1. Subject, start and duration

This DPA forms part of the MyRecruit.App agreement and applies from activation of the free account whenever the Provider processes personal data for the Customer. It continues through free and any subsequent paid use until all Customer Data has been returned or deleted. Instructions may be given in text form, through application functions or agreed settings.

2. Nature and purpose

Processing includes collection, recording, organization, storage, alteration, retrieval, consultation, use, transmission, making available, restriction, export and erasure as needed to provide, secure, maintain and support MyRecruit.App.

Purposes: enabled contact, recruiting, business transaction, document, invoice, expense and related modules; support, backup and user-triggered AI functions.

3. Data and data subjects

Data: identity, contact, communications, contract, applicant, qualification, employee, customer, supplier, financial, invoice, payment, document, usage and log data. Special-category data is processed only where the Customer lawfully submits it and it is necessary.

Data subjects: applicants, candidates, employees, users, contacts, customers, prospects, suppliers, providers and business partners.

4. Customer duties

• The Customer is responsible for lawfulness, transparency, legal bases, data-subject rights and instructions.
• It limits data, manages permissions and promptly reports unauthorized access.
• It identifies special protection needs and reviews AI output before use.
• Instructions beyond the agreed service may be charged separately.

5. Provider duties

• Process only on documented instructions unless law requires otherwise and notify the Customer of apparently unlawful instructions.
• Bind authorized persons to confidentiality and maintain Annex 1 TOM.
• Assist with rights requests, DPIAs, consultations and compliance evidence as reasonably possible.
• Notify the Customer without undue delay of a Customer Data breach and provide available Art. 33(3) GDPR information.
• Maintain required records and supply information needed to demonstrate Art. 28 compliance.

6. Sub-processors

The Customer generally authorizes the following sub-processors. Additions or replacements will be announced at least 30 days in advance to the administrator email or in the application. The Customer may object on substantiated data-protection grounds; if no reasonable solution is found, the affected service may be terminated for cause.

The Provider imposes substantially equivalent data-protection duties on sub-processors. Google reCAPTCHA used for registration is outside Customer processing and is described in the Privacy Policy.

7. International transfers

Customer Data is processed outside the EEA only on documented instruction or under Art. 44 et seq. GDPR, including an adequacy decision or EU Standard Contractual Clauses with required supplementary measures. Evidence is available on request.

8. Audits

With reasonable notice, the Customer may request evidence or a proportionate audit once per year and when an incident justifies it. Existing certificates, reports and documentation are used first. Audits must protect security, confidentiality and other customers; unreasonable additional effort may be charged.

9. Return and deletion

At service end, personal Customer Data is returned in an available, commonly used format or deleted at the Customer's choice unless retention law applies. During free use, return may be provided through available self-service exports or another suitable standard format; no individually prepared handover or migration package is owed unless mandatory law requires otherwise.

Customers with a SaaS Agreement receive the tenant-specific standard export described in the Main Agreement. Required data return and standard operations necessary for a legally protected provider switch are not made conditional on an additional switching charge. Separately requested bespoke formats, cleansing, mapping or migration consulting may be charged by prior agreement. When the free account ends, productive data is deleted within 30 days unless a subsequent agreement applies. Backups are overwritten under documented cycles and until then used only for recovery and security.

10. Liability and final terms

Art. 82 GDPR and the permitted Main Agreement terms govern liability. This DPA prevails for data-protection conflicts. Electronic acceptance at registration or contract formation satisfies Art. 28(9) GDPR.

1. Organization and confidentiality

• Confidentiality commitments and need-based permissions for authorized persons.
• Physical data-center safeguards maintained by IONOS and AWS.
• Individual accounts; passwords stored using a recognized hashing method.
• Role, team and tenant access rules and logical separation of Customer Data.

2. Integrity and transmission

• TLS encryption in transit.
• Server-side encryption of stored documents under the deployed AWS S3 bucket configuration.
• Logging of security-relevant and business-relevant access and changes where required for traceability.
• Controlled software changes and patch/dependency management.

3. Availability and recovery

• Hosting, storage and network safeguards of the infrastructure providers.
• Defined backup, recovery and deletion procedures; backup access limited to authorized purposes.
• Operational monitoring and security-incident handling and escalation procedures.

4. Privacy-oriented procedures

• Data minimization, purpose-based permissions and deletion functions.
• Risk-based and event-based review of permissions, safeguards and sub-processors.
• AI functions run only on user action and require human review.
• Safeguards are updated in line with technology, risk and processing changes.