1. Introduction

The Data Protection Agreement (hereinafter the "Agreement") is intended to govern the use of the Personal Data of the clients (hereinafter the "Client") of DB Global Limited (hereinafter the "Processor" or "DB Global Limited") when they use the Hiros platform service (hereinafter the "Service").

2. Definitions

The terms "adequacy decision", "technical and organisational measures", "data subjects", "data protection by design", "data protection by default", "record", "joint controller(s)", "controller", "processor", "processing", "personal data breach" used in the Agreement have the meanings set out in Article 4 et seq. of the GDPR.

The other terms are defined below:

• "Agreement": means the annex to the Contract governing the use of the Client's Personal Data in accordance with the provisions of Article 28 of the GDPR, also referred to as the "Data Processing Addendum" ("DPA")

• "DPIA": means a data protection impact assessment used to verify the proportionality of Personal Data processing and to prevent risks associated with the processing of Personal Data

• "Anonymisation": means processing intended to irreversibly prevent the identification of the data subjects affected by the processing carried out under the Service

• "Supervisory Authority": means the data protection supervisory authority with jurisdiction over the Service provided by the Processor

• "Client": means the entity that has subscribed to the Service provided by the Processor

• "Contract": means the contract entered into between the Processor and the Client for the use of the Service, to which this Agreement is annexed

• "Data Subject Request(s)": means the fundamental right(s) created by the GDPR under Articles 15 et seq. (e.g. right of access, right to erasure, etc.).

• "Client Personal Data": means any data relating to an identified or identifiable natural person transmitted to the Processor and processed by it on behalf of the Client under the Service, the detailed list of which is set out in the annex

• "Party(ies)": means the Client and the Processor jointly

• "GDPR": means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, also referred to as the "General Data Protection Regulation"

• "Applicable Data Protection Regulations": means, together, the Data Protection Act 2018 (DPA) and the GDPR

• "Reversibility": means the operation intended to enable the transfer and integration, in a usable and recognised format, of the Client Personal Data from the Processor's Service to an equivalent service offered by another provider

• "SaaS Service": means software hosted by the Processor that can be used simultaneously by an unlimited number of clients

• "Sub-processor": means the sub-processors engaged by the Processor to process the Client Personal Data exclusively in connection with the Service

• "End Users": means the individuals whose Personal Data is processed by the Processor on behalf of the Client

3. Contractual Relationship and Term

The Agreement is an inseparable annex to the Contract signed between the Client and the Processor for the use of the Service.

In the event of a conflict between the Contract entered into for the use of the Service and the Agreement, the obligations set out in the Agreement shall prevail over the Contract with respect to the GDPR as a whole.

The Agreement applies for the entire term of the Contract entered into for the use of the Service and may continue thereafter for as long as the obligations set out herein remain applicable.

4. Role of the Parties and Scope

Under the Agreement, the Client acts as controller of the processing activities and DB Global Limited acts as processor within the meaning of Article 28 of the GDPR.

Under no circumstances may the Parties be regarded as joint controllers in connection with the Service. However, the Parties agree that, in the event of an error or a change in their respective qualification, they shall meet as soon as possible to amend the Agreement and take all measures relating to such situation in order to comply with the requirements of the Applicable Data Protection Regulations.

The Agreement governs exclusively the processing of Client Personal Data carried out under the Service in the capacity of Processor within the meaning of Article 28 of the GDPR, to the exclusion of any processing carried out by DB Global Limited as controller, which is governed by the Contract.

5. Instructions and Undertakings

The Processor undertakes to use the Client Personal Data in connection with the use of the Service only on the basis of the documented instructions set out in the annex to the Agreement. The Processor shall immediately inform the Client if it considers that an instruction given by the Client is unlawful under the Applicable Data Protection Regulations.

The Processor's liability may not be engaged where, despite the Processor's notification regarding the unlawfulness of the instruction, the Client maintains and applies that instruction through the Service.

The Processor undertakes to comply with the provisions of the GDPR and, in particular, to maintain a record of processing activities specific to the Service and to develop its Service in compliance with the "data protection by design" and "data protection by default" principles.

The Processor undertakes never to transfer the Client Personal Data for purposes other than the provision of the Service, and undertakes never to use the Client Personal Data for its own purposes as a controller.

The Processor represents that all internal or external personnel who process the Client Personal Data are bound by one or more binding legal instruments and regularly receive training and awareness sessions.

The Processor undertakes to guarantee the security of the Client Personal Data and to implement all technical and organisational measures necessary for its Service, the details of which are set out in the annex to the Agreement.

Conversely, the Processor shall never be liable for the Client's breaches of the Applicable Data Protection Regulations when the Client uses the Service as controller.

6. Assistance with Carrying Out DPIAs

DPIAs must be carried out by the Client, in accordance with the provisions of the GDPR. Nevertheless, the Processor undertakes to provide, upon the Client's written request, all information necessary and required to enable the Client to carry out a DPIA.

The Processor is, however, not required to carry out DPIAs in place of, and on behalf of, the Client. Any request going beyond the provision of information may be refused.

7. Assistance with Data Subject Requests

Data Subject Requests sent by End Users are forwarded to the Client as soon as possible. The Processor is not required to keep a log of Data Subject Requests on behalf of the Client and is not liable for the Client's failures in handling Data Subject Requests.

The Processor shall carry out, upon the Client's written request, the technical actions required to enable the Client to fulfil its obligation to respond to data subjects' requests.

The Client accepts and understands that the Processor is not required to handle Data Subject Requests made under the Service in place of, and on behalf of, the Client. Any further request to that effect shall be refused.

Data Subject Requests sent to the Processor in its capacity as controller are handled exclusively by the Processor and are not forwarded to the Client.

8. Assistance with Security Measures

The Processor undertakes to provide all information necessary and required regarding the technical and organisational security measures to be implemented to guarantee the security of the Client Personal Data in connection with the provision of the Service.

9. Personal Data Breaches

The Processor undertakes to notify the Client, as soon as possible and, at the latest, within 48 business hours of becoming aware of it, of any personal data breach related to the Service that is likely to affect the Client Personal Data, together with all information necessary and required in its possession to mitigate the effects of the personal data breach.

The Client accepts and acknowledges that the 72-hour period applicable to it only begins to run from the time it becomes aware of the personal data breach and that, on this basis, the 48-business-hour period complies with the GDPR.

The Processor is not authorised to handle personal data breach notifications to the Supervisory Authority or to inform End Users on behalf of the Client. Any request to that effect from the Client shall be refused.

10. Sub-processors

The Client grants the Processor general authorisation to engage Sub-processors, provided that it is informed of any change to such Sub-processors as soon as possible so as to allow the Client to raise objections. The Client accepts and acknowledges that specific authorisation is not applicable in the case of a SaaS tool and could result in the Service being blocked.

In the absence of any objection raised by the Client within eight (8) days of the notification, the new Sub-processor shall be definitively engaged and the Client may not oppose this, claim damages, or request termination of the Contract. If an objection raised within the time limit is considered admissible by the Processor, the Processor may offer the Client one of the following solutions: i) withdrawal of the Sub-processor, ii) implementation of additional measures to guarantee the security of the Client Personal Data, or iii) discontinuation of the Service, without the Client being entitled to claim damages.

To be considered admissible by the Processor, objections must be objective, serious and duly substantiated. The Parties agree that the following situations shall, by default, be considered admissible: i) the proposed Sub-processor is a direct competitor of the Client, ii) the Sub-processor is in a dispute with the Client, iii) the Sub-processor has been sanctioned by a Supervisory Authority within the 12 months preceding its engagement, and iv) the Sub-processor fails to comply, where applicable, with the rules applicable to transfers outside the European Union.

The Processor undertakes to engage only Sub-processors which, following review, provide sufficient guarantees to ensure the security and confidentiality of the Client Personal Data. The relationship between the Processor and the Sub-processor must be governed by an agreement imposing obligations similar to those set out in this Agreement.

The Processor remains liable, within the limits of liability set out in the Contract, for any breaches of the GDPR that its Sub-processors may commit in connection with the Service.

11. Hosting and Transfers Outside the European Union

a) Data Hosting

The Processor undertakes to use its best efforts to host the Client Personal Data exclusively within a Member State of the European Union. The Client authorises the Processor to choose the Member State of the European Union of its choice. Where the Personal Data is hosted in a country located outside the European Union, the Processor undertakes to obtain the Client's prior authorisation and to implement all mechanisms required to govern such transfer, such as entering into Standard Contractual Clauses, and, where applicable, to implement additional technical measures to strengthen the security of the Client Personal Data.

b) Data Transfers

The Client grants the Processor general authorisation to make transfers outside the European Union provided that, cumulatively, i) such transfers are made exclusively to GDPR-compliant Sub-processors, and ii) such transfers are made exclusively to a country benefiting from an adequacy decision or are governed by appropriate safeguards, such as, in particular, Standard Contractual Clauses. If these conditions are not met, transfers outside the European Union shall only be authorised with the Client's prior consent. Additional technical security measures to strengthen the security of the Client Personal Data must be implemented where the Personal Data is transferred to a non-democratic country.

12. Retention Periods and Fate of the Client Personal Data

The Processor undertakes to retain the Client Personal Data only for the duration of the use of the Service, in accordance with the detailed instructions set out in the annex, and to delete it at the end of the Contract. The Processor shall certify, upon written request, the deletion of the Personal Data and of all existing copies.

The Client is informed that it must retrieve its Personal Data before the end of the Agreement. Failing this, the Client will no longer be able to retrieve its Personal Data, as the deletion of the Personal Data is irreversible and final. The Processor cannot be held liable for any loss of Personal Data after its deletion, and the Client shall bear sole responsibility for such loss. The Client accepts that the complete, irreversible and final anonymisation of the Client Personal Data may be used as a method of deletion and that the Processor may retain the anonymised data to improve the Service, as is accepted by Supervisory Authorities.

The Processor informs the Client that the return of Personal Data provided for under the GDPR does not constitute Reversibility of the data to a new processor, and that any request to that effect will always be refused by the Processor.

13. Audits

The Client has the right to carry out an audit in the form of a written questionnaire once a year to verify compliance with this Agreement. The questionnaire has the force of a sworn undertaking binding on the Processor. The questionnaire may be sent to the Processor in any form, and the Processor undertakes to respond to it as soon as possible after receipt.

The Client also has the right to carry out, once a year and at its own expense, an on-site audit, where applicable at the Processor's premises, in the event of a data breach resulting from a proven and demonstrated failure by the Processor that has caused duly justified harm to the Client. An audit at the Processor's premises may be carried out either by the Client or by an independent third party appointed by the Client, and must be notified in writing to the Processor at least thirty (30) days before the audit is carried out. The Processor has the right to refuse the choice of independent third party if the latter is i) a direct or indirect competitor of the Processor, ii) in a conflict of interest with the Processor (e.g. an adviser to a competitor of the Processor), or iii) in pre-litigation or litigation with the Processor. In such a case, the Client undertakes to choose a new independent third party to carry out the audit. The Processor may refuse access to certain areas for confidentiality or security reasons. In such a case, the Processor shall carry out the audit in those areas and communicate the results to the Client.

If a discrepancy is identified in the course of the audit, the Processor undertakes to implement, without delay and at its own expense, the measures necessary to comply with this Agreement. Discrepancies may only relate to the Applicable Data Protection Regulations concerning the Client Personal Data and may not relate to procedures or internal measures implemented by the Client for its own specific purposes. Discrepancies must be duly demonstrated, justified and documented.

If the Processor disputes the discrepancies identified, the Processor may, at its discretion and subject to the Client's prior written acceptance, propose to i) meet in order to find an amicable solution and reach a compromise, ii) refer the dispute to the Supervisory Authority for arbitration, or iii) refer the dispute to an independent expert for arbitration.

14. Cooperation with the Authorities

The Processor undertakes to cooperate with the ICO, the competent Supervisory Authority, in the event of an inspection concerning the processing carried out under the Service, and undertakes to notify the Client as soon as possible of any requests concerning its Personal Data made by the Supervisory Authority or by an administrative, judicial or police authority.

The Processor undertakes to cooperate with the competent Supervisory Authority in the event of an inspection concerning the processing carried out under the Service, and undertakes to notify the Client as soon as possible of any requests concerning its Personal Data made by the Supervisory Authority or by an administrative, judicial or police authority.

15. Contact

The Client and the Processor shall each designate a contact person responsible for this Agreement, who shall be the recipient of the various notifications and communications to be made under the Agreement.

The Processor informs the Client that it has appointed the company Dipeeo SAS as Data Protection Officer, who can be contacted using the following details:

• Email address: legal@gethiros.com

• Postal address: Dipeeo SAS, 95 avenue du Président Wilson, 93100 Montreuil, France

• Phone number: 01 59 06 81 85

16. Amendments

The Processor reserves the right to amend this Agreement in the event of changes to the rules applicable to the protection of Personal Data or in the event of changes to the Service that would affect any of its provisions.

DPA Annexes

Annex 1 - Client's Detailed Instructions

1. List of Processing Activities

1.1. Purposes and Legal Bases

The Service provided by the Processor is intended to provide an AI recruitment agent enabling candidates to be sourced and contacted by email. On this basis, the Processor implements the following processing activities:

• Duplication of the Client Personal Data on backup servers

• Management of the Client Personal Data under the Service

• Management of features using artificial intelligence

• Email management

• Management of the security and maintenance of the Service

• Hosting of the Client Personal Data database

The processing activities implemented are carried out exclusively for the performance of the Contract.

1.2. Data Subjects

The data subjects concerned under the Service are:

• End Users

• Third parties: sourced candidates

1.3. Processing Operations

The processing operations carried out under the Service are detailed below:

• Adaptation

• Disclosure to Sub-processors

• Storage

• Collection

• Recording

• Alteration

• Organisation

• Erasure

• Use

1.4. Categories of Data Processed

The Client Personal Data processed under the Service are as follows:

• "Standard" data of End Users:

  • Identification and contact data

• "Standard" data of candidates:

  • Identification and contact data

  • Data relating to professional life

1.5. Retention Periods

The Client Personal Data is retained for the duration of the performance of the contract.

2. Security Measures

2.1. Technical Security Measures

• Two-factor authentication for Service users

• Two-factor authentication for Back-office Users

• Database encryption

• HTTPS platform

• Access traceability

2.2. Organisational Security Measures

• Information systems charter

• Access authorisation procedure

• Procedure for handling End User Data Subject Requests

• Personal data breach procedure

• Code of conduct

• Awareness training twice a year

Annex 2 - Inventory of Sub-processors and Transfers Outside the EU

Sub-processor

Purpose

Location

Safeguards

Claude

AI model

European Union for the client database

No transfer outside the EU for the client database

OpenAI

AI model

European Union for the client database

No transfer outside the EU for the client database

Supabase

Backup servers

United Kingdom

Adequacy decision

Supabase

Database hosting

United Kingdom

Adequacy decision