Addendum to General Terms and Conditions CVWarehouse concerning Data Processing
This addendum (“Addendum”) stipulates how CVWarehouse (“CVW”) processes Personal Data as a Processor on behalf of the Customer, being a Controller. This Addendum shall form an integral part of the agreement -including the CVW general terms and conditions- (“Agreement”) between CVW and the Customer. The provisions of the Agreement shall fully apply to this Addendum unless explicitly stated otherwise, and more specifically, any provisions in the Agreement relating to data protection shall be complemented by the terms of this Addendum. This Addendum shall not alter any provisions of the Agreement that fall outside of the scope of its subject.
The purpose of this Addendum is to determine the mutual rights and responsibilities of Parties in the light of the current local privacy regulations and the new EU privacy regulation (2016/679) of 27 April 2016, effective from 25 May 2018 onwards (together: “Data Protection Regulation”). All definitions, such as "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", “Third Party” and "Processing" shall have the same meaning as in the Data Protection Legislation.
1.1 - Under the Agreement, Personal Data is processed as follows:
- Subject, nature and purpose of Processing: CVW provides the Customer with a digital platform to process the Personal Data of candidates that apply for a position with the Customer.
- Duration of Processing: during the term of the Agreement.
- Categories of Personal Data: identification data, contact data, information regarding employment and education and any other (possibly sensitive) information a candidate would share through its CV.
- Categories of Data Subjects: candidates for a position with the Customer, representatives of Customer.
1.2 - Where Personal Data is processed by CVW, its sub contractors (“Sub-Processors”) or employees under or in connection with the Agreement, CVW shall, and shall procure that its Sub Processors and employees shall:
- undertake to foresee at all times fitting and appropriate technical and organizational measures to comply with Data Protection Regulation;
- only Process the Personal Data (including the deletion of Personal Data) or disclose the Personal Data to any Third Party in accordance with the Customer's instructions as stated in the Agreement and this Addendum or where required by law, in which case CVW shall inform the Customer of such a legal requirement before commencing the processing of Personal Data, unless that law prohibits such information being provided to the Customer;
- take reasonable steps to ensure that all employees and Sub-Processors who may have access to the Personal Data are informed of the confidential nature of the Personal Data and are subject to confidentiality undertakings with respect to (the Processing of) such Personal Data;
- notify the Customer without undue delay upon becoming aware of a Personal Data Breach, and otherwise assist the Customer, taking into account the nature of Processing and the information available to CVW, in meeting its obligations regarding the notification, investigation, mitigation and remediation of a Personal Data Breach under the Data Protection Legislation, without prejudice to CVW’s right to charge the Customer any reasonable costs for such assistance;
- co operate as reasonably requested by the Customer, to the extent necessary to enable the Customer to comply with any exercise of rights by a Data Subject under the Data Protection Legislation in respect of Personal Data processed by CVW under the Agreement or comply with any assessment, enquiry, notice or investigation under the Data Protection Legislation, including by any regulator, without prejudice to CVW’s right to charge the Customer any reasonable costs for such assistance;
- only authorize Sub-Processors (whereas this Addendum forms a general consent of the Customer to use Sub-Processors) to Process the Personal Data, subject to (i) informing the Customer of the identity of a new Sub-Processor (that replaces or complements an existing Sub-Processor) beforehand at which point Customer has the right to object to a Sub-Processor on reasonable grounds and (ii) including terms in the contract between CVW and the Sub-Processor which are substantially the same as those set out in this clause 1 and (iii) CVW remaining fully liable to the Customer, in accordance with the terms of the Agreement relating to liability, for any failure by a Sub-Processor to fulfil its obligations in relation to the Processing of any Personal Data;
- cease Processing the Personal Data upon the termination or expiry of the Agreement and, at the Customer's option, either return or delete the Personal Data and any copies of it or of the information it contains, without prejudice to any EU or Member State legal obligation to further store such Personal Data;
1.3 - Upon request, CVW shall make available to the Customer all information necessary to demonstrate compliance with its obligations under this Addendum and allow for and contribute to audits, including inspections, conducted by the Customer or/and an auditor mandated by the Customer, without prejudice to CVW’s right to charge the Customer any reasonable costs for such assistance.
1.4 - CVW shall provide reasonable assistance to the Customer related to a data protection impact assessment and prior consultations with the competent data privacy authority, if and when the Customer reasonably considers this to be necessary under article 35 or 36 of the Data Protection Regulation, solely in relation to the Processing of Personal Data by CVW, without prejudice to CVW’s right to charge the Customer any reasonable costs for such assistance.