Effective Date: 30 June 2026
1. PURPOSE
This Data Processing Addendum ("DPA") forms part of the contractual relationship between Jobultimator ("Jobultimator", "Processor", "Subprocessor", or "Service Provider") and any Employer, Recruiter, Enterprise Customer, Agency, Organization, or other business customer ("Customer").
This DPA supplements:
• Terms of Service
• Enterprise Subscription Agreement
• Employer Agreement
• Recruiter Agreement
• Privacy Policy
This DPA applies whenever Jobultimator processes Personal Data on behalf of a Customer.
2. COMPLIANCE FRAMEWORK
This DPA is intended to support compliance with:
United Kingdom
• UK GDPR
• Data Protection Act 2018
European Union
• EU GDPR
• European Data Protection Board guidance
United States
• CCPA
• CPRA
• Applicable state privacy laws
Canada
• PIPEDA
Australia
• Privacy Act 1988
India
• Digital Personal Data Protection Act
Singapore
• PDPA
Japan
• APPI
South Korea
• PIPA
UAE
• UAE Personal Data Protection Law
Saudi Arabia
• Saudi Personal Data Protection Law
3. DEFINITIONS
Personal Data
Any information relating to an identified or identifiable natural person.
Processing
Any operation performed on Personal Data including:
• Collection
• Recording
• Storage
• Analysis
• Transfer
• Disclosure
• Deletion
Controller
Entity determining purposes and means of processing.
Processor
Entity processing Personal Data on behalf of a Controller.
Data Subject
Individual whose Personal Data is processed.
Security Incident
Any unauthorized access, disclosure, destruction, loss, alteration, or misuse of Personal Data.
4. PARTIES
Customer
Acts as Controller for Customer Data.Jobultimator
Acts as Processor when processing Customer Data. In certain circumstances Jobultimator may act as an independent Controller.
5. SUBJECT MATTER OF PROCESSING
Jobultimator provides:
• Recruitment platform services
• Candidate management tools
• Employer services
• Recruiter services
• Messaging services
• AI-assisted recruitment services
• Analytics services
6. NATURE OF PROCESSING
Processing activities may include:
• Collection
• Storage
• Retrieval
• Analysis
• Matching
• Ranking
• Transmission
• Hosting
• Security monitoring
• Deletion
7. PURPOSE OF PROCESSING
Processing may occur for:
• Recruitment
• Hiring
• Candidate sourcing
• Candidate evaluation
• Messaging
• Subscription management
• Security
• Fraud prevention
• Compliance
• Platform administration
8. CATEGORIES OF DATA SUBJECTS
Data Subjects may include:
• Candidates
• Employees
• Contractors
• Freelancers
• Recruiters
• Hiring managers
• Customer personnel
• Platform users
9. CATEGORIES OF PERSONAL DATA
Personal Data may include:
Identity Information
• Names
• Usernames
• Identification numbers
Contact Information
• Email addresses
• Telephone numbers
• Addresses
Employment Information
• Job history
• Salary expectations
• Professional experience
Education Information
• Degrees
• Qualifications
• Certifications
Technical Information
• IP addresses
• Device identifiers
• Usage information
Communications
• Messages
• Support requests
• Platform interactions
10. SPECIAL CATEGORY DATA
Customers shall avoid uploading Special Category Data unless necessary and lawful.
Where Special Category Data is processed:
• Appropriate safeguards shall apply.
• Processing shall occur only where legally permitted.
11. PROCESSOR OBLIGATIONS
Jobultimator shall:
• Process data only on documented instructions
• Implement security controls
• Maintain confidentiality
• Assist with compliance requests
• Notify Customers of Security Incidents
• Delete or return data when required
12. CONFIDENTIALITY
Jobultimator personnel with access to Personal Data shall be subject to:
• Confidentiality obligations
• Security requirements
• Appropriate training
13. SECURITY MEASURES
Jobultimator shall maintain reasonable technical and organizational measures including:
Access Controls
• Role-based access
• Least privilege principles
Authentication
• Strong authentication controls
• Multi-factor authentication where appropriate
Encryption
• Encryption in transit
• Encryption at rest where appropriate
Monitoring
• Logging
• Monitoring
• Threat detectionBusiness Continuity
• Backups
• Disaster recovery procedures
14. CUSTOMER RESPONSIBILITIES
Customers remain responsible for:
• Lawful collection of Personal Data
• Legal bases for processing
• Candidate notices
• Data accuracy
• User permissions
• Compliance obligations
15. DATA SUBJECT RIGHTS
Jobultimator shall assist Customers in responding to requests involving:
• Access
• Correction
• Deletion
• Restriction
• Portability
• Objection
• Human review requests
Customers remain responsible for final responses.
16. SECURITY INCIDENTS
Jobultimator shall maintain procedures for identifying and managing Security Incidents.
Upon becoming aware of a Security Incident affecting Customer Data, Jobultimator shall:
• Investigate the incident
• Mitigate impacts
• Notify the Customer without undue delay
• Provide available information reasonably necessary for compliance
17. BREACH COOPERATION
Jobultimator shall reasonably cooperate with Customers regarding:
• Regulatory notifications
• Data Subject notifications
• Investigations
• Remediation activities18. SUBPROCESSORS
Jobultimator may engage Subprocessors.
Subprocessors may provide:
• Cloud hosting
• Storage
• Analytics
• Security services
• Payment processing
• Communication services
Jobultimator shall maintain appropriate agreements with Subprocessors.
19. SUBPROCESSOR OBLIGATIONS
Subprocessors shall be subject to obligations materially equivalent to those imposed on Jobultimator under this
DPA.
20. INTERNATIONAL TRANSFERS
Customer Data may be processed internationally.
Transfers may rely upon:
United Kingdom
• UK International Data Transfer Agreement (IDTA)
European Union
• Standard Contractual Clauses (SCCs)
Other Jurisdictions
• Adequacy decisions
• Approved safeguards
• Contractual protections
21. AI PROCESSING
Jobultimator may use AI systems to:
• Match candidates
• Rank search results
• Generate insights
• Detect fraud
• Improve services
AI processing shall be subject to:
• Privacy controls• Security controls
• Human oversight measures
22. AUDIT RIGHTS
Customers may request information reasonably necessary to demonstrate compliance. Jobultimator may satisfy audit obligations through:
• Certifications
• Compliance reports
• Security documentation
• Questionnaires
Direct audits may be subject to reasonable limitations.
23. RECORDS OF PROCESSING
Jobultimator may maintain records regarding:
• Processing activities
• Security incidents
• Compliance activities
• Subprocessors
24. DATA RETENTION
Personal Data shall be retained only as necessary for:
• Service delivery
• Legal compliance
• Security
• Fraud prevention
• Legitimate business purposes
Retention schedules may vary.
25. RETURN OR DELETION OF DATA
Upon termination of services and subject to legal requirements:
Jobultimator may:
• Return Customer Data
• Delete Customer Data
• Anonymize Customer Data
Certain information may be retained where required by law.
26. REGULATORY COOPERATION
Jobultimator may cooperate with:• Supervisory authorities
• Courts
• Regulators
• Government agencies
where legally required.
27. LIMITATION OF LIABILITY
Liability under this DPA shall be governed by the applicable agreement between the parties unless prohibited by law.
28. TERM
This DPA remains in effect while Jobultimator processes Personal Data on behalf of the Customer.
29. GOVERNING LAW
Unless otherwise required by applicable law, this DPA shall be governed by the laws of England and Wales.
30. CONTACT DETAILS
Website: www.jobultimator.com
Data Protection Officer: dpo@jobultimator.com
Privacy Team: privacy@jobultimator.com
Legal Department: legal@jobultimator.com
Compliance: compliance@jobultimator.com
Effective Date: 30 June 2026
