This Data Processing Agreement (hereinafter the “Agreement”) with regards to the processing of Personal Data (as defined hereinafter) is entered into between:
i) Saply.ai (hereinafter “Saply” and/or the “Processor”); and
ii) You being a customer of Saply (hereinafter the “Customer” and/or “Controller”) and the party for which Saply performs certain Services (as defined hereinafter).
This Agreement forms an integral part of the General Terms and Conditions, Commercial Offer, Statement of Work and/or other contractual agreements or documentations as agreed upon between the Controller and the Processor for the performance of Processor’s Services (hereinafter: the ‘Main Agreement’’).
This Agreement sets forth the terms and conditions pursuant to which Personal Data will be processed in the framework of the Main Agreement.
The Controller and the Processor will be referred together as the “Parties” and individually as a “Party” hereafter.
This Agreement regarding the processing of Personal Data was drafted and entered into in order for the Parties to comply with the obligations set forth in the General Data Protection Regulation 2016/679 of the European Parliament and the Council of 27 April 2016 (hereafter the “GDPR” or the “Regulation”). This Agreement contains the rights and obligations of the Controller and the Processor with regard to the processing of Personal Data.
Definitions
For the purpose of this Agreement, the following definitions apply:
“Agreement” shall mean this data protection agreement;
“Confidential Information” of a Party means the information of such Party, whether in written, oral, electronic or other form, and which (i) is explicitly marked as confidential or proprietary, or (ii) should reasonably be considered confidential or is traditionally recognized to be of a confidential nature, regardless of whether or not it is expressly marked as confidential, including but not limited to, information and facts concerning business plans, customers, prospects, personnel, suppliers, partners, investors, affiliates or others, training methods and materials, financial information, marketing plans, sales prospects, client lists, inventions, program devices, discoveries, ideas, concepts, know-how, techniques, formulas, blueprints, software (in object and source code form), documentation, designs, prototypes, methods, processes, procedures, codes, and any technical or trade secrets, including all copies of any of the foregoing or any analyses, studies or reports that contain, are based on, or reflect any of the foregoing. The Confidential Information of Saply shall include, without limitation, the Licensed Materials;
“Commercial Offer” shall mean the commercial offer between the Processor and the Controller;
“Controller” shall mean the natural or legal person, public authority, agency or any other body which, alone or jointly with others, that determines the purposes and means of the processing of Personal Data carried out under his authority, for the purposes of this Agreement understood to be the Controller;
“Data Subject” shall mean an identified or identifiable natural person;
“General Terms and Conditions” shall mean the general terms and conditions of the Processor;
“Employee” means an individual who is hired by an employer and has entered into or works under a contract of employment for the provision of labour services in exchange for a wage or a fixed payment. An Employee does not provide professional services as part of an independent business. Agents, distributors, advisors, consultants, freelancers, (independent) (sub)contractors or any other third party are not considered Employees for the purposes of this Agreement;
“Personal Data” shall mean all information relating to a Data Subject;
“Personal Data Breach” shall mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
“Processor” shall mean a natural or legal person, public authority, agency or any other body which is authorised to process Personal Data on behalf of the controller, such as Processor;
“Security Measures” shall mean those measures aimed at protecting Personal Data against accidental or unlawful destruction or loss, as well as against non-authorised access, alteration or transmission;
“Services” shall mean the right to use the Product, Customizations, Maintenance Services, Professional Services and Hosting Services provided by Saply, in the context of services performed by Processor for the Controller, as described in the Main Agreement;
“Statement of Work” shall mean the statement of work between the Controller and the Processor;
“Subprocessor” shall mean any Processor engaged as a subcontractor by the Processor and who agrees to process Personal Data for and on behalf of the Controller in accordance with this Agreement;
“Supervisory Authority” shall mean an independent public authority which is established by a member state pursuant to Article 51 of the Regulation;
“Third Party” shall mean any party who is not a Data Subject, Controller, Processor or Subprocessor under this Agreement or a person who is authorised to process Personal Data under the direct authority of the Controller or Processor.
2. Subject Matter of the Agreement
The Controller wishes to entrust the Processor with the processing of Personal Data. The Processor shall process the Personal Data in name of and on behalf of the Controller. For the performance of Services, the Controller is responsible for the processing of personal data, and the Processor is a data Processor.
The Processor performs the Services in accordance with the provisions of this Agreement.
Both Parties explicitly commit to comply with the provisions of the relevant applicable data protection laws and shall not do or omit anything that may cause the other Party to infringe the relevant and applicable data protection laws.
Processing Activities. The processing carried out by the Processor in name and on behalf of the Controller relates to the Services performed by the Processor. The Processing Activities consist of:
Use, performance, delivery and improvement of the Services and internal business purposes
Machine learning and statistical and scientific studies
Categories of Personal Data. The Personal Data that are processed are data relating to individuals about whom data is provided to the Processor via the Services by or at the direction of the Controller or by the end users of the Controller.
Data Subjects. The Data Subjects include the individuals about whom data is provided to the Processor via the Services by or at the directions of the Controller or by the end users of the Controller.
Purposes. The Processor shall only use the Personal Data to ensure a good performance and delivery of the Services in accordance with the provisions of this Agreement. Moreover, the Processor shall be allowed to process the Personal Data to improve the Services.
Only those Personal Data which are mentioned in Articles 2.5 and 2.6 may and shall be processed by the Processor. Furthermore, Personal Data shall only be processed in light of the purposes which are determined in this Article by the Parties.
Both Parties shall undertake to adopt appropriate measures to ensure that the Personal Data are not used improperly or acquired by an unauthorised Third Party.
3. Duration of the Processing
This Agreement shall apply as long as the Processor processes Personal Data in name of and on behalf of the Controller as part of the Services.
In the event of a breach of this Agreement or the applicable provisions of the Regulation, the Controller can instruct the Processor to stop further processing of the Personal Data with immediate effect.
In the event of the end of the commercial relationship or delivery of Services by the Processor, the Processor shall delete or return the Personal Data in accordance with the Data Retention article of this Agreement. The Processor may keep Personal Data beyond that point only in anonymised form, from which no Data Subject can be identified, solely for the following internal purposes:
To comply with legal obligations and further improve the Services delivered by the Processor.
Data Retention
The Processor deletes Personal Data submitted to the Services for processing, such as formatting, tailoring or matching a CV, within seven (7) calendar days of processing, unless the Controller or its end users save that Personal Data in the CV database of the Services or Union or Member State law requires further storage.
Personal Data saved in the CV database is retained for the duration of the Main Agreement so that the Controller and its end users can access, reuse and manage documents and candidate profiles previously processed through the Services. Upon termination or expiry of the Main Agreement, or earlier upon written instruction of the Controller or deletion by an end user, the Processor shall delete or return that Personal Data within thirty (30) calendar days, unless Union or Member State law requires further storage.
Copies of Personal Data held in encrypted backups shall be purged within ninety (90) calendar days after deletion and shall remain protected by the Security Measures until purged. The Processor shall certify deletion in writing upon request of the Controller.
The Controller may at any time instruct the Processor to delete specific Personal Data, for example following a request of a Data Subject, and the Processor shall comply within thirty (30) calendar days.
4. Controller’s Instructions
The Processor processes the Personal Data only on the instructions of the Controller and in any case in accordance with the agreed Processing Activities as set out in Article 2.4 of this Agreement in order to perform the Services. The Processor shall not further process the Personal Data subject to this Agreement in a manner which is incompatible with these instructions and the provisions laid down in this Agreement.
The Controller can make limited changes to the instructions unilaterally. The Processor shall be consulted before any significant changes are made to the instructions. Changes affecting the core of the Agreement must be agreed upon by both Parties.
The Processor processes the Personal Data in accordance with Article 4.1 of this Agreement, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Union or Member State law to which Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
Assistance to the Controller
Compliance with legislation. The Processor shall assist the Controller in ensuring compliance with its obligations pursuant to the Regulation, taking into account the nature of processing and the information available to the Processor.
Personal Data Breach. In the case of a Personal Data Breach related to the subject of the processing of this Agreement, the Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach.
The nature of the Personal Data Breach;
The categories of Personal Data that are affected;
The categories and approximate number of Data Subjects concerned;
The categories and approximate number of personal data records concerned;
The likely consequences of the Personal Data Breach;
Measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
In case the Processor makes use of a Subprocessor, the Processor shall require the Subprocessor to provide it with the same information when a Personal Data Breach takes place at the Subprocessor. The Processor shall promptly relay the information received from the Subprocessor to the Controller.
The Processor and its Subprocessor(s) shall appoint among their Employee a single point of contact who shall be responsible for all communication between the Processor, the Subprocessor(s) and the Controller in the event of an incident which has led or may lead to an accidental or non-authorised destruction or loss or a non-authorised access, alteration or transmission of the Personal Data processed on behalf of Controller.
The Controller shall exclusively decide, at its own discretion and in compliance with the relevant and applicable data protection laws, whether or not Data Subjects whose Personal Data have been impacted by a Personal Data Breach shall be notified of this. It is the responsibility of the Controller to notify the Supervisory Authority of a Personal Data Breach.
The Parties, and if applicable the Subprocessor(s) shall ensure to work together in good faith to limit possible adverse effects of a Personal Data Breach.
Data Processing Impact Assessment. Furthermore, the Processor shall assist the Controller as it carries out a Data Protection Impact Assessment in accordance with Article 35 of the Regulation. However, the Processor, at its own discretion, is free to charge additional costs for the performance of these services. These costs shall at all times be in relation to the delivered performances.
Information Obligations
The Processor shall provide the Controller, at any time upon request of Controller (however such request needs to be made giving the Processor a reasonable delay to comply with such request), with the following information as determined by the provisions of this clause:
All relevant details regarding its own corporate structure, as well as accurate and up-to-date identifying information on all of PROCESSORS’ entities involved in the processing of Personal Data, including the location of their main establishment;
Geographical details of processing locations, including back-up and redundancy facilities;
Processor’s Obligations
The Processor shall handle all reasonable requests of the Controller concerning the processing of Personal Data related to this Agreement, promptly or within a reasonable time (depending on the legal obligations defined in the Regulation) and in a proper manner.
The Processor guarantees that there are no obligations that arise from any applicable legislation that make it impossible to comply with the obligations of this Agreement.
The Processor undertakes to not process Personal Data for another purpose than the performance of the Services and the compliance with the responsibilities of this Agreement in accordance with the instructions of the Controller; if the Processor, for any reason, cannot comply with this requirement, he shall notify the Controller without reasonable delay thereabout.
The Processor shall notify the Controller without reasonable delay if he is of the opinion that an instruction from the Controller violates the applicable legislation related to data protection.
The Processor shall ensure that the access to, the inspection, the processing and the disclosure of Personal Data shall only take place in accordance with the principle of proportionality and the ‘need-to- know’ principle (i.e. data are only disclosed to the persons that require Personal Data for the performance of the Services).
Controller’s Obligations
The Controller shall render all assistance needed and shall cooperate in good faith with the Processor in order to ensure that all processing of Personal Data complies with the requirements of the Regulation particularly with the principles relating to processing of Personal Data.
The Controller shall agree with the Processor on appropriate communication channels in order to ensure that instructions, directions and other communications regarding Personal Data that are processed by the Processor on behalf of the Controller is well received between the Parties. The Controller shall notify the Processor of the identity of the single point of contact at the Controller that the Processor is required to contact in application of this Article 8.2.
The Controller warrants that it shall not issue any instructions, directions or requests to the Processor, which do not comply with the provisions of the Regulation.
The Controller shall render the assistance needed for the Processor and/or its Subprocessor(s) to comply with a request, order, inquiry or subpoena directed at the Processor or its Subprocessor(s) by a competent national governmental or judicial authority.
The Controller warrants that it shall not issue instructions, directions or requests to the Processor which would require the Processor and/or its Subprocessor(s) to violate any obligations imposed by applicable mandatory national law to which the Processor and/or its Subprocessor(s) are subject.
The Controller warrants that it shall cooperate in good faith with the Processor in order to mitigate the adverse effects of a security incident impacting Personal Data processed by the Processor and/or its Subprocessor(s) on behalf of the Controller.
Use of Subprocessors
Parties agree that the Controller by means of this Agreement gives the Processor a general written authorisation to work with the Subprocessors, belonging to categories as indicated in Article 9.5. As such, the Processor shall at its sole discretion inform the Controller of any intended changes concerning the addition or replacement of other Processors, thereby giving the Controller the opportunity to object to such changes.
Without prejudice to the foregoing, the Parties agree that the Processor shall not be required to disclose the identity of each Subprocessor (categories of Subprocessor shall suffice). Notwithstanding the above, the Controller can at all times request the Processor to disclose the identity of a Subprocessor and the Processor shall do so if such disclosure does not constitute a breach of any confidentiality engagement or trade secret provision the Processor has entered into with the relevant Subprocessor, or does not harm the intellectual property rights or know how rights of Processor. If the Processor cannot disclose the identity of a Subprocessor, the Processor shall be obliged to provide a formal justification in writing.
The Processor shall ensure that its Subprocessors will be bound to substantially the same obligations with respect to Personal Data as to which the Processor is bound by this Agreement.
The Processor shall relay the purposes determined and instructions issued by the Controller in an accurate and prompt manner to the Subprocessor(s) when and where these purposes and instructions pertain to the part of the processing in which the Subprocessor(s) is(are) involved.
As part of this Agreement the Processor makes use of the following categories of Subprocessors in order to ensure the performance of the Services to the Data Subjects, including but not limited to:
cloud hosting providers established in the European Union (Microsoft Azure), AI model providers operated within the EEA (Microsoft Azure OpenAI Service), email providers, accounting software providers, payroll administrators and software providers. The current list of Subprocessors is available on request via privacy@saply.ai.
Rights of the Data Subjects
Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the Data Subject’s rights laid down in Chapter III of the Regulation.
With respect to any request from Data Subjects regarding their rights concerning the processing of Personal Data pertaining to them by the Processor and/or its Subprocessor(s), the following conditions apply:
The Processor shall on a best efforts basis promptly inform the Controller of any request made by a Data Subject with regard to the Personal Data the Processor and/ or its Subprocessor(s) processes on behalf of the Controller, without giving any consequence to such request unless explicitly authorised by the Controller to do so;
The Processor shall promptly comply and shall require its Subprocessor(s) to promptly comply with any request made by the Controller in order for the Controller to comply with a request made by the Data Subject who wishes to exercise one of its rights;
Strictly in relation to the processing of Personal Data under this Agreement, the Processor shall, upon request of the Controller and upon best efforts basis render all assistance required and provide all information necessary for the Controller to defend its interests in any proceedings – legal, arbitral or others – brought against the Controller or its Employee for any violation of fundamental rights to privacy and protection of Personal Data of Data Subjects. The Processor may in its sole discretion charge fees Controller for such assistance.
Security Measures
Throughout the term of this Agreement the Processor shall have in place and maintain appropriate technical and organisational measures in such a manner that processing will meet the requirements of the Regulation and ensure the protection of the rights of the Data Subject.
The Processor shall amongst others have in place technical and organisational measures against unauthorised and unlawful processing and shall on a regular basis evaluate and adjust if required, the appropriateness of the Security Measures.
More in particular, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, according to Article 32 of the Regulation.
In assessing the appropriate level of security, account was taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.
The Processor operates an information security management system that is independently certified against ISO/IEC 27001:2022. The Processor shall use reasonable efforts to maintain this certification, or an equivalent standard, for the duration of this Agreement and shall provide a copy of the certificate to the Controller upon request.
Audit
The Processor acknowledges that the Controller is under the supervision of a/several Supervisory Authority/ies. The Processor acknowledges that any involved Supervisory Authority will have the right to perform an audit at any time, and in any case during the normal office hours of the Processor, during the term of this Agreement to assess whether the Processor is compliant to the Regulation and the provisions of this Agreement. The Processor shall provide the necessary cooperation.
The Controller shall only have a right to audit the Processor if the Controller has justifiable grounds to request such audit and if such grounds are communicated and demonstrated in writing to the Processor. Justifiable grounds shall mean a (strong presumption of a data breach in the meaning of Article 4 of the GDPR (and in the case of an actual data breach if such data breach has not been notified and no remediation actions have been taken), destruction of confidential Personal Data, material breach of any of the Processor’s obligations under this Agreement). In such event and upon written request of the Controller, the Processor will provide an independent third party, certified auditor, appointed by the Controller or the involved Supervisory Authority access to the relevant parts of the administration of the Processor and all locations and information of interest of the Processor (and those of its agents, subsidiaries and sub-contractors) to determine if the Processor is compliant with the Regulation and the provisions of this Agreement. On request of the Processor, the concerned parties shall agree a confidentiality agreement.
The Controller shall take all appropriate measures to minimise any obstruction caused by the audit on the daily functioning of the Processor or the Services performed by the Processor.
If there is agreement between the Processor and the Controller on a material shortcoming in the compliance with the Regulation and/or the Agreement, as revealed in the audit, the Processor shall recover this failure as soon as possible. The Parties can agree to have a plan in place, including a timescale to implement this plan, to respond to the shortcomings revealed in the audit.
The Controller will bear the costs of any performed audit in the meaning of this Article. Although, when the audit has revealed that the Processor is manifestly not compliant to the Regulation and/or the provisions of this Agreement, the Processor shall bear the costs of such audit.
International Transfer
The Processor hosts and processes Personal Data in data centres located within the European Economic Area (EEA), on Microsoft Azure infrastructure in the European Union. Should a transfer of Personal Data to a country outside the EEA that does not benefit from an adequacy decision of the European Commission ever be required, such transfer shall be governed by:
the Regulation or Binding Corporate Rules for any internal entities of the Processor; or
the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, the EU-US Data Privacy Framework where the recipient is certified under it, or other transfer mechanisms foreseen by the applicable data protection law (as may be amended and updated from time to time).
Conduct in Relation to National Governmental and Judicial Authorities
The Processor shall inform the Controller immediately of any request, order, inquiry or subpoena by a competent national governmental or judicial authority directed at the Processor or its Subprocessor which entails the communication of Personal Data processed by the Processor or a Subprocessor for and on behalf of the Controller or any data and/or information associated with such processing.
Without prejudice to article 14.1 of this Agreement, the Processor warrants that there are no obligations of applicable statutory law, which make it impossible for the Processor to comply with its obligations under this Agreement.
Confidentiality
The Processor commits itself to handle the Personal Data and its processing with utter confidentiality. The Processor shall guarantee the confidentiality with measures that are not less restrictive than the measures he uses to protect his own confidential material, including Personal Data.
The Processor ensures that employees or the Subprocessors authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Liability
The Processor is liable for the damage caused by processing only where it has not complied with the obligations of the Regulation specifically directed to Processors or where it has acted outside or contrary to lawful and fair instructions of the Controller.
A Party is liable (contractual or in tort/delict (including default) or by any means associated with this Agreement, including liability for severe misconduct) for verified shortcomings attributable to her. The liability of the Parties for a breach under this Agreement, shall be limited to suffered foreseeable, direct and personal damages, with the exclusion of consequential damage (even if informed about the possibility of such consequential damage or if the likelihood of such consequential damage was reasonably foreseeable), where ‘’consequential damage’’ means: damage or loss that did not derive directly and immediately from a breach of contract and/or extracontractual non-performance, but instead indirectly and/or after a certain lapse of time, including, but not limited to loss of income, interruption or stagnation of operations, increase of staff costs and/or the costs of staff cuts, damage consisting of or as a result of claims from third parties, lack of expected savings or advantages and loss of data, profit, time or income, loss of orders, loss of customers, increase of overhead costs, consequences of a strike, irrespective of the causes.
If it appears that both the Controller and the Processor are responsible for the damage caused by the processing of Personal Data, both Parties shall be liable and pay damages, in accordance with their individual share in the responsibility for the damage caused by the processing.
In any event the total liability of the Processor under this Agreement shall be limited to the cause of damage and to the amount that equals the total amount of fees paid by the Controller to the Processor for the delivery and performance of the Services for a period not more than twelve months immediately prior to the cause of damages. In no event shall the Processor be held liable if the Processor can prove he is not responsible for the event or cause giving rise to the damage.
Mediation and Jurisdiction
The Processor agrees that if the Data Subject files a claim for damages under this Agreement, the Processor will accept the decision of the Data Subject:
To refer the dispute to mediation by an independent person;
To refer the dispute to the relevant courts in Brussels, Belgium.
The Parties agree that the choice made by the Data Subject will not prejudice the Data Subject’s substantive or procedural rights to seek remedies in accordance with other provisions of applicable national or international law.
Termination of the Agreement
This Agreement shall apply as long as the Processor processes Personal Data on behalf of the Controller and at least as long as the Main Agreement is in place.
In the event of breach of this Agreement or the Regulation, the Controller can instruct the Processor to stop further processing of the information with immediate effect.
Without prejudice to article 3.3, the Processor shall not store the data any longer than needed to perform the Service(s) for which the data is provided. At the choice of Controller, the Processor shall delete or return all the Personal Data to the Controller after the end of the provision of Services within the time limits set out in the Data Retention article of this Agreement, and deletes existing copies, and will certify that it has done so, unless legal obligation, Union or Member State law requires storage of the Personal Data. The Personal Data shall be provided to the Controller without charge, unless otherwise agreed upon.
Document History
23 September 2026, effective 8 October 2026: the Data Retention article sets out a two-tier retention. Personal Data submitted for one-off processing is still deleted within seven days, while Personal Data saved in the CV database is retained for the duration of the Main Agreement and deleted or returned within thirty days after it ends. The international transfer clause references the 2021 standard contractual clauses, the Subprocessor categories name the EU hosting and AI providers, and the Security Measures reference the ISO/IEC 27001:2022 certification.