Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Phaedra Solutions ([CONFIRM: exact registered legal form, e.g. “Phaedra Solutions (Private) Limited”]), headquartered in Lahore, Pakistan ([CONFIRM: full registered company address], registration [CONFIRM: company registration number]) (“Processor”, “we”), and the customer accepting the Terms (“Customer”, “you”). It governs our Processing of Personal Data contained in Customer Content — above all, candidate data — in the course of providing the Rubrily service (the “Service”).

“GDPR” means Regulation (EU) 2016/679, and “UK GDPR” means the GDPR as incorporated into United Kingdom law. “Data Protection Law” means the GDPR, the UK GDPR and any other privacy law applicable to the Processing.

“Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach” have the meanings given in the GDPR.

“Candidate Data” means Personal Data relating to a job candidate that the Customer processes through the Service.

“SCCs” means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, as completed in Section 10.

The subject matter, duration, nature and purposes of Processing, the categories of Data Subjects and of Personal Data are set out in Annex I.

For Candidate Data and other Personal Data in Customer Content, the Customer is the Controller (or a processor acting for another controller, in which case we are a subprocessor and this DPA applies accordingly) and Phaedra Solutions is the Processor.

We Process such Personal Data only on the Customer’s documented instructions — these Terms, this DPA, and the Customer’s configuration and use of the Service’s features are those instructions — including with regard to international transfers, unless required to do otherwise by law that applies to us; in that case we inform the Customer of the legal requirement before Processing, unless the law prohibits that on important grounds of public interest. We will promptly inform the Customer if, in our opinion, an instruction infringes Data Protection Law.

The Customer is responsible for the lawfulness of the Personal Data it collects and the instructions it gives — including having a lawful basis, providing candidate notices, and configuring the Service consistently with its obligations.

We ensure that every person we authorize to Process Personal Data — employees and contractors alike — is bound by a contractual or statutory duty of confidentiality, is granted access on a need-to-know basis under the access controls in Annex II, and receives appropriate data-protection training.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risks to Data Subjects, we implement and maintain the technical and organizational measures set out in Annex II. We may update those measures as technology evolves, provided the protection of Personal Data is not materially reduced.

The Customer grants a general authorization to engage the subprocessors listed in Annex III (maintained at rubrily.com/subprocessors). We impose on every subprocessor, by contract, data protection obligations no less protective than this DPA, and we remain fully liable to the Customer for a subprocessor’s performance.

We will give the Customer at least 30 days’ notice by email before adding or replacing a subprocessor (default — confirm). The Customer may object on reasonable data-protection grounds within the notice period; we will then work with the Customer in good faith on an alternative, and if none is reasonably available the Customer may terminate the affected part of the Service with a pro-rata refund of prepaid fees.

Taking the nature of the Processing into account, we assist the Customer with appropriate technical and organizational measures — as far as possible — in fulfilling the Customer’s obligation to respond to Data Subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). In practice: the Service’s export functions and its built-in erasure workflow let the Customer answer most requests directly; for anything else, we assist on request at privacy@rubrily.com.

If a Data Subject contacts us directly about Candidate Data, we do not respond on the merits; we route the request to the Customer without undue delay and tell the Data Subject we have done so — the routing described in the Candidate Privacy Notice.

We also assist the Customer, taking into account the nature of the Processing and the information available to us, with the Customer’s obligations under Articles 32–36 GDPR: security, breach notification to authorities and Data Subjects, data protection impact assessments, and prior consultation.

We notify the Customer of a Personal Data Breach affecting Customer Content without undue delay and in any case within 72 hours of becoming aware(default — confirm). The notice describes, to the extent known: the nature of the breach, the categories and approximate numbers of Data Subjects and records affected, likely consequences, the measures taken or proposed, and a contact point. We provide updates as our investigation progresses and cooperate with the Customer’s own notification obligations. Our notice is not an admission of fault.

On termination or expiry of the Service, the Customer has an 30-day export window (the Service provides CSV and PDF export). After that window we delete all Personal Data in Customer Content within 30days (defaults — confirm), unless law applicable to us requires storage — in which case we isolate and protect the data, Process it for no other purpose, and delete it when the requirement ends. On written request we confirm deletion in writing. During the term, the Customer can delete Candidate Data at any time using the Service’s erasure workflow.

We make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR — starting with this DPA, Annex II, our security pageand completed security questionnaires. Where that information is insufficient, the Customer (or an independent auditor that is not our competitor) may audit our compliance: on reasonable prior notice, at most once per year (except after a Personal Data Breach or where a supervisory authority requires it), during business hours, under confidentiality, without access to other customers’ data, and at the Customer’s cost. We may satisfy an audit request with a recent third-party report to the extent it covers the scope requested.

We are headquartered in Lahore, Pakistan, and Processing involves the countries shown in Annex III. Where Processing involves a transfer of Personal Data protected by the GDPR to a country without an adequacy decision, the parties incorporate the SCCs (2021/914), Module Two (controller → processor) into this DPA by reference — and Module Three (processor → processor) where the Customer acts as a processor for another controller — completed as follows: Clause 7 (docking) included; Clause 9(a) Option 2 with the notice period in Section 5; Clause 11 optional redress not selected; Clause 17 Option 1 with the law of Ireland; Clause 18 the courts of Ireland; Annexes I–III of the SCCs are completed by Annexes I–III of this DPA. For transfers subject to UK GDPR, the UK International Data Transfer Addendum (version B.1.0) applies with the same appendix information ([CONFIRM: UK customers targeted]).

We are not certified under the EU–US Data Privacy Framework and this DPA makes no DPF claim. Where a transfer assessment identifies supplementary measures, we implement them per Annex II.

Each party’s liability under this DPA is subject to the exclusions and caps in the Terms of Service; nothing in this DPA limits a Data Subject’s rights or either party’s liability where Data Protection Law does not allow it to be limited.

If documents conflict: the SCCs prevail over this DPA; this DPA prevails over the Terms for Processing of Personal Data; the Terms govern everything else.

This DPA is incorporated into the Terms for all customers and needs no signature to bind the parties. Enterprise customers that need a countersigned copy can request one at legal@rubrily.com ([CONFIRM: countersigning offer and process]).