This Data Processing Agreement ("DPA") between Talenthub.io ("Processor") and you ("Controller") sets forth the terms governing the processing of Personal Data under the Talenthub.io Standard Terms and Conditions (the "T&C's"). This DPA is in addition to the T&C's and is effective upon its incorporation into the T&C's, which may be specified in an Order Form or an executed amendment to the T&C's. Once incorporated into the T&C's, the DPA will become part of the T&C's.

In all cases, the Processor or a third party acting on behalf of the Processor acts as the processor of Personal Data, and the Controller remains the controller of Personal Data. The term of this DPA shall follow the term of the T&C's, and any terms not defined herein shall have the meaning set forth in the T&C's.

Hereinafter, the Processor and the Controller are individually referred to as a "party" and collectively referred to as "the parties."

The parties have agreed to this Data Processing Agreement (the "DPA") to comply with the requirements of the General Data Protection Regulation (GDPR) and to ensure the protection of the rights of data subjects.

1. Content
   2.   Preamble
   3.   The rights and obligations of the data controller
   4.   The data processor acts according to instructions
   5.   Confidentiality
   6.   Security of processing
   7.    Use of sub-processors
   8.   Transfer of data to third countries or international organisations
   9.   Assistance to the data controller
   10.  Notification of personal data breach
   11.   Erasure and return of data
   12.  Audit and inspections
   13.  The parties' agreement on other terms
   14.  Remuneration and costs
   15.  Liability and limitations of liability
   16.  Other provisions
   17.   Effective data and termination
   
   Appendix A - Information about the processing
   Appendix B - Authorised sub-processors
   Appendix C - Instructions pertaining the use of personal data
   
   
   
2. Preamble
3. These Contractual Clauses (the Clauses) set out the rights and obligations of the data controller and the data                       processor when processing personal data on behalf of the data controller.
4. The Clauses have been designed to ensure the parties’ compliance with Article 28(3) of Regulation 2016/679 of the           European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the                 processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General                 Data Protection Regulation).
5. “Personal information” means any kind of information about an identified or identifiable natural person, cf. General             Data Protection Regulation article 4, nr. 1. If, as part of the fulfilment of the Main Agreement, confidential                             information other than personal data is processed, e.g. information which is deemed confidential pursuant to the               Financial Business Act, any reference to "personal information" also includes this other confidential information.
6. In connection with the provision of certain services from the data processor to the data controller, as described in               more detail in the parties' Main Agreement and Appendix A to this agreement (the "Main Services"), the data                       processor processes personal data on behalf of the data controller in accordance with this Agreement.
7. The Agreement takes precedence over any similar provisions in other agreements between the parties unless                     otherwise follows directly from the Agreement, or more far-reaching obligations are stipulated for the data                           processor in the Main Agreement. If additional obligations have been laid down for the data processor by another               agreement between the partners, for example by standard contractual provisions within the meaning of Article 46             (2), litra c and d of the Data Protection Regulation, then these additional obligations apply in addition to the                         Agreement.
8. If one or more of the provisions of the Agreement is/are not enforceable, are illegal or invalid, they shall be replaced           by fair negotiation or interpretation by provisions which, as far as possible, make the parties as if the provisions in               question were valid and enforceable. If this is not possible, the clause in question or part thereof shall not be                       construed as part of the Agreement. The other provisions of the agreement remain in force.
9. There are three (3) annexes to this Agreement, and the annexes form an integral part of the Agreement
10. Annex A contains details of the processing of personal data, including the purpose and nature of the processing,               the type of personal data, the categories of data subjects and the duration of the processing.
11. Appendix B contains the data controller's conditions for the data processor's use of sub-data processors and a list             of sub-data processors that the data controller has approved the use of.
12. Appendix C contains the data controller's instructions regarding the data processor's processing of personal data,             a description of the security measures that the data processor must implement as a minimum and how the data                 processor and any sub-data processors are supervised.
13. The agreement and its annexes must be kept in writing, including electronically, by both parties.
14. The Clauses shall not exempt the data processor from obligations to which the data processor is subject pursuant              to the General Data Protection Regulation (the GDPR) or other legislation.
    
    
15. The rights and obligations of the data controller
    
16. The data controller is responsible for ensuring that the processing of personal data takes place in compliance with              the GDPR (see Article 24 GDPR), the applicable EU or Member State data protection provisions and the Clauses                (References to ”Member States” made throughout the Clauses shall be understood as references to “EEA Member              States”).
17. The data controller has the right and obligation to make decisions about the purposes and means of the processing          of personal data.
18. The data controller shall be responsible, among others, for ensuring that the processing of personal data, which the          data processor is instructed to perform, has a legal basis.
    
    
19. The data processor acts according to instructions
    
20. The data processor shall process personal data only on documented instructions from the data controller unless                required to do so by EU law or Member State law to which the processor is subject.
21. This instruction must be specified in Appendices A and C. Subsequent instructions may also be given by the data              controller while personal data is being processed, but the instructions must always be documented and stored in                writing, including electronically, together with this Agreement.
22. The data processor may, to the extent not otherwise provided in the Agreement, use all relevant technical and                    organisational aids, including IT systems, which meet the requirements set out in this Agreement.
23. The processor shall immediately notify and inform the controller in writing if instructions given by the data                           controller, in the opinion of the data processor, contravene the GDPR or the applicable EU or Member State data               protection provisions.
24. The data processor may not condition the full and unlimited compliance with the data controller's instructions on               the data controller's prepayment or payment of outstanding invoices, etc., and the data processor has no right of               retention in the personal data.
25. The data controller has instructed the data processor that personal data may only be processed by the sub-                       processors listed in Annex B from the locations listed in the Annex. The data controller guarantees that personal                 data is encrypted during transport and storage and that the decryption key is with the data processor (and not the             sub-data processors). The data processor also confirms that the data processor's sub-processors have a fixed                     procedure for inquiries from authorities, which includes that the sub-processors strongly challenge inquiries in the             courts.
26. The data processor shall indemnify the data controller for any claim that may arise as a result of the data processor            or its sub-data processors acting outside the data controller's instructions.
    
    
27. Confidentiality
    
28. The data processor must keep the personal information confidential. The regulation of confidentiality in the Main                Agreement also applies to this Agreement. To the extent that there is a discrepancy between the Main Agreement              and this Agreement, the agreement that provides the widest possible protection of information and confidentiality              shall take precedence. The confidentiality obligation in the Main Agreement does not apply in the event of a breach            of personal data security.
29. The Data Processor may only grant access to personal data processed on behalf of the data controller to persons              who are subject to the Data Processor's instructional powers, who have committed themselves to confidentiality or            are subject to an appropriate statutory duty of confidentiality, and only to the extent necessary, including to any time          applicable rules of the Financial Business Act. In the processing of confidential information from the data controller,            the data processor and his employees are subject to a criminal duty of confidentiality, cf. section 117ff and section              373 of the Danish Financial Business Act. The list of persons who have been granted access must be reviewed on an          ongoing basis. On the basis of this review, access to personal data must be closed if access is no longer necessary,            and the personal data must no longer be available to these persons.
30. The data processor must, at the request of the data controller, be able to demonstrate that the persons in question,            who are subject to the data processor's powers of instruction, are subject to the above-mentioned duty of                          confidentiality.
31. If the data processor is a legal person, this Agreement applies to any person who is subject to the data processor's             instructional powers, and the data processor guarantees that these persons, who have access to the personal data,           comply with the Agreement.
32. The data processor's obligations under this section 5 exist without a time limit, regardless of whether the parties'                cooperation has otherwise ceased.
    
    
33. Security of processing
    
34. Article 32 of the Data Protection Regulation states that the data controller and the data processor, taking into                      account the current technical level, the implementation costs and the nature, scope, coherence and purpose of the            processing in question and the risks of varying probability and seriousness of natural persons' rights and freedoms,            implement appropriate technical and organisational measures to ensure a level of protection appropriate to these              risks.
35. The data controller shall assess the risks to the rights and freedoms of natural persons constituting the processing              and implement measures to address these risks. Depending on their relevance, it may include:
36. Pseudonymisation and encryption of personal data
37. ability to ensure lasting confidentiality, integrity, availability and robustness of treatment systems and services;
38. ability to restore in a timely manner the availability and access to personal data in the event of a physical or                    technical incident;
39. a procedure for regular testing, assessment and evaluation of the effectiveness of technical and organisational              measures to ensure treatment safety.
40. According to Article 32 GDPR, the data processor shall also – independently from the data controller – evaluate               the risks to the rights and freedoms of natural persons inherent in the processing and implement measures to                     mitigate those risks. To this effect, the data controller shall provide the data processor with all information                           necessary to identify and evaluate such risks.
41. In addition, the data processor shall assist the data controller in complying with the data controller's obligation                   under Article 32 of the Regulation, by, inter alia providing the data controller with the necessary information                       regarding the technical and organisational security measures already implemented by the data controller in                         accordance with Article 32 of the Regulation and any other information necessary for the data controller to comply           with its obligation under the Regulation; Article 32.
42. If the response to the identified risks - in the opinion of the data controller - requires the implementation of                        additional measures than those already implemented by the data processor, the data controller shall indicate the                additional measures to be implemented in Annex C and in the Main Agreement.
    
    
43. Use of sub-processors
    
44. The data processor must meet the conditions set out in Article 28(2) and (4) of the Data Protection Regulation, to               make use of another data processor (a sub-data processor).
45. The data processor may thus not make use of a sub-data processor to fulfil this Agreement without prior general                written approval from the data controller.
46. The data processor has the data controller's general approval for the use of sub-data processors. The data                          processor shall notify the data controller in writing of any planned changes regarding the addition or replacement of          sub-data processors with at least 30 days notice and thereby give the data controller the opportunity to object to              such changes before using the sub-data processor(s) in question(s). If the data controller's acceptance of the sub-              data processor cannot be obtained and the data processor continues to use the sub-data processor, the data                      controller is entitled to terminate this Agreement and the parts of the Main Agreement which involve the data                      processor's processing of personal data on behalf of the data controller. or the Main Agreement in its entirety, if the            services under the Main Agreement cannot be separated or the remaining services do not have an independent                value for the data controller. Upon cessation of the use of a sub-data processor, the data processor must give the              data controller written notice thereof. Longer notice of notification in connection with specific processing activities            can be specified in Appendix B. The list of sub-processors that the data controller has already approved is shown in          Appendix B.
47. When the data processor uses a sub-data processor in connection with the performance of specific processing                  activities on behalf of the data controller, the data processor shall, through a contract or other legal document                    under EU law or the national law of the Member States, impose on the sub-data processor the same data protection          obligations such as those set out in this Agreement, which in particular provide the necessary guarantees that the              sub-processor will implement the technical and organisational measures in such a way that the processing complies          with the requirements of this Agreement and the Data Protection Regulation.
48. The data processor is therefore responsible for requiring the Sub-Data Processor to at least comply with the Data              Processor's obligations under this Agreement and the Data Protection Regulation.
49. Prior to the data processor's notification pursuant to section 7.2, the data processor must have carried out an                      appropriate pre-audit (preliminary investigation) of the sub - processor's security level in accordance with Article                28(1) of the Data Protection Regulation.
50. The sub-data processor also acts solely on instructions from the data controller. All communication with the                        sub-data processor is handled by the data processor unless otherwise agreed. Any changed or specified                            instructions from the data controller must be passed on immediately by the data processor to the sub-data                          processor.
51. Sub-data processor agreement (s) and any subsequent amendments thereto are sent - at the request of the data                controller - in copy to the data controller, who thereby has the opportunity to ensure that corresponding data                    protection obligations under this Agreement are imposed on the sub-data processor. Provisions on commercial                  terms that do not affect the data protection law content of the subdivision agreement shall not be sent to the data              controller. In addition, the data processor must, upon request, provide documentation for the sub-data processors'            fulfilment of their data protection obligations and the data processor's ongoing control thereof, etc.
52. In its agreement with the sub-processor, the data processor shall, as far as possible, include the data controller as a          beneficiary third party in the event of the data processor's bankruptcy, so that the data controller can intervene in              the data processor's rights and enforce them against sub-processors. ex. enables the data controller to instruct the            sub-data processor to delete or return the personal data.
53. If the sub-data processor does not fulfil its data protection obligations, the data processor remains fully liable to the            data controller for the fulfilment of the sub-data processor's obligations. This does not affect the rights of data                    subjects under the Data Protection Regulation, in particular Articles 79 and 82 of the Regulation, vis-à-vis the                    controller and the processor, including the sub-processor.
    
    
54. Transfer of data to third countries and international organisations
    
55. Any transfer of personal data to third countries or international organisations by the data processor shall only occur            on the basis of documented instructions from the data controller and shall always take place in compliance with                Chapter V GDPR.
56. In case transfers to third countries or international organisations, which the data processor has not been instructed             to perform by the data controller, is required under EU or Member State law to which the data processor is subject,           the data processor shall inform the data controller of that legal requirement prior to processing unless that law                   prohibits such information on important grounds of public interest.
57. Without documented instructions from the data controller or claims under EU law or the national law of the                         member state to which the data processor is subject, the data processor may not, within the framework of this                   Agreement:
58. transfer personal data to a controller or processor in a third country or an international organisation;
59. entrust the processing of personal data to a sub-processor in a third country
60. process the personal data of a third country
61. The data controller's instructions regarding the transfer of personal data to a third country, including any basis for               transfer in Chapter V of the Data Protection Regulation on which the transfer is based, shall be set out in Annex C.6.
62. This Agreement shall not be confused with standard contractual provisions within the meaning of Article 46(2)(c)               and (d) of the Data Protection Regulation, and this Agreement may not constitute a basis for the transfer of personal           data within the meaning of Chapter V of the Data Protection Regulation.
63. If the data controller in Annex C.6 has instructed the data processor to transfer personal data to a third country, it is           the data controller's responsibility to ensure that the basis of transfer described, e.g. standard contractual                           provisions within the meaning of Article 46(2)(c) and (d) of the Data Protection Regulation 2, have been concluded             between the relevant parties.
    
    
64. Assistance to the data controller
    
65. Taking into account the nature of processing, the data processor shall assist the data controller as far as possible by            appropriate technical and organisational measures in compliance with the data controller's obligation to respond to          requests for the exercise of data subjects' rights as set out in Chapter III of the Data Protection Regulation.
66. This entails that the data processor shall, insofar as this is possible, assist the data controller in the data controller’s            compliance with:
67. the right to be informed when collecting personal data from the data subject
68. the right to be informed when personal data have not been obtained from the data subject
69. the right of access by the data subject
70. the right to rectification
71. the right to erasure (‘the right to be forgotten’)
72. the right to restriction of processing
73. notification obligation regarding rectification or erasure of personal data or restriction of processing
74. the right to data portability
75. the right to object
76. the right not to be subject to a decision based solely on automated processing, including profiling
77. In addition to the data processor’s obligation to assist the data controller pursuant to Clause 6.3., the data                           processor shall furthermore, taking into account the nature of the processing and the information available to the               data processor, assist the data controller in ensuring compliance with:
78. The data controller's obligation to without undue delay and if possible within 72 hours, after he has become                   aware of reporting a breach of personal data security to the competent supervisory authority, the Danish Data               Protection Agency, unless it is unlikely that the breach of personal data security involves a risk to the rights or               freedoms of natural persons
79. the data controller's obligation to notify the data subject of a breach of personal data security without undue                 delay, when the breach is likely to entail a high risk to the rights and freedoms of natural persons;
80. the data controller's obligation to carry out an analysis of the consequences of the proposed processing                       activities for the protection of personal data prior to the processing (an impact assessment);
81. the data controller's obligation to consult the competent supervisory authority, the Danish Data Protection                   Agency, before processing, if an impact assessment concerning data protection shows that the processing will             lead to a high risk in the absence of measures taken by the data controller to limit the risk.
82. The parties shall define in Appendix C the appropriate technical and organisational measures by which the data                processor is required to assist the data controller as well as the scope and the extent of the assistance required. This          applies to the obligations foreseen in Clause 9.1. and 9.2.
83. The data processor shall, without undue delay upon receipt of a request directly from the data subject or from a                third party related to Chapter III of the Data Protection Regulation, inform the data controller in writing.
84. The data processor shall comply with the obligations set forth in this Agreement without additional consideration              from or costs to the data controller, unless otherwise specifically stated in the Agreement.
85. The data processor is not entitled to payment from the data controller to handle inquiries from the data subjects                about insights/objections or to delete data in the system as a result of the data processor having set up the system in          such a way that the data controller does not or only with large inconvenience can handle inquiries from registered              or delete data on its own.
    
    
86. Notification of personal data breach
    
87. The data processor shall inform the data controller without undue delay after becoming aware that there has been              a breach of personal data security.
88. The data processor's notification to the data controller must be made to example@example.com without undue                  delay and no later than 36 hours after he has become aware of the breach, so that the data controller can comply              with his obligation to report the breach of personal data security to the competent supervisory authority, in                          accordance with Article 33 of the Data Protection Regulation.
89. In accordance with clause 9.2.a, the data processor shall assist the data controller in notifying the breach to the                  competent supervisory authority. This means that the data processor must assist in providing the following                          information, which according to Article 33(3), must appear from the data controller's notification of the breach to              the competent supervisory authority:
    
90. the nature of the breach of personal data security, including, if possible, the categories and approximate                        number of data subjects concerned and the categories and approximate number of personal data records                    concerned;
91. the likely consequences of the breach of personal data security
92. the measures taken or proposed by the data controller to deal with the breach of personal data security,                       including, where appropriate, measures to limit its potentially harmful effects.
93. The data processor must keep and maintain a record of all security breaches. The list must be made available to                the data controller or the supervisory authorities upon written request.
94. The Parties shall set out in Annex C the information that the data processor must provide in connection with his                  assistance to the data controller in his obligation to report breaches of personal data security to the competent                  supervisory authority.
    
    
95. Erasure and return of data
    
96. Upon termination of the personal data processing services, the data processor and its sub-processors are obliged to          return all personal data that has been processed on behalf of the data controller in a structured commonly used and          machine-readable format and confirm to the data controller that all personal data are subsequently deleted at the              end of the agreement, unless EU law or the national law of the Member States, provides for the longer storage of the          personal data by the data processor.
97. The data processor may continue to process the personal data for up to three (3) months after the termination of               the Agreement, to the extent that this is necessary to take the necessary statutory measures. During the same                     period, the data processor is entitled to have the personal data included in the data processor's usual backup                     procedure. The data processor's processing during this period is still considered to take place in compliance with               the instructions and the other requirements in the Agreement.
98. Notwithstanding the above points, the Agreement and provisions in the Main Agreement, which deal with the                     processing of personal data, apply as long as the data processor processes the data controller's personal data,                   regardless of whether the Agreement and the Main Agreement have been formally terminated.
99. The data processor must, at the request of the data controller, provide the necessary documentation that the return           and/or deletion has taken place in accordance with the deletion instructions from the data controller. The data                   controller may request that the data processor obtain an audit statement from an external auditor that the personal           data has been returned and/or deleted from the data processor and its possible sub-data processors. The costs to            the external auditor are borne by the data controller.
    
    
100. Audit and inspections
     
101. The data processor shall make available to the data controller all information necessary to demonstrate compliance           with the obligations laid down in Article 28 and the Clauses and allow for audits, including inspections, conducted             by the data controller or another auditor mandated by and paid by the data controller.
102. Procedures applicable to the data controller’s audits, including inspections, of the data processor and sub-                          processors are specified in appendices C.7. and C.8.
103. The data processor shall be required to provide the supervisory authorities, which pursuant to applicable                            legislation have access to the data controller’s and data processor’s facilities, or representatives acting on behalf of            such supervisory authorities, with access to the data processor’s physical facilities on presentation of appropriate              identification.
     
     
104. The parties' agreement and other terms
     
105. The parties may agree on/to other clauses concerning the provision of the personal data processing service                       specifying e.g. liability, as long as they do not contradict directly or indirectly the Clauses in the Agreement or                     prejudice the fundamental rights or freedoms of the data subject and the protection afforded by the GDPR.
     
     
106. Remuneration
     
107. The parties are only entitled to payment for the fulfilment of this Agreement, where this is specifically stated herein.
108. Notwithstanding the above, a party is not entitled to payment for assistance in investigating or implementing                      changes, etc. to the extent that such assistance or modification is a direct consequence of the breach of this                      Agreement or data protection law by that party.
     
     
109. Liability and limitations of liability
     
110. The Parties are liable in accordance with the general rules of applicable law, subject to the limitations set forth in                 this paragraph 15.
111. The Parties' maximum liability for all accumulated claims in accordance with this Agreement follows from the                     Parties' Main Agreement.
112. Notwithstanding clause 15.2, the following are not covered by the limitation of liability in this clause 15:
113. Loss because of gross negligence or wilful misconduct by the other Party.
114. Expenditure and resource consumption in fulfilling a Party's obligations to a supervisory authority or the data                 subject or costs of investigations (eg in the event of a security breach), compensation, tort and other                               compensation to data subjects, as well as administrative fines imposed by a supervisory authority, fines                         adjudicated by the courts to the extent that they are caused by the other Party's breach or breach of data                    protection law and this Agreement.
     
     
115. Other provisions
     
116. The provisions of the main agreement, including but not limited to provisions on violation, force majeure and                       dispute resolution, shall also apply to this Agreement, unless otherwise specifically provided in this Agreement.
117. Except where an express time frame is specified in this Agreement, no Party's delay or failure to exercise a right,                  power or the like will be prejudicial or deemed a waiver of such right, power or the like, which this has under the                Agreement.
118. Any Party's waiver of any right or breach of this Agreement shall not be construed as a waiver of rights or                           acceptance of any other or subsequent infringement and shall be in writing.
     
     
119. Effective date and termination
     
120. The Agreement shall take effect on the date of signature by both Parties. The agreement is valid until either (a) the               main agreement terminates or (b) the agreement is terminated, cf. clauses 17.3-17.4.
121. Both parties may demand that the Agreement be renegotiated if changes in the law or inconveniences in the                     Agreement give rise to this.
122. The agreement is valid for as long as the service concerning the processing of personal data lasts. During this                   period, the Agreement may not be terminated unless other provisions governing the provision of the personal data             processing service are agreed upon between the parties.
123. If the provision of the personal data processing services ceases and the personal data has been deleted or returned           to the data controller in accordance with clause 11.1 and Annex C.4, the Agreement may be terminated with written             notice by both parties in accordance with the Main Agreement's provisions on termination and revocation.
124. Notwithstanding the termination of the Agreement, the provisions of the Agreement which, according to its                         content, are intended to regulate the Parties' rights and obligations after the termination of the Agreement, shall                 continue to have effect.
125. 
     
     
     
     
     
126. Appendix A - Information about the processing

A.1. Main benefit

The data controller and the data processor have entered into an agreement for the delivery of:

A survey tool to measure and analyse candidate feedback in order to optimize the overall candidate experience. The solution analyses feedback from candidates throughout the recruitment process. Completion is optional for the candidate and may contain personal information, depending on the candidate's completion of the evaluation. The candidate answers questions related to the recruitment process using, for example, a 5 or 10-scale answer as well as the possibility of stating comments in a free text field. The feedback can be accessed by the data controller via the data processor's platform and is owned exclusively by the data controller.

A.2. Information about the processing

The purpose of the data processor's processing of personal data on behalf of the data controllerThe Collaboration Agreement incl. Annexes regulate the rights and obligations of the parties in connection with the data processor making a platform available to the data controller. As part of this collaboration, the data processor will host the Talenthub platform on behalf of the data controller as well as assist the data controller in collecting, measuring, and analysing candidate feedback collected via the Talenthub Feedback module.The data processor's processing of personal data on behalf of the data controller is primarily about (the nature of the processing)The data processor hosts the Talenthub platform on behalf of the data controller and assists the data controller in collecting, measuring, and analysing candidate feedback. In addition, the data processor makes the data as well as the analysis available to the data controller via the platform.

In editable fields where candidates have the ability to write free text, Talenthub has implemented a bot that scans for text that may contain personal information. If the bot finds text - such as email addresses or phone numbers - these will be anonymised by replacing this information with xxxx’s so that these cannot be used to identify people.The processing includes the following types of personal information about the data subjectsGeneral personal information, including answers (feedback) from candidates, any information related to the candidate's experiences (which may make it possible to identify the applicant in question), feedback related to the recruitment process, identification information in the form of names and email addresses of employees of the data controller and logging the behaviour of the data controller’s employees on the platform.The processing includes the following categories of data subjectsThe category of registered, identified, or identifiable natural persons covered by the Agreement or the processing activity:
    ⋅  Job applicants to the data controller
    ⋅ Employees of the data controllerThe data processor's processing of personal data on behalf of the data controller may commence after the entry into force of this Agreement. The treatment has the following durationThe processing may take place until the termination of this Agreement, cf., however, sections 11 and 17.

Appendix B - Authorised sub-processors

B.1. Approved sub-processors

On commencement of the Agreement and the Clauses, the data controller authorises the engagement of the following sub-processors:

NAMEADDRESSDESCRIPTION OF PROCESSINGLOCATION(S) FOR PROCESSINGAmazon Web Services EMEA SARL38 Avenue John F. Kennedy
L-1855 LuxembourgAmazon Web Services hosts the platform that the data processor makes available to the data controller.Frankfurt, GermanyGoogle Cloud EMEA70 Sir John Rogerson’s Quay
Dublin 2, IrelandProcesses our Google Suite in different locations. These, however, hold duplicates of the same things. ⋅ Dublin, Ireland
⋅ St. Ghislain, Belgium
⋅ Eemshaven, Netherland
⋅ Hamina, Finland

The data controller shall on the commencement of the Clauses authorise the use of the abovementioned sub-processors for the processing described for that party. The data processor shall not be entitled – without the data controller’s explicit written authorisation, cf. clause 7 – to engage a sub-processor for a ‘different’ processing than the one which has been agreed upon or have another sub-processor perform the described processing. In addition, the data processor may not - without observing point 7 - process the personal data at locations other than those agreed above.

B.2. Prior notice for the authorisation of sub-processors

The data processor must notify the data controller in writing of the replacement or addition of sub-processors no later than 30 days prior to commissioning, whereby the data controller has been given the opportunity to object to the use of the use in question or change, cf. 7.2.

Appendix C - Instructions pertaining the use of personal data

C.1 The subject of instructions for the processing

The data processor’s processing of personal data on behalf of the data controller is described in Appendix A – Information about the processing.

C.2. Security of processing

It is a cloud solution that processes little ordinary personal information on job applicants.

The data processor is then entitled and obliged to make decisions about which technical and organisational security measures must be implemented in order to establish the necessary (and agreed) security level.

However, the data processor must - in any case and as a minimum - implement the following measures, which have been agreed with the data controller:

C.2.1. Pseudonymisation and encryption of personal data
The main systems used by the data processor including Talenthub.io, G-suite and Amazon all encrypt “data in transit” with at least TLS 1.2 and “data at rest” with at least 256-bit AES.

C.2.2. Ensure ongoing confidentiality, integrity, availability
All data is backed up at least once every 24 hours, and most are backed up continuously as changes are made. Also, company policy dictates that no files are physically stored on a PC drive or similar, partly because of security risks, but also because of the risk of losing data.

C.2.3. The ability to restore availability in a timely manner
Should the data processor encounter an unforeseen event, a Disaster Recovery Plan has been implemented. This ensures fast recovery of data from the data processor's redundant backups located in separate geographical zones.

C.2.4. Regular testing, assessment and evaluation of the effectiveness of the technical and organisational measures
If necessary, the data processor performs security audits that test both digital and physical compliance. In addition, all employees undergo training in data security and management when they start their employment with the data processor.

C.2.5. Access to the information via the Internet
The transfer of files and information carried out by the data processor's employees follows specific guidelines regarding which information can be conveyed and which systems this can be done through. These systems have all passed our internal requirements regarding security and traceability.

C.2.6. Protection of information during transmission
When the data processor transmits data, the data processor uses end-to-end encryption. This ensures that the information remains unintelligible to outsiders, even if they were to pick it up along the way. The data processor's transmission protocols are configured to allow only secure connections, and any attempt to connect via unsecured methods is immediately rejected.

C.2.7. Protection of information during storage
Transfer of files and information carried out by the Data Processor's employees follows specific guidelines regarding which information can be conveyed and which systems this can be done through. These systems have all passed our internal requirements regarding security and traceability. In addition, all data is encrypted with AES-256 at rest.

C.2.8. Regarding physical security of locations
Access to the physical assets of the data processor (i.e. IT equipment) is limited to the data processor's employees and selected persons responsible for cleaning/maintenance at the data processor’s office. All persons have been issued a key and a code for our alarm system. The office building is monitored by a security company 24 hours a day, 7 days a week. No assets are stored locally in our office, but rather in the cloud, where they are located redundantly in data centres in Europe.

Physical access to the office is checked continuously. This means that physical and digital access is withdrawn/revoked if an employee quits. The data processor also has a digital access system based on the individual employee's position and work, which ensures that employees only have access to information and materials that are relevant to their work. All systems log the individual's use of the systems, which allows for detailed tracking of use and, more importantly, misuse of any information.

C.2.9. Home/remote workplaces
Employees are allowed home/remote work. For home/remote work, the same rules and guidelines apply as for attendance at the office, and activities are stored, cf. c.2.8, in the cloud.

C.2.10. Logging
All systems have a minimum log that shows the creation, updating and deletion of items or information. In addition, all systems have a log function that shows who has gained access to a given piece of information.

C.3. Assistance to the data controller

The Data Processor shall, as far as possible - within the scope and extent below - assist the Data Controller in accordance with clauses 9.1 and 9.2 by implementing the following technical and organisational measures.

At the specific request of the data controller, the data processor shall, taking into account the nature of the processing, assists the data controller as far as possible by means of appropriate technical and organisational measures in fulfilling the data controller's obligation to respond to requests for the exercise of the data subject's rights as laid down in the personal data legislation.

If a data subject makes a request for the exercise of his rights towards the data processor, the data processor shall notify the data controller without undue delay.

Taking into account the nature of the processing and the information available to the data processor, the data processor shall, upon specific request, also assists the data controller in ensuring compliance with the data controller's obligations in relation to:
Implementation of appropriate technical and organisational measures
Security breach
Notification of breach of personal data security to the data subject
Implementation of impact analyses
Prior hearings from the supervisory authorities

Furthermore, the data processor is free to inform the system owner and/or other contact persons in accordance with the main agreement.

C.4. Storage and period / erasure process

Personal information is stored for as long as the Main Agreement is active and the collaboration continues, after which it is deleted by the data processor.

In the event of deletion or request for deletion, the personal data in question must be irrevocably removed from all storage media on which they have been stored, so that personal data cannot be recovered, including with any sub-processors in accordance with section 11.1. This applies regardless of whether it is the data controller or the data processor who is responsible for the deletion.

C.5. Processing location

The processing and storage of the personal data covered by the Agreement may not take place without observance of clause 7 at locations other than the following:

Skelbækgade 4, 4. tv., 1717 Copenhagen V, Denmark

In addition, reference is made to the listing under Appendix B.1 above.

The data processor is obliged to inform the data controller in writing of changes in locations for the data processor's processing of personal data with at least 1 month 'written notice, however by transfer to insecure third countries with at least 2 months' written notice, thereby giving the data controller the opportunity to against the transfer.

C6. Instructions on the transfer of personal data to third countries

All data is stored and processed within the EU.

If the data controller does not in this Agreement or subsequently provide a documented instruction regarding the transfer of personal data to a third country, the data processor is not entitled to make such transfers within the framework of the Agreement.

C.7. Procedures for the data controller's audit, including inspections, of the processing of personal data being performed by the data processor

Upon request, the Data Processor shall provide a management declaration/statement subject to the usual confidentiality obligations regarding the Data Processor's compliance with the Data Protection Regulation, data protection provisions of other EU or national laws and this Agreement.

There is an agreement between the parties that the data processor must provide the following:
  - Management statements

Management statements are sent without undue delay to the data controller for information. The data controller may challenge the framework for and/or the method in the declaration and in such cases may request a new management declaration under another framework and/or using another method.

In addition, the data controller or a representative of the data controller has access to carry out audits.

Any expenses of the data controller in connection with an audit shall be borne by the data controller himself. However, the data processor shall allocate the resources (mainly time) necessary for the data controller to carry out this audit.

The data processor shall also provide authorities which, under EU law or the law of a Member State, have access to the data controller's and data controller's facilities, or representatives acting on behalf of the authorities, access to the data processor's physical facilities upon presentation of proper identification.

C.8. Procedures for audit, of the processing of personal data being performed by sub-processors

Notwithstanding any contrary provision in this Agreement, it is acknowledged and agreed that certain limitations may apply with respect to the audit rights concerning sub-processors due to the policies and constraints imposed by the sub-processors. Sub-processors, such as Amazon and Google, do not permit audits of their facilities or systems. In such cases, the Data Processor shall make reasonable efforts to obtain assurances from its sub-processors regarding the protection of personal data.

The Data Processor shall ensure that its sub-processors are bound to provide adequate data protection and security measures as required by applicable data protection laws and regulations. If the Data Processor becomes aware of any material breach by a sub-processor, it shall take appropriate steps to remedy or mitigate the breach.

In the event that the Data Controller reasonably believes that a sub-processor's processing activities pose a significant risk to the protection of personal data, the Data Processor shall cooperate with the Data Controller in finding alternative solutions that comply with applicable data protection laws and regulations.

‍

1. DEFINITIONS, APPLICATION, AND SCOPE
   
   

1. These General Terms and Conditions (“GTC”) apply to all orders, contracts, and purchases of Talenthub’s services.
2. “Agreement” shall mean these GTC’s, including any amendments, supplements, and annexes.
3. “Anonymised Data” shall mean that all identifiers have been irreversibly removed and data subjects are no longer               identifiable in any way.
4. “Authorised Users” shall mean employees, contractors, or consultants of the customer.
5. “Confidential Information” shall mean any business, commercial, technical, research, developmental, performance,            operating, or process information which a Party gets access to or receives under this Agreement
6. “Customer” shall mean the company who is purchasing Talenthub’s service(s).
7. “Customer Data” shall mean Customer’s user data and all data received from candidate replies.
8. “Effective Date!” shall mean the on which the Order Form is signed and the collaboration begins.
9. “Order Form” shall mean a separate document in which Customer agrees to purchase Supplier’s services.
10. “Professional Services” shall mean professional or technical expertise provided by the supplier to the customer.
11. “Services” shall mean the services covered under this Agreement and provided by Supplier.
12. “Supplier” shall mean Talenthub who is providing the service(s) under this Agreement to Customer.
13. “Support Services” shall mean any help, support installation, or assistance given by Supplier to Customer under                  the implementation and during the subscription.
14. “System” shall mean the online platform provided by Supplier via business.talenthub.io.
15. Customer and Supplier shall under this Agreement individually also be called “Party” and collectively “Parties”.
    
    

1. SUBSCRIPTION TERMS
   
   

1. The Parties are entering into this Agreement, the Order Form, the Professional Services terms in Annex A and                      Service Level Agreement in Annex B.
   
   

1. PROVISIONS OF SYSTEM AND SERVICES
   
   

1. Subject to payment by Customer of the Charges (as defined below in section 6.1), Supplier shall, during the                          subscription (as may be extended in accordance with this Agreement) (the “Subscription Term”), and in accordance          with this Agreement: (a) provide Customer with a nonexclusive, non-transferable, non-sublicensable, revocable,                  royalty-free licence to permit the Authorised Users to access and use the System during the Subscription Term in                accordance with the terms of this Agreement and solely for Customer’s internal business operations, (b) perform the          SupportServices for Customer during the support hours and to the service availability levels specified in this                        Agreement, and (c) perform the Professional Services in accordance with this Agreement and the Professional                    Services Annex A.
2. Customer shall designate the Authorised Users, who will only be employees and contractors of Customer and                    Customer affiliates and shall procure that only one individual uses each Authorised User account and accounts are            not shared.
3. Supplier shall make the System available, excluding the following excused outages: (a) planned downtime, where                Supplier has given a minimum of one-hour advance notice (as per Annex B, 5.1), and Supplier will give longer notice          where reasonably possible, (b) unscheduled maintenance in the case of actual or anticipated emergency, and (c)                unavailability for reasons beyond Supplier’s reasonable control.
4. Supplier shall, to the extent required for the provision of Services under this Agreement: (a) perform the Services in            accordance with this Agreement and with utmost skill and care, (b) comply with applicable laws and regulations,                and (c) maintain any licences and consents that are needed to provide the Services and the System.
5. Supplier shall use best efforts to promptly correct any material non-conformance of the System. However, Supplier            will not be liable for: (a) the System or Services to the extent damage is caused by these being used contrary to                  Supplier’s instructions or this Agreement, or (b) Customer’s connection to the System over the internet.
6. The Supplier may modify the System if it does not materially reduce the functionality of the System (and may                      provide alternative features that have materially the same benefits as the previous feature).
7. Supplier may only use the name and logo of Customer for promotional and marketing purposes for the duration of            this Agreement and only upon prior separate written approval from Customer.
8. By signing this Agreement Customer agrees that they may be chosen to participate in the beta testing of new                    features (or variations of features) to help Supplier develop the product for the customer's benefit. Customer will be            informed in writing if they have been chosen to participate in the testing.
9. In the event that Customer does not wish to participate in beta testing, they can opt out of this by contacting their              candidate experience specialist.
   
   

1. CUSTOMER DATA
   
   

1. Customer shall own any data or information uploaded by Customer and/or its Authorised Users into the System or              provided by Customer to Supplier in connection with the Services. Customer shall be responsible for the content of          Customer Data.
2. All Data is backed up at least once every 24 hours, and most of it is backed up continuously as changes are made.            Furthermore, Company policy dictates that no files are stored physically on a PC Drive or similar, partially due to                security risks, but also due to the risk of losing data. If there is any loss or damage to Customer Data due to a                      System error, then Supplier shall use best efforts to restore the lost or damaged Customer Data from the latest                    backup as its sole liability.
   
   

1. CUSTOMER’S OBLIGATIONS
   
   

1. Customer shall: (a) cooperate with Supplier and provide any necessary information, as required to provide the                    Services, (b) comply with laws applicable to this Agreement and maintain any consents to allow the use of Customer          Data in accordance with this Agreement, (c) procure that the Authorised Users keep their System passwords                        confidential, and (d) use reasonable efforts to prevent unauthorised access or use of the System (and if Customer is            aware of unauthorised access or use, promptly notify Supplier).
2. Customer shall not (and Supplier may suspend Customer’s access to the System if any of the following occur, or                Supplier reasonably believes any of the following has occurred): (a) access, store, distribute or transmit any viruses            or any material that is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing, discriminatory or            offensive, (b) except as expressly permitted under this Agreement or allowed by any applicable law that is incapable          of exclusion: (i) copy, modify, duplicate, republish, download, display, transmit, or distribute any portion of the                    System, or (ii) decompile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable          form any part of the System, (c) use the System or Services to provide services to third parties or build a product or            service which competes with the System or Services, (d) subvert any security restrictions imposed by Supplier,                    including attempting to obtain, or assist others in obtaining, access to the System, other than as permitted under                this Agreement.
   
   

1. CHARGES AND PAYMENT

1. Customer shall pay Supplier the subscription charges as specified in the Order Form for Customer’s use of the                    System and the Services (the “Charges”). The Charges are non-cancellable and non-refundable (except if Customer          terminates this Agreement for Supplier material breach, in which case Supplier will refund any prepaid fees covering          the remainder of the then-current Subscription Term). Customer shall pay the Charges in the Order Form after                    receiving Supplier’s invoice.
2. Subscription Charges shall be invoiced on the Effective Date for the initial Subscription Term and on or around the            beginning of each subsequent minimum renewal period of 12 months (“Renewal Periods”) in advance thereafter (or          in accordance with the Order Form). Professional Services fees shall be invoiced in accordance with this Agreement.
3. The Charges are exclusive of value-added, sales, use or withholding, or equivalent taxes in any jurisdiction                          (together, the “Taxes”), which if payable, will be additionally payable by Customer at the appropriate rate. Customer          shall be responsible for, and will not withhold or deduct, any applicable Taxes on the Charges.
4. If Supplier has not received payment within the days stipulated in the order form after receipt of an invoice and has           contacted (or attempted to contact) Customer both by email and by telephone referring to its rights of suspension,             then: (a) Supplier may disable Customer's access to the System and suspend the Services, and (b) interest shall                   accrue on a daily basis at an annual rate equal to 1,5% until actual payment of the overdue amount, whether before           or after actual judgement. If a Charge is thirty (30) days or more overdue, then Customer shall reimburse Supplier             for Supplier’s reasonable costs incurred in the collection of the overdue amount from Customer, provided that the             Charge is not disputed by Customer in good faith.
5. Supplier may adjust the Charges at the start of each Renewal Period by giving not less than 90 days prior written               notice to Customer. Adjustment is made every term and is assessed by measuring the use of service in the past 365           days.
   
   

1. PROPRIETARY RIGHTS
   
   

1. Supplier shall have a non-exclusive, royalty-free, worldwide, transferable, sublicensable, irrevocable, perpetual                   licence to use or incorporate into the System and Services any suggestions, enhancement requests,                                     recommendations or other feedback provided by Customer or its Authorised Users relating to the operation of the             System and Services.
2. Nothing in this Agreement will be deemed to transfer any intellectual property rights between the parties. Customer         may use the System by viewing it in a browser or printing out copies for Customer’s use, but Supplier reserves all               other rights.
3. Customer grants Supplier a non-exclusive licence to use Customer Data for the purposes of providing the System             and Services in accordance with and for the duration of this Agreement.
   
   

1. CONFIDENTIALITY
   
   

1. The Parties shall each: (a) keep confidential, (b) only use for the purposes of this Agreement, and (c) only disclose in            confidence to the recipient’s employees, contractors and advisors who need to know and who are subject to                      confidentiality obligations equivalent to those of this Agreement, the Confidential Information of the other Party                  received in connection with this Agreement, unless the Confidential Information (i) has become public knowledge              otherwise than through a breach of this section, (ii) can reasonably be shown to have been known by the recipient              before being received from the discloser, (iii) was obtained by a third Party that had not breached a duty of                          confidentiality, or (iv) is required to be disclosed by law or a Party’s regulatory body. Upon termination of this                      Agreement each Party shall on request promptly return or delete the confidential information of the other Party.
2. Each Party shall be responsible for enforcing the confidentiality of the Confidential Information received under this            Agreement against all of its agents, directors, employees, consultants or other representatives, and former agents,              directors, employees, consultants or other representatives by all appropriate legal measures.
3. The duty of confidentiality and the prohibition against the use of Confidential Information shall apply for the entire            term of the Agreement, and for a period of five (5) years after the expiration or termination of the Agreement.
   
   

1. INDEMNITY
   
   

1. Supplier shall defend and indemnify Customer and Customer affiliates, from and against:

1. any claim brought by a third party that the Services or System infringes any patent effective as of the Effective              Date, copyright, trademark, database right or right of confidentiality, and shall indemnify Customer and                          Customer affiliates for any amounts awarded against Customer or Customer Affiliates in judgement or                            settlement of any such infringement claims, and
2. ny third party or regulatory claims, actions, proceedings, or fines and for any related losses, damages,                           expenses, and costs, to the extent arising out of or in connection with any material breach by Supplier of the                 Data Processing Agreement.

1. Customer shall defend and indemnify Supplier and Supplier affiliates, from and against:

1. any claims, actions, proceedings, losses, damages expenses and costs arising in connection with the misuse or             otherwise improper use of the System in breach of this Agreement by Customer or by any person under the                 control of Customer or any Customer Affiliate, and
2. any third party or regulatory claims, actions, proceedings, or fines, and for any related losses, damages,                        expenses, and costs, to the extent arising out of or in connection with any material breach by Customer of the             Data Processing Agreement.

1. Section 9.1 and 9.2 are subject to:

1. the indemnifying Party being given prompt notice of any matter for which indemnified Party wishes to be                       indemnified.
2. the indemnified Party providing reasonable cooperation in the defence and settlement of the relevant claim, at             the indemnifying Party's expense; and
3. the indemnifying Party being given sole authority to defend or settle the relevant claim, provided that no                       settlement shall be made which prejudices the indemnified Party’s rights or imposes any obligations on it                       without its prior written approval (such approval not to be unreasonably withheld or delayed).

1. In the defence or settlement of any third-party claim, Supplier may procure the right for Customer to continue using                   the System, replace or modify the System so that it becomes non-infringing or, if such remedies are not                               reasonably available, terminate this Agreement on two business days' notice to Customer without any                                   additional liability.
2. Supplier will not be liable to Customer to the extent that an alleged infringement is based on:
   
   

1. a modification of the Services by anyone other than Supplier or its subcontractors or any person under the                     control of Supplier;
2. Customer's use of the Services in a manner contrary to the instructions given by Supplier; or
3. Customer's use of the Services after notice of the alleged infringement.

1. The foregoing states Customer's sole and exclusive rights and remedies, and Supplier’s entire obligations and                     liability, for infringement of any intellectual property right.
2. Each Party shall make reasonable efforts to mitigate any loss, damage, or liability it may suffer or incur as a result of          a breach by the other Party of this Agreement or in respect of which it seeks indemnification from the other Party              under this Agreement.
   
   

1. LIMITATIONS AND LIABILITY

1. Except as expressly and specifically provided in this Agreement and to the fullest extent permitted by applicable                  law:
2. Supplier shall have no liability for the correctness and completeness of the information provided by the Customer.
3. the Services are provided to Customer on an "as is" basis.
4. Liability cap:

1. the total and aggregate liability of (a) Supplier and (b) Customer, in each case whether in contract, tort                          (including for negligence), breach of statutory duty or otherwise, arising under or in connection with this                        Agreement shall be limited to 125% of the total subscription fees paid or payable for the Authorised Users                      during the 24 months immediately preceding the date on which the claim arose.

1. Neither Party shall be liable to the other Party in contract, tort or otherwise (including negligence) for any indirect,              consequential, punitive, or special damages, including but not limited, to loss of profits, loss of revenue, loss of use            of revenue, loss of use of the products, loss of time or inconvenience, even if the Party has been advised of the                  possibility of such damages.
2. NOTWITHSTANDING ANY OTHER PROVISIONS OF THIS AGREEMENT OR OF ANY OTHER CONTRACT, THESE                PROVISIONS SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW, REGARDLESS OF FAULT.
   
   

1. TERM AND TERMINATION

1. This Agreement shall commence on the Effective Date and continue for the initial Subscription Term and for                        successive Renewal Periods thereafter unless (a) either Party notifies the other of its intention to terminate the                    collaboration or (b) otherwise terminates in accordance with this section.

1. Termination of the collaboration must be notified in writing and no later than 60 days before the end of the                   then current subscription term in progress.

1. Either Party may terminate this Agreement with immediate effect by giving written notice to the other Party if the              other Party:

1. fails to pay any amount due under this Agreement and remains in default not less than 30 days after being                     notified in writing to make such payment;
2. commits a material breach of any other term of this Agreement which breach is irremediable or (if remediable)             fails to remedy that breach within a period of 30 days after being notified in writing to do so: or
3. the other Party is subject to any of the following events (or any event analogous to any of the following in a                   jurisdiction other than Denmark) in relation to the relevant entity: becomes insolvent, enters into liquidation,                   whether voluntary or compulsory (other than for reasons of bona fide amalgamation or reconstruction), passes             a resolution for its winding-up, has a receiver or administrator manager, trustee, liquidator or similar officer                   appointed over the whole or any part of its assets, makes any composition or arrangement with its creditors or             takes or suffers any similar action in consequence of its debt, or becomes unable to pay its debts or suspends               or ceases, or threatens to suspend or cease, all or a substantial part of its business.

1. On termination of this Agreement for any reason: (a) Customer shall cease using the System, (b) each Party shall                 return and make no further use of any equipment, property and other items (and all copies of them) belonging to               the other Party, (c) without prejudice to Supplier’s rights in respect of Anonymised Data, Supplier shall delete                       Customer Data within 90 days of the termination of this Agreement (unless otherwise requested by Customer to                 delete sooner), provided that Customer Data contained on backup copies of Supplier’s databases shall not be                     deleted for up to 180 days from the date of termination, upon expiry of the then-current backup, and Customer                 shall be entitled to export aggregated Customer Data via the data export functionality within the System, and (d)                 any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination shall not           be affected.

1. Upon termination by either Party, Customer has access to customer data for 30 days for the purpose of                         extracting and downloading customer data via the export functionality within the System.

1. Any provision of this Agreement that expressly or by implication is intended to operate after the expiration or                        termination of this Agreement shall remain in full force and effect.
   
   

1. GENERAL
   
   

1. Except in relation to Customer’s obligation to pay the Charges, neither Party shall have any liability for none or                   delayed performance by unforeseeable events beyond its reasonable control, provided that the other Party is                     notified of such event and its expected duration, and such affected Party uses reasonable endeavours to mitigate its           effect. If a Party is prevented due to any such events from substantially performing its obligations under this                         Agreement for a period more than 30 consecutive days, then the other Party may terminate this Agreement on 30             days' written notice.
2. No variation of this Agreement shall be effective unless it is in writing and signed by the parties' authorised                         representatives.
3. No failure or delay by a Party to exercise any right or remedy shall constitute a waiver of that or any other right or             remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or             any other right or remedy.
4. Except as expressly provided in this Agreement, the rights and remedies provided under this Agreement are in                   addition to any rights or remedies provided by law.
5. If any provision of this Agreement is found to be invalid, unenforceable, or illegal, the other provisions shall remain             in force. If any provision would be valid, enforceable, or legal if some part of it were deleted, the provision shall                   apply with whatever modification is necessary to give effect to the commercial intention of the parties.
6. This Agreement constitutes the entire Agreement between the parties and supersedes all previous Agreement                   (written) relating to its subject matter.
7. Each Party acknowledges that it does not rely on, and shall have no remedies in respect of, any statement not set               out in this Agreement. Each Party agrees that it shall have no claim for innocent or negligent misrepresentation or               negligent misstatement based on any statement in this Agreement.
8. This Agreement may not be assigned or transferred by either Party without the prior written approval of the other              but may be assigned or transferred by either Party without the other’s consent to (a) a parent or subsidiary, (b) an                acquirer of all or substantially all of its assets, or (c) a successor by merger.

1. Where proper notice has been given the Customer shall in case of (b) or (c) have the possibility to terminate                   extraordinary, in cases for instance where Supplier is bought, acquired or controlled by a direct competitor to               Customer.

1. Nothing in this Agreement shall create a partnership between the parties or authorise either Party to act as an                    agent on behalf of the other.
2. This Agreement does not confer any rights on any third person or third party.
3. Any notice under this Agreement shall be in writing and shall be delivered by hand or sent by pre-paid first-class                post or recorded delivery post to the other Party at its address set out in this Agreement, or such other address as              may have been notified by that party for such purposes or sent by email to the other Party's email address as set                out in this Agreement. A notice delivered by hand shall be deemed received when delivered (or if delivery is not in              business hours, at 9 am on the first business day following delivery). A correctly addressed notice sent by pre-paid            first-class post or recorded delivery post shall be deemed received at the time at which it would have been                          delivered in the normal course of post. A notice sent by email shall be deemed received at the time of transmission.
4. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation                (including non-contractual disputes or claims) shall be governed by and construed in accordance with Danish law              and subject to the exclusive jurisdiction of the Danish courts.

ANNEX A - PROFESSIONAL SERVICES

This Annex will also apply to any services to be provided under this Agreement and will form part of the Agreement entered into by the parties. Professional Services will be deemed to be Services.

1. PROFESSIONAL SERVICES

1. Supplier shall provide the Professional Services to Customer as set out according to any specifications provided by                 Supplier, subject to Customer’s payment of the applicable Charges. Any changes to the Professional Services will be               subject to a change order being signed by the parties before the change is implemented. Supplier shall use reasonable           efforts to deliver the Professional Services by any specified delivery dates but such dates are estimates.
2. The use of the System shall be governed by the Agreement and not this Annex and Customer’s right to use the System           will be subject to this Agreement. The purchase of Professional Services is not dependent on the delivery of any future           functionality or features in the System.
3. Customer shall reasonably cooperate and assist Supplier in relation to the Professional Services, including: (a) allocating        sufficient resources and promptly performing any tasks reasonably necessary to enable Supplier to perform the                      Professional Services, (b) promptly providing any necessary information, documentation, equipment or other materials,            and (c) informing Supplier in advance of any applicable security or health and safety rules that apply to any site visits.              Supplier shall not be liable for any delay or failure in performing the Professional Services as a result of Customer failing          to provide such cooperation and assistance and may charge Customer for additional resulting costs that it incurs in                performing the Professional Services.
4. Customer shall notify Supplier of any failure of the Professional Services to comply with this Agreement within 30 days          of completion. Supplier shall either reperform or otherwise remedy the Professional Services or refund the Charges for            the deficient part of the Professional Services.
   
   

1. INTELLECTUAL PROPERTY RIGHTS
   
   

1. Subject to payment of the Charges, Supplier hereby grants Customer a non-exclusive, perpetual, sublicensable right to            use the deliverables (if applicable) for Customer’s internal business purposes.
   
   

1. CHARGES AND PAYMENT
   
   

1. Customer shall pay the Charges specified in the Order Form.

Annex B – Service Level Agreement

1. AGREEMENT OVERVIEW

1. The Agreement overview includes four components:
             a)  SLA introduction
             b)  Definitions, conventions, acronyms, and abbreviations (a glossary)
             c)  Purpose
             d)  Contractual parameters
2. SLA introduction

1. This Talenthub Service Level Agreement ("SLA") between Talenthub.io. ("Talenthub", “Supplier”, "us" or "we")                  and users of the Talenthub Services (“Customer”, “Purchaser”, "you") govern the use of the Talenthub Services              under the provisions of the Talenthub GTC’s.
   
             Unless otherwise provided herein, this SLA is subject to the provisions of this Agreement.

Term

Description

SLA

Service Level Agreement

Accuracy

Degree of conformance between a result specification and standard value

IT Operations Department / Service Desk

A unit of Customer responsible for internal IT Operations

Maintenance

Scheduled unavailability of the Talenthub Services, as announced by us prior to the Talenthub Services becoming unavailable.

Monthly Uptime Percentage

Is calculated by subtracting from 100% the percentage of minutes in which the Talenthub Services were unavailable. Monthly Uptime Percentage measurements exclude downtime resulting directly from SLA Exclusions.

Service Compensation

Means a credit denominated in Euros (EUR/€) calculated as set forth below, that we may credit back to an eligible account.

Timeliness

The characteristics representing the performance of an action that leaves sufficient time remaining to maintain SLA service expectations.

Unavailable and unavailability

For services, when your services or database is not running or not reachable due to Talenthub’s fault.

4. 
   
   
   
5. Purpose

1. The purpose of this SLA is to specify the requirements of the SaaS service as defined herein with regards to:
             ⋅  Requirements for SaaS service that will be provisioned to Customer
             ⋅  Service targets
             ⋅  Criteria for target fulfilment evaluation
             ⋅  Roles and responsibilities of Talenthub
             ⋅  Duration, Scope and Renewal of this SLA
             ⋅  Supporting processes, limitations, exclusions and deviations.

4. Contractual parameters

1. This section specifies the contractual parameters of this Agreement:
             ⋅  This SLA is an appendix to GTC’s. As per GTC’s, Talenthub and Customer have signed an annually recurring                 agreement, which means this SLA is terminated at the same time as the Agreement and with the same                           terms. This SLA is valid until further notice and/or until the next review.
             ⋅  In case of SLA reviews, the Customer will be informed about the review and from what date the reviewed                       SLA version is valid, whereby the Customer then has the option to terminate the Agreement early, should the                 new SLA be reasonably inadequate for the Customer.
             ⋅  In such cases where Customer wants to terminate the recurring agreement, Customer is to inform Talenthub                 no later than 14 days after the SLA review, by evoking Customer’s right to early termination by emailing                         Talenthub with the subject line “Evoking SLA Review Early Termination”.
   
   

2. Service agreement
   
   

1. This section includes a variety of components and subsections into the following components:
             ⋅  Service levels
             ⋅  Service response
             ⋅  Exceptions and limitations
             ⋅  Responses and responsibilities
             ⋅  Service Management
             ⋅  Maintenance and Service window(s)
             ⋅  Service Commitments and Service Compensation
2. Service levels

1. In order to avoid intermittent and transient fluctuations, a downtime period may begin after observing one to                 five consecutive minutes of downtime and end when services are restored. Furthermore, downtime must affect             a significant number of requests or core functionality to qualify as a Service Outage.

1. Talenthub shall provide the Services during the recurring term of this Agreement, on a 24 hours a day, 365               days a year basis, according to the Service Levels in this SLA. Customer is understanding, that the                             Talenthub Services may have periods of unavailability, inaccessibility or otherwise inoperable for reasons                 including, but not limited to:
                     ⋅  Hardware equipment malfunctions
                     ⋅  Up-front communicated periodic maintenance procedures or service windows
                     ⋅  Reasons caused or not foreseeable beyond the control of Talenthub, including, but not limited to,                             documented downtime with Amazon Web Services (“AWS”), interruption or failure of                                                 telecommunication or digital transmission links, delays or failures due to Customer’s Internet access                         connections, hostile network attacks, network congestion or other Force Majeure Events (elaborated                         in 2.4. Exceptions and Limitations)
   
               Customer confirms that Talenthub is not responsible for or has no control over any aspects of the                              Customer’s Internet connection, speed, data transmission systems or other 3rd party vendors, suppliers or              partners.
   
               Talenthub’s service targets and commitments are directly related to Talenthub’s Infrastructure & Cloud                      Provider (AWS), which by the date of this SLA guarantees a Service with an uptime of 99,00%. It is                          furthermore understood that Talenthub is never responsible for providing higher service target levels than                what AWS at any point in time is servicing.
   
               Talenthub does not commit to making services available, should one or more of the following conditions                  take effect, thus unavailability due to these is not included when calculating potential downtime:
                         1.  Any events occurring within Customer’s own control, acquired third-party or partners, network or                             internet connection, or due to incompatibility between Customer’s it and Talenthub’s ditto
                         2. Maintenance and/or Service window(s)

1. Service level rankings and responses

1. Below is how Talenthub assesses the level of severity and targets responses accordingly:
   
   

1. Exceptions and limitations
             ⋅  In no way are Talenthub responsible for downtime, thus not breaching this SLA, if the downtime is caused by                       factors outside of Talenthub’s reasonable control, including any force majeure event, Internet access, problems                   beyond the demarcation point of the Talenthub network, acts of the government or public authorities, or strikes.
             ⋅  That results from any actions or inactions of Customer or any third party
             ⋅  That results from the equipment, software or other technology of Customer or any third party (other than third-                   party equipment within Talenthub’s direct control)
             ⋅  That results from any Maintenance (See 5. Maintenance and Service window(s))
2. Responses and responsibilities

1. Here are the defined responsibilities of both the service provider (Talenthub) and the Customer.
             Customer responsibilities and obligations:
             ⋅  Customer should provide all necessary information and assistance related to service performance that                           allows Talenthub to meet the performance standards as outlined in this document.
             ⋅  Customer shall inform Talenthub regarding changing business requirements that may necessitate a review,                   modification, or amendment of the SLA.
             ⋅  Should the Customer be planning to alter Customer’s ATS and/or IT system, the Customer is required to                         inform Talenthub in advance of such changes. Should the changes to the Customer’s ATS and/or IT system                   result in Talenthub’s services no longer working on Customer’s ATS and/or IT system, Talenthub is in no way                   responsible for such implications, and Talenthub cannot be held responsible for fixing the issue(s) at hand.
             ⋅  Reasonable availability of customer representative(s) when resolving a service-related incident or request.
             ⋅  Customer agrees to only one single point of contact (SPOC) with Talenthub, and Talenthub never                                   communicated directly with end-users (regular employees at Customer and candidates/applicants).
             ⋅  In those cases, where the Services mentioned and listed in the enclosed offer/Agreement are integrated into                 the Customer’s Applicant Tracking System (ATS) or other IT-system, the Customer warrants at any time to                     meet the requirements regarding the ATS or IT system, in order to accommodate that Talenthub’s Services                     can be integrated into the Customer’s ATS and/or IT-system
   
             Talenthub responsibilities obligations:
             ⋅  Talenthub will act as a primary support provider of the services herein identified except when third-party                       vendors are employed who shall assume appropriate service support responsibilities accordingly.
             ⋅  Talenthub will inform Customer regarding scheduled and unscheduled service outages due to maintenance,                 troubleshooting, disruptions or as otherwise necessary.

1. Service assumptions

1. Assumptions related to in-scope services and/or components include:
             ⋅  Changes to services - such as new features, functions and/or redesign - will be communicated and                                 documented to the customers
             ⋅  At all times Talenthub has the prerogative to further develop and improve the Talenthub Services. This also                   includes changing third-party vendors such as hosting, cloud and infrastructure providers, or any other                         third- party vendor or service provider, which Talenthub is utilising to offer the Customer the Talenthub                         Services. Any such changes will be communicated in advance, and/but will not make the Customer eligible                   for termination of GTC’s or SLA.
   
   

2. Service commitments and service compensation
             ⋅  Should the Talenthub services not be available 99,00% of the time per month (as per 2.2. Service Levels),                                 Talenthub commits to reimburse Customer a compensation of 5%, of 1/12 of the annual Agreement value, per 1%                     below 99,00% downtime per month.
   
                 Under no circumstances is Talenthub required to provide compensations greater than 80% of 1/12 the annual                           Agreement value relating to downtown per month in relation to the Talenthub services, except for instances of                         intent or gross negligence.
             ⋅  Should the Customer wish to invoke compensation reimbursement as per above, the Customer shall do so no later                   than 8 working days into the following month. If the deadline is not met, or the Customer does not invoke the right                   to compensation, the Customer automatically waives its right to compensation.
             ⋅  Compensation is invoked by emailing Talenthub with details about the assumed downtime and claiming                                     compensation. Talenthub is then granted 30 days to investigate and calculate/confirm compensation before issuing                 a credit notum to the Customer.
             ⋅  If there are any disagreements between the Customer and Talenthub about downtime % and compensation                             amount, Talenthub is to provide detailed calculations of the downtime.

1. Sole remedy

1. Unless otherwise provided in the GTC’s, the Customer’s sole and exclusive remedy for any unavailability, non-                performance, or other failures by Talenthub to provide the Services is the receipt of a credit notum (if eligible) in            accordance with the terms of this SLA.
   
   

2. Service management

1. Service management and support details applicable to the Talenthub Services
2. Support availability

1. Service coverage by Talenthub as outlined in this Agreement follows the schedule specified below:
                     ⋅  Talenthub support may be reached:
                               ⋅  Chat-support service in office hours from 8:00 am (CET) to 5:00 pm (CET), Monday to Friday on                                    all weekdays (Danish bank holidays and other public holidays excluded).
                                   Chat messages received outside of office hours will be collected, however, no action can be                                            guaranteed until the next working day.
                               ⋅  Email-support service in office hours from 8:00 am (CET) to 5:00 pm (CET), Monday to Friday on                                  all weekdays (Danish bank holidays and other public holidays excluded).
                                   Emails received outside of office hours will be collected, however, no action can be guaranteed                                      until the next working day.
   
   

2. Maintenance and service windows
   
   

1. As per default, all future maintenance and service windows are included in the service level, as long as they are                 notified no less than 1 hour prior to the window
             ⋅  In cases of a service level ranking of 2 or higher (see 2.3), Talenthub may announce service windows 10 minutes                 in advance
             ⋅  In cases where we expect >15 minutes of downtime, we will communicate
             ⋅  24 hours in advance
   
         Service windows are communicated inside the Talenthub Dashboard.

‍

General information

Talenthub wants to offer a service that gives you the best possible experience. To do so, we use technologies that may collect information about you and how you and others use Talenthub's website.

For example, we use cookies that allow you to watch videos. We also use cookies to track how many people visit Talenthub and how our website is used. This allows us to develop the content and make our services intuitive to use.

Talenthub uses its own cookies and cookies from partners, so-called third-party cookies. Partners can use cookie data for targeted marketing on platforms of their own and others’ platforms. You can see which partners use cookies and for what purposes under the section What are the different cookies used for?

You can control cookies

Until you have given your consent, Talenthub may not use anything other than necessary cookies. Therefore, we ask for your consent to use cookies when you visit Talenthub for the first time. If you accept all or selected cookies, cookies are stored on your computer, tablet, mobile or other electronic device.

You can enable and disable cookies, and you can always revoke your consent and change settings here.

You can also change cookie settings by going to your browser settings and deleting cookies.
How to change cookie settings in your browser

How to change cookie policy

We have grouped our cookies into these categories:

        •  Necessary cookies: Make the website work

        •  Statistical cookies: Track how you use the website

        •  Marketing cookies: Used for advertising

You can read more about the individual types of cookies below.

What is a cookie

A cookie is a file that is stored on your computer, tablet, mobile or other electronic device when you visit Talenthub's digital services.

A cookie may contain a randomly generated ID that makes it possible to recognise your computer and gather information about which pages and features you visit.

Cookies can do different things. Some cookies ensure that a website works as intended, while others may store information about your behaviour to provide you with targeted advertising. You can see a description of the different types of cookies below.

This policy also covers other forms of data collection, e.g. via so-called scripts and pixels. Data collection only happens for the purposes you have consented to.

What are different cookies used for?

Below, you can read more about the different types of cookies.

Necessary cookies: Make the website work

Necessary cookies are technical cookies that make the website work.

Technical cookies mean that you do not have to enter your login details because the website remembers them from last time. These cookies also ensure that Talenthub is displayed correctly by activating basic functions. The website cannot function properly without these cookies, which means that you cannot opt out of this type of cookie.

When you log in via Google, Facebook or Apple necessary cookies are used. Beyond this, partners do not use necessary cookies.

Necessary cookies are used by Talenthub and the following partners:

Cookiebot

Stores the user's cookie consent state for the current domain

1 year

https://www.cookiebot.com/da/privacy-policy/ 

Google

Used to check if the user's browser supports cookies and to distinguish between humans and bots. This is beneficial for the website, in order to make valid reports on the use of their website.

Persistent

https://policies.google.com/privacy 

Hubspot

Used to implement forms on the website.

Session

https://legal.hubspot.com/privacy-policy?_ga=2.251458369.639178606.1643280521-527515060.1642358325&_gac=1.195924446.1642358415.Cj0KCQiAoY-PBhCNARIsABcz771YA6EIqp8NZ2l7bhT_oxEXotlmFx3EL8GgElcJur0FpVEBmEPpEckaAuRuEALw_wcB 

LinkedIn

Stores the user's cookie consent state for the current domain.

1½ Year

https://www.linkedin.com/legal/privacy-policy 

New Relic

Preserves users' states across page requests.

Session

https://newrelic.com/termsandconditions/privacy 

Young CRM

This cookie is used in context with load balancing - This optimises the response rate between the visitor and the site, by distributing the traffic load on multiple network links or servers.

6 days

talenthub.io

This cookie is a part of the services provided by Cloudflare - Including load-balancing, deliverance of website content and serving DNS connection for website operators.

Session

Statistical cookies: Track how you use the website

Statistical cookies are used, for example, to track how long you have been on a given website and to track which pages you visit and in what order.

The information helps us understand how users interact with the website by collecting and reporting information anonymously. They form part of analyses that contribute to improving content and user experience, as well as market analyses.

You can enable and disable statistical cookies.

Statistical cookies are used by Talenthub and the following partners:

Google Analytics

Collection of information about users and their activity on the website for analysis and reporting purposes

2 years

www.google.com/intl/da/policies/privacy/partners 

Hotjar

Collection of information and statistics about users and their activity on the website for analysis purposes.

1 year

https://www.hotjar.com/legal/policies/privacy/ 

Hubspot

Collection of information about users and their activity on the website for analysis purposes and to identify if cookie data needs to be updated in the visitor’s browser.

½ year

https://legal.hubspot.com/privacy-policy 

LinkedIn

Used for data-synchronisation with third-party analyses service and collection of information about users activity on the website for analysis purposes.

30 days

https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy 

New Relic

Used to monitor website performance and statistical purposes.

Session

https://newrelic.com/termsandconditions/privacy 

tr-rc.lfeeder.com

Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.

Session

Marketing cookies: Used for advertising

Marketing cookies track how you navigate the website.

Marketing cookies can work in such a way that, after searching for a job title on Talenthub, you start getting banner ads with job postings for similar jobs.

Our partners can use cookies for targeted marketing on their own and others' platforms.

You can enable and disable marketing cookies.

Marketing cookies are used by Talenthub and the following partners:

Meta Platforms, Inc.

Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers.

3 months

https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0 

Clearbit

Collects data on user behaviour and interaction in order to optimise the website and make advertisement on the website more relevant.

Session

https://clearbit.com/privacy-policy 

Google

Collection of information about users and their behaviour on websites to present more relevant advertisements.

1 year

https://policies.google.com/privacy 

Hotjar

Used to identify visitors and optimise ad-relevance.

Session

https://www.hotjar.com/legal/policies/privacy/ 

Hubspot

Sends data to the marketing platform Hubspot about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.

Session

https://legal.hubspot.com/privacy-policy 

LinkedIn

Collection of user behaviour to present relevant advertisement based on visitor’s preference.

1 year

https://www.linkedin.com/legal/privacy-policy 

Salesloft

Collection of user behaviour on the website. Used for optimising advertisement.

1 year

https://salesloft.com/privacy-policies/ 

Youtube

Collection of user’s video player preference.

½ year

https://policies.google.com/privacy 

YoungCRM

Collection of user information and interactions with web-campaign content. This is used by the website owner for promoting events and/or products.

1 day

https://youngcrm-platform.com/ 

Play.hubspotvideo.com

Collects information on user preferences and/or interaction with web-campaign content - This is used on CRM-campaign-platform used by website owners for promoting events or products.

Persistent

 sc.lfeeder.com

399 days

What information is collected about me?

In connection with a visit, your computer, tablet or mobile shares, among other things, your IP address and location data. Talenthub is also informed about what type of computer, phone and operating system you are using.

How long are cookies stored for?

Fundamentally, there are two types of cookies – temporary (session) and permanent (persistent). Temporary cookies are linked to the current visit and are deleted automatically when you leave Talenthub's website. Persistent cookies are, however, stored on your device. Persistent cookies delete themselves after a certain period of time but will be renewed every time you visit Talenthub's website.

Below, you can read about how you can delete cookies yourself.

Can I disable or delete cookies?

If you want to disable one or more categories of cookies, you can manage your consent here.

Necessary cookies, which are a prerequisite for basic functions, cannot be disabled.

You can also change cookie settings by going to your browser settings and deleting cookies.
How to change cookie settings in your browser.

What does it mean that cookies can be set by partners (third-party cookies)?

Talenthub makes use of components that involve companies other than Talenthub. When using these third-party cookies, information about your use of our digital services and technical information about your device is collected for the purpose of compiling statistics and targeting advertisements at you.

For this storage and collection of information, Talenthub is the joint data controller, along with the supplier of the third-party cookies in question. Talenthub, however, is not responsible for the further processing of the information collected by third parties. You can read more about the processing of personal data in the third parties' own personal data policies, to which links are provided in the section What are the different cookies used for? If you wish to exercise your rights, which includes gaining insight into the information that these companies process about you, you must use the contact information provided in the privacy policies of the companies concerned.

What does it mean to log in via other services?

It is possible to link a Facebook, Google or Apple login with Talenthub's login system, but it is not a prerequisite for using Talenthub's login. It is up to you to decide whether you want to use this function.

If you do decide to use this function, Facebook, Google or Apple will receive technical data about your browser and IP address, and Facebook, Google or Apple will be able to link this data to your profile. The processing that Facebook, Google or Apple performs is beyond the control of Talenthub and solely a matter between you Facebook, Google or Apple, who are the data controllers for this use.

Contact us

Talenthub.io A/S
Skelbækgade 4, 4. tv.
1717 Copenhagen V
Denmark

CRN (CVR): 38623508

‍

At Talenthub, we understand the importance of protecting your personal information and are committed to safeguarding your privacy. This Privacy Policy explains how we collect, use, and disclose personal information from our users and visitors to our website, and online services (collectively, the “Services”).

By using our Services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use our Services.

This Privacy Policy applies to personal information collected by Talenthub through our Services and does not apply to any third-party websites, applications, or services that may be linked to or from our Services. We encourage you to review the privacy policies of those third-party services before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our privacy practices or legal obligations. We will notify you of any material changes to this Privacy Policy by posting a notice on our website or through other means, such as email. Your continued use of our Services following the posting of changes to this Privacy Policy means you accept those changes.

Use of personal data

We understand that you may have concerns about the personal data you share with us. We want to be transparent about what data we collect and how we use it. Personal data is any information that can be used to identify you, such as your name, email address, or payment information.

We keep and use only personal data that you've provided directly, or when it's clear they were left for processing by us when provided. We may use the following types of data for the purposes set out in this Privacy Policy:

      •  Name
      •  Email address
      •  IP address
      •  The way you navigate through our service
      •  Statistics as to how you use the service

We collect this data for the following purposes:

      •  To provide you with our services       •  To personalise your experience with our services       •  To analyse how you use our services and identify areas for improvement       •  To send you important account information and updates

We use cookies on our website to provide you with a better user experience. Cookies are small text files that are placed on your computer or mobile device when you visit a website. We use cookies to remember your preferences and settings, to analyse how our website is used, and to personalise your experience.

The legal basis for processing your personal data is consent. We obtain your consent when you visit our website and accept our offer to use our service. You have the right to withdraw your consent at any time. If you wish to withdraw your consent, please contact us at dpo@talenthub.io.

Account

To access our service, you must register a user first. When you register, we collect personal data associated with the username you choose to share with us. This allows us to personalise your experience and keep you informed about updates to our service.

We will not disclose your personal data to third parties (other than the below listed) unless it is necessary to fulfil our agreement with you, or we are legally required to do so.

If we suspect fraudulent or abusive behaviour related to the Talenthub feedback application, we may share your personal data with relevant authorities.

User responsibility

As a user of our platform, you agree to use the platform in a responsible and ethical manner. You agree not to use the platform to engage in any activity that violates any laws, infringes upon the rights of others, or interferes with the operation of the platform or any related services.

Furthermore, you agree to abide by the following guidelines:

      •  After registering a user: Do not provide or post any personal identifiable information on the platform, including but not                limited to your full name, home address, phone number, email address, social security number, or any financial                              information unless specifically asked to do so.       •  Do not copy and paste any contact details of a hiring manager or contact person from a job posting into the platform.       •  Do not engage in any activity that violates any laws, regulations, or the rights of any person or third party.       •  Do not attempt to access any part of the platform that you are not authorised to access.       •  Do not engage in any activity that could harm, disable, overburden, or impair the platform or interfere with any other                    user's use of the platform.

We reserve the right to investigate and take appropriate action against any user who violates these guidelines, including but not limited to terminating their account and reporting their activity to law enforcement authorities.

Third party service providers

We may use third-party service providers to help us operate our website and provide our services. These third-party service providers may have access to your personal information in order to perform tasks on our behalf. We strive to ensure that all third-party service providers we work with are reputable and have adequate security measures in place to protect your personal information.

Currently, we work with the following third-party service providers:

      •  Juice.io:     We partner with Juice.io to provide job-matching services. If you choose to use this service, we will share                                      name and email address with Juice.io to make the onboarding process easier. Please note that this is an                                        feature and we will only share your personal information if you choose to use it. Juice.io's privacy policy can                                  found on their website.       •  Mailchimp: We use Mailchimp for our email correspondence with users, this among others include welcome messages,                                  notifications about profile deletion requests from users, etc.. Mailchimp's privacy policy can be found on their                                website.

Please note that our use of third-party service providers may change over time. We will update this section of our privacy policy accordingly and notify you of any significant changes.

Security

We take the security of your personal data seriously and have implemented measures to protect it from unauthorised access, use, disclosure, alteration, and destruction. We use industry-standard security practices and technologies to safeguard your personal data.

However, no transmission over the internet or electronic storage system is completely secure. Therefore, we cannot guarantee absolute security of your personal data. We encourage you to take steps to protect your personal data, such as using strong and unique passwords, logging out of your account when you finish using our service, and keeping your account information confidential by not sharing your credentials with anyone else.

If you have reason to believe that your personal data has been compromised, please contact us immediately so that we can take appropriate action.

Storage period

Personal data provided by you will be stored in your account until the account is terminated or removed. However, in certain cases, we may need to store your data for a longer period of time to comply with legal requirements.

If you share personal data with us via contact forms or email, we will retain the data for as long as necessary to provide a complete response or handle your request. Once the purpose of the data collection has been fulfilled, we will delete the information unless we are required by law to keep it for a longer period of time.

Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) to oversee our data protection responsibilities and ensure that we are processing your personal data in accordance with applicable data protection laws and regulations.

Our DPO can be contacted by emailing dpo@talenthub.io. If you have any questions or concerns regarding the processing of your personal data or would like to exercise any of your data subject rights as outlined in this Privacy Policy, please contact our DPO.
Our DPO's responsibilities include:

      •  Monitoring our compliance with applicable data protection laws and regulations;

      •  Providing advice and guidance on data protection matters to employees and other individuals whose personal data we                process;       •  Coordinating with regulatory authorities in the event of a data protection breach; and       •  Serving as a point of contact for individuals whose personal data we process regarding any questions, concerns, or                      requests related to their personal data.

Please note that our DPO is not responsible for handling any customer service or technical support inquiries. If you have a question or concern that is unrelated to data protection or privacy matters, please contact our customer service team at hello@talenthub.accademy.

Exercise your rights

As a data controller, we respect your right to privacy and understand that you have certain rights under applicable data protection laws. This section describes your data subject rights and explains how you can exercise them.

Right to Access
You have the right to request access to the personal data that we hold about you. If you wish to exercise this right, you can submit a request to us using the contact details provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by applicable data protection laws.

Right to Rectification
If you believe that any of the personal data that we hold about you is inaccurate, you have the right to request that we rectify it. You can submit a request to us using the contact details provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by applicable data protection laws.

Right to Erasure
You have the right to request that we delete the personal data that we hold about you in certain circumstances. If you wish to exercise this right, you can submit a request to us using the contact details provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by applicable data protection laws.

Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances. If you wish to exercise this right, you can submit a request to us using the contact details provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by applicable data protection laws.

Right to Data Portability
You have the right to receive a copy of the personal data that you have provided to us in a structured, commonly used, and machine-readable format. If you wish to exercise this right, you can submit a request to us using the contact details provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by applicable data protection laws.

Right to Object
You have the right to object to the processing of your personal data in certain circumstances, including where we process your personal data for direct marketing purposes. If you wish to exercise this right, you can submit a request to us using the contact details provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by applicable data protection laws.

Right to Withdraw Consent
If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time. If you wish to withdraw your consent, you can submit a request to us using the contact details provided at the end of this Privacy Policy. Please note that withdrawing your consent will not affect the lawfulness of any processing that we have carried out based on your consent before you withdrew it.

Contact Details
If you wish to exercise any of your data subject rights, or if you have any questions or concerns about how we process your personal data, please contact us using the following details:

dpo@talenthub.io

We will respond to your request or query within the timeframes required by applicable data protection laws. Please note that we may need to verify your identity before we can fulfil your request

Changes to this privacy policy

We reserve the right to make changes to this statement at any time. If we make any material changes, we will notify you via email or other means of communication, and the updated statement will be effective immediately upon posting.

We encourage you to review this statement regularly to stay informed of any updates. By continuing to use our service after any changes have been made, you agree to the updated privacy statement.

Contact us

Talenthub.io A/S
Skelbækgade 4, 4. Tv.
1717 Copenhagen V
Denmark

hello@talenthub.io
CRN (CVR): 38623508

‍

Introduction

At Talenthub we take the protection of personal data seriously. This statement is intended to explain how we collect, use, and protect personal data when visiting our website, purchasing our services, or interacting with us in any way. The General Data Protection Regulation (GDPR) sets out strict requirements for how organisations handle personal data. We comply with GDPR and are committed to ensure that personal data is processed lawfully, fairly, and transparently. This statement will provide you with information on how we use personal data and the rights of data subjects in relation to that data. We encourage you to read this statement carefully to understand our practice and how to contact us with any questions or concerns.

We would like to inform you that we process personal data on the basis of consent. This means that we will ask for your explicit consent before collecting and processing any personal data. We take your privacy seriously and are committed to ensuring that your personal data is processed lawfully, fairly, and transparently.

Personal data collection

Personal data collection:
We collect personal data from you when you create a user account on our platform. The personal data we collect is limited to your name and email address. This information is necessary for us to provide you with our services and to communicate with you about your account.

If you are an integration customer, we may also collect the name and email address of your candidates in order to send out survey emails on your behalf. This personal data is used solely for the purpose of administering the surveys and is not used for any other purposes.

We do not collect any other personal data from you, and we do not share your personal data with third parties unless required to do so by law.

We only collect personal data that is necessary for the provision of our services, and we do not process your personal data in any way that is incompatible with the purposes for which it was collected.

Data subject rights

Under GDPR, you have certain rights with respect to your personal data. These rights include:

• 
  Right of access:
  You have the right to obtain confirmation from us as to whether or not we are processing personal data about you, and, where that is the case, access to the personal data.
• Right to rectification:
  You have the right to request that we rectify inaccurate or incomplete personal data about you.
• Right to erasure:
  You have the right to request that we erase personal data about you in certain circumstances, such as where the personal data is no longer necessary in relation to the purposes for which it was collected, or where you withdraw your consent and there is no other legal basis for processing the data.
• Right to restrict processing:
  You have the right to request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the personal data or where the processing is unlawful.
• Right to data portability:
  You have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to object:
  You have the right to object to the processing of your personal data in certain circumstances, such as where the processing is based on our legitimate interests or for direct marketing purposes.

If you wish to exercise any of these rights, please contact us using the contact details provided in the "Contact us" section below. We will respond to your request without undue delay and in any event within one month of receipt of your request, unless we need to extend the period by a further two months due to the complexity or number of requests. Please note that we may need to verify your identity before fulfilling your request.

You also have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data infringes applicable data protection laws.

Data security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

We use industry-standard security measures, including encryption, firewalls, and secure socket layer (SSL) technology, to protect your personal data. We regularly review and update our security measures in light of current technologies and industry standards to ensure the security and confidentiality of your personal data.

However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security of your personal data.

If we become aware of a data breach that affects your personal data, we will notify you and the relevant supervisory authority within 72 hours as required by applicable law. We will also take all necessary steps to mitigate the effects of the breach and prevent similar incidents from occurring in the future.

If you have any questions or concerns about the security of your personal data, please contact us using the contact details provided in the "Contact us" section below.

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

If you have registered with us, we will retain your personal data for as long as your account is active or as needed to provide you with our services.

If you have contacted us with a question or a request, we will retain your personal data for as long as necessary to respond to your question or request and for a reasonable period thereafter in order to maintain a record of our communications.

If you have provided your consent to receive marketing communications from us, we will retain your personal data for as long as you remain subscribed to our mailing list or until you withdraw your consent.

Once the retention period has expired, we will securely delete or anonymize your personal data in accordance with our data retention policies and applicable laws.

If you have any questions or concerns about our data retention practices, please contact us using the contact details provided in the "Contact us" section below.

Data transfer

We store your personal data in the European Economic Area (EEA) and do not transfer it outside of the EEA.

If we need to transfer your personal data outside of the EEA, we will ensure that appropriate safeguards are in place to protect your personal data, in accordance with the requirements of the GDPR. This may include implementing Standard Contractual Clauses approved by the European Commission, or ensuring that the recipient of the data is located in a country that has been deemed to provide an adequate level of protection for personal data by the European Commission.

If you have any questions or concerns about the transfer of your personal data, please contact us using the contact details provided in the "Contact us" section below.

Conclusion

We take your privacy and the protection of your personal data seriously. We are committed to complying with the GDPR and other applicable data protection laws and regulations.

If you have any questions or concerns about how we collect, use, or protect your personal data, or if you would like to exercise any of your data subject rights, please contact us using the contact details provided in the "Contact us" section below.

We reserve the right to update or amend this GDPR statement from time to time, in order to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any such updates or amendments will be posted on this page, and we encourage you to review this statement periodically.

Contact us

Talenthub.io A/S
Skelbækgade 4, 4. Tv.
1717 Copenhagen V
Denmark
hello@talenthub.io
CRN (CVR): 38623508