Data Processing

Annex to the talentguide Terms & Conditions

Last modified: 1 August 2026

This Data Processing Agreement (the “DPA”) forms part of, and is an annex to, the Terms & Conditions agreed between TalentGuide BV (“Talentguide”, the “Processor”) and the client identified in the Agreement (the “Client Company”, also referred to in the Terms & Conditions as the “Client”, the “Controller”), together the “Parties.” It governs the Processing of Client Company Personal Data by Talentguide on behalf of the Client Company.

Background:

• The Client Company acts as the Controller.

• Talentguide acts as the Processor.

• The Client Company uses the talentguide SaaS-platform, which involves the Processing of personal data by Talentguide on the Client Company’s behalf.

• The Parties wish to set out their rights and obligations in compliance with the GDPR and applicable Data Protection Laws.

For all matters concerning the Processing of personal data, this DPA prevails over the Terms & Conditions and the Addendum in the event of conflict.

1.  Definitions and Interpretation

Capitalised terms used but not defined in this DPA have the meaning given in the Terms & Conditions. The following definitions apply:

“Agreement” means the Terms & Conditions, the Addendum and any proposal, order or statement of work between the Parties, of which this DPA forms part.

“Client Company” / “Client” means the client identified in the Agreement; the two terms refer to the same party and are used interchangeably across the Agreement documents.

“Client Company Personal Data” means any Personal Data Processed by Talentguide on behalf of the Client Company under or in connection with the Agreement. This is the single defined term used throughout this DPA.

“Data Protection Laws” means all laws applicable to the Processing of personal data under the Agreement, including the GDPR, any national laws implementing or supplementing it, and (where applicable) the ePrivacy rules.

“GDPR” means Regulation (EU) 2016/679.

“EEA” means the European Economic Area.

“Standard Contractual Clauses” / “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914, as amended or replaced.

“Sub-processor” means any processor engaged by Talentguide to Process Client Company Personal Data on behalf of the Client Company.

“Services” means the talentguide SaaS-platform and related services provided by Talentguide.

Capitalised GDPR terms – “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Processing,” and “Supervisory Authority” – have the meanings given in the GDPR.

The Schedules form part of this DPA. Headings are for convenience only.

2.  Roles, Scope and Precedence

2.1  The Client Company is the Controller and Talentguide is the Processor of the Client Company Personal Data.

2.2  This DPA applies to all Processing of Client Company Personal Data by Talentguide under the Agreement, as described in Schedule 1.

2.3  For matters concerning the Processing of personal data, this DPA prevails over the Terms & Conditions and the Addendum in the event of conflict.

3.  Processing on Documented Instructions

3.1  Talentguide shall Process the Client Company Personal Data only on the Client Company’s documented instructions (including as set out in this DPA, Schedule 1 and the Agreement), including with regard to transfers, unless required to do otherwise by EU or Member State law, in which case Talentguide shall inform the Client Company of that legal requirement before Processing, unless the law prohibits such information.

3.2  The Client Company may issue further written instructions consistent with the Agreement. Talentguide shall inform the Client Company without delay if, in its opinion, an instruction infringes the Data Protection Laws.

3.3  The Client Company warrants that it has a lawful basis for the Processing it instructs and has provided all required notices to, and obtained any required consents from, Data Subjects.

4.  Confidentiality of Personnel

4.1  Talentguide shall ensure that persons authorised to Process the Client Company Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it for the Services.

5.  Security

5.1  Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risks to Data Subjects, Talentguide shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate the measures referred to in Article 32(1) GDPR. The measures in place are described in Schedule 3.

5.2  In assessing the appropriate level of security, Talentguide shall take account in particular of the risks presented by Processing, in particular from a Personal Data Breach.

6.  Sub-processing

6.1  The Client Company gives Talentguide general written authorisation to engage Sub-processors to Process Client Company Personal Data, provided that Talentguide (i) maintains an up-to-date list of Sub-processors in Schedule 2; (ii) imposes on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA (in particular those required by Article 28 GDPR); and (iii) remains fully liable to the Client Company for each Sub-processor’s performance.

6.2  The Sub-processors authorised as at the date of this DPA are listed in Schedule 2, including the Hosting Partner, Microsoft Azure.

6.3  Talentguide shall give the Client Company at least thirty (30) days’ prior notice of any intended addition or replacement of a Sub-processor. The Client Company may object on reasonable data-protection grounds within that period; the Parties shall work in good faith to resolve the objection and, failing resolution, the Client Company may terminate the affected Services.

7.  Data Subject Rights

7.1  Taking into account the nature of the Processing, Talentguide shall assist the Client Company by appropriate technical and organisational measures, insofar as possible, to respond to requests by Data Subjects to exercise their rights under the Data Protection Laws.

7.2  Talentguide shall promptly notify the Client Company if it receives such a request and shall not respond to it except on the Client Company’s documented instructions or as required by law (in which case it shall, where permitted, inform the Client Company first).

8.  Personal Data Breach

8.1  Talentguide shall notify the Client Company without undue delay after becoming aware of a Personal Data Breach affecting the Client Company Personal Data, providing sufficient information to allow the Client Company to meet its obligations to report or inform Data Subjects under the Data Protection Laws.

8.2  Talentguide shall co-operate with the Client Company and take reasonable steps as directed to assist in the investigation, mitigation and remediation of the Personal Data Breach.

9.  Data Protection Impact Assessment and Prior Consultation

9.1  Talentguide shall provide reasonable assistance to the Client Company with any data protection impact assessment and any prior consultation with a Supervisory Authority that the Client Company reasonably considers to be required under Article 35 or 36 GDPR, taking into account the nature of the Processing and the information available to Talentguide.

10.  International Transfers

10.1  Talentguide shall not transfer Client Company Personal Data to a country outside the EEA, or authorise a Sub-processor to do so, without ensuring that the transfer is subject to an appropriate safeguard under Chapter V GDPR.

10.2  Where a transfer is made to a country that is not subject to an adequacy decision, the Parties shall rely on the SCCs, which are incorporated into this DPA by reference and completed as set out in Schedule 2, together with any supplementary measures identified by a transfer impact assessment.

10.3  Where the Processing and hosting of the Client Company Personal Data remain within the EEA, no transfer mechanism under this clause is required.

11.  Deletion or Return of Client Company Personal Data

11.1  At the Client Company’s choice, and no later than ninety (90) days after cessation of the Services involving the Processing of Client Company Personal Data (the “Cessation Date”), Talentguide shall either (i) delete and securely destroy all copies of the Client Company Personal Data, or (ii) return all such data to the Client Company in a structured, commonly-used and machine-readable format at no additional charge for a standard export, and then delete all remaining copies, including from backups in the ordinary backup cycle – unless EU or Member State law requires the data to be retained.

12.  Audit and Information

12.1  Talentguide shall make available to the Client Company all information necessary to demonstrate compliance with this DPA and Article 28 GDPR, and shall allow for and contribute to audits, including inspections, conducted by or on behalf of the Client Company.

12.2  Audits may be carried out no more than once per contract year (or more frequently where a material breach is reasonably suspected), on at least thirty (30) days’ written notice, in a manner that preserves the confidentiality, security and operational continuity of Talentguide. Costs are borne by the Client Company unless the audit reveals material non-compliance.

13.  Anonymisation and Research Use

13.1  The Client Company instructs and authorises Talentguide to anonymise Client Company Personal Data at any time and to the extent that Talentguide considers appropriate (i.e. as and when Talentguide sees fit).

13.2  Once anonymised so that Data Subjects are no longer identifiable and the data cannot be re-identified, the resulting data is no longer Personal Data and falls outside this DPA. Talentguide may use such anonymised data for the research purposes described in the Terms & Conditions (clauses 6.5–6.6).

13.3  Talentguide shall apply anonymisation techniques consistent with the Data Protection Laws and applicable regulatory guidance.

14.  Liability

14.1  Liability under or in connection with this DPA is subject to the limitations and exclusions set out in the Terms & Conditions and the Addendum, except to the extent that liability cannot be limited or excluded under the Data Protection Laws.

14.2  Each Party is liable for damage caused by Processing that infringes the GDPR to the extent provided in Article 82 GDPR. As between the Parties, Talentguide is liable for such damage only where it has not complied with obligations specifically directed to processors under the GDPR, or where it has acted outside or contrary to the Client Company’s lawful documented instructions.

15.  Governing Law and Forum

15.1  This DPA is governed by and construed in accordance with the laws of Belgium, and the Parties submit to the exclusive jurisdiction of the courts of Ghent (Ghent division), Belgium.

15.2  Before initiating proceedings, the Parties shall use reasonable good-faith efforts to settle amicably any dispute arising under this DPA.

Schedule 1 – Description of the Processing