Data Processing Agreement

This Data Processing Agreement ("DPA") governs all processing of personal data performed by Selection Lab in the context of its assessment, selection, and recruitment technology services, in accordance with Article 28(3) of the General Data Protection Regulation ("GDPR").

Parties

This DPA applies between:

• The Selection Lab B.V., trading as Selection Lab, a private limited liability company registered in the Netherlands (Chamber of Commerce no. 71341730), with its registered office at Sint Pieterspoortsteeg 19, 1012 HM Amsterdam ("Selection Lab" or "Processor"); and
• the party identified as the client in the Main Agreement ("Client" or "Controller"), whose corporate details, registered office and registration number are as stated in the Main Agreement.

Hereinafter collectively referred to as the "Parties", and individually as a "Party".

Recitals

The terms "Personal Data", "Processing", "Data Subject", "Controller" and "Processor" have the meanings given in the GDPR. Other capitalised terms have the meanings assigned below:

No Personal Data shall be transferred outside the EEA unless authorised in writing by the Controller and in full compliance with Chapter V of the GDPR, including, where applicable, the EU Standard Contractual Clauses.

The Processor shall assist the Controller in performing data protection impact assessments and in consultations with supervisory authorities when required.

The Controller may audit the Processor's compliance with this DPA once annually, or upon reasonable suspicion of non-compliance. The Processor shall cooperate fully and provide all necessary evidence.

The Parties shall cooperate fully with competent supervisory authorities and provide access to systems and documentation as legally required.

The Processor shall assist the Controller in responding to Data Subject requests under Articles 15 to 22 GDPR (access, rectification, erasure, restriction, portability, and objection).

Upon termination of the Main Agreement, the Processor shall return or delete all Personal Data as instructed by the Controller, unless retention is legally required.

Each Party is responsible for its own actions and omissions. The Processor shall maintain adequate insurance and shall be liable up to the limits set forth in the Main Agreement.

This DPA enters into force on the effective date of the Main Agreement and remains in effect for as long as the Processor processes Personal Data on behalf of the Controller, including after termination of the Main Agreement to the extent such processing continues.

This DPA is governed by Dutch law. Disputes shall be submitted exclusively to the competent court in Rotterdam, the Netherlands.

1. Contact details

• Controller: the contact person designated by the Client in the Main Agreement or, in the absence thereof, the Client's signatory of the Main Agreement.
• Processor: Beau Mosterd, Privacy Lead, [email protected].

2. Nature and purpose of processing

The Processor invites candidates on behalf of the Client to complete an online assessment used for recruitment or development purposes.

• Categories of Data Subjects: job applicants of the Client.
• Categories of Personal Data: name, email address, (optional) phone number, assessment data (psychometric responses and results).
• Purpose: to enable the Client to assess the suitability of candidates for employment or development programs.

3. Clarification of roles (split responsibility)

For the invitation, delivery, and data handling of candidate information, Selection Lab acts as Data Processor on behalf of the Client.

For the assessment content, psychometric algorithms, and analytical results generated through its proprietary models, Selection Lab acts as an independent Data Controller in accordance with the GDPR.

Selection Lab determines the analytical framework, scientific methodology, and processing logic and may use aggregated and anonymised data to improve its services.

4. Approved Sub-Processors

The following Sub-Processors are approved by the Controller upon acceptance of the Main Agreement. All Sub-Processors process Personal Data within the EEA. The current list is also published in Selection Lab's privacy statement at www.selectionlab.com/pages/privacy.

Applicable only to Clients using SmartChat (AI chat screening):

The OpenAI Sub-Processor applies exclusively where the Client has contracted SmartChat under the Main Agreement. For Clients without SmartChat, no Personal Data is processed by OpenAI.

5. Security measures

Selection Lab maintains security aligned with ISO 27001 standards, including:

• Access control and authentication;
• Encryption of data at rest and in transit;
• Logging and monitoring;
• Incident response and breach management procedures;
• Secure hosting within the EEA;
• Annual external audits (ISAE 3000 type II or equivalent).