Processing of Personal Data

This Data Processing Agreement ("DPA") governs all processing of personal data performed by Selection Lab in the context of its assessment, selection, and recruitment technology services, in accordance with Article 28(3) of the General Data Protection Regulation ("GDPR").

Parties

This DPA applies between:

• The Selection Lab B.V., trading as Selection Lab, a private limited liability company registered in the Netherlands (Chamber of Commerce no. 71341730), with its registered office at Sint Pieterspoortsteeg 19, 1012 HM Amsterdam ("Selection Lab" or "Processor"); and
• the party identified as the client in the Main Agreement ("Client" or "Controller"), whose corporate details, registered office and registration number are as stated in the Main Agreement.

Hereinafter collectively referred to as the "Parties", and individually as a "Party".

Recitals

The terms "Personal Data", "Processing", "Data Subject", "Controller" and "Processor" have the meanings given in the GDPR. Other capitalised terms have the meanings assigned below:

Personal Data is transferred outside the EEA only to the Sub-Processors listed in Annex 1, section 4, on the basis stated there for each, being an adequacy decision or the European Commission's Standard Contractual Clauses, and in full compliance with Chapter V GDPR. Approval of that list under Article 4.3 is the Controller's written authorisation.

The Processor shall assist the Controller in performing data protection impact assessments and in consultations with supervisory authorities when required.

The Controller may audit the Processor's compliance with this DPA once annually, or upon reasonable suspicion of non-compliance. The Processor shall cooperate fully and provide all necessary evidence.

The Parties shall cooperate fully with competent supervisory authorities and provide access to systems and documentation as legally required.

The Processor shall assist the Controller in responding to Data Subject requests under Articles 15 to 22 GDPR (access, rectification, erasure, restriction, portability, and objection).

Upon termination of the Main Agreement, the Processor shall return or delete all Personal Data as instructed by the Controller, unless retention is legally required.

Each Party is responsible for its own actions and omissions. The Processor shall maintain adequate insurance and shall be liable up to the limits set forth in the Main Agreement.

This DPA enters into force on the effective date of the Main Agreement and remains in effect for as long as the Processor processes Personal Data on behalf of the Controller, including after termination of the Main Agreement to the extent such processing continues.

This DPA is governed by Dutch law. Disputes shall be submitted exclusively to the competent court in Rotterdam, the Netherlands.

1. Contact details

• Controller: the contact person designated by the Client in the Main Agreement or, in the absence thereof, the Client's signatory of the Main Agreement.
• Processor: Ondřej Sloup, Data Protection Officer, [email protected].

2. Nature and purpose of processing

The Processor invites candidates on behalf of the Client to complete an online assessment used for recruitment or development purposes.

• Categories of Data Subjects: job applicants of the Client.
• Categories of Personal Data: name, email address, (optional) phone number, assessment data (psychometric responses and results).
• Purpose: to enable the Client to assess the suitability of candidates for employment or development programs.

3. Clarification of roles

Selection Lab acts as an independent Data Controller for the assessment: the assessment content and psychometric methodology, the processing of candidates' responses and results, the consent candidates give, and their rights requests. The Client acts as an independent Data Controller for its own recruitment process, including the decision whether to make an offer. Selection Lab acts as Data Processor on the Client's behalf only for tasks it performs strictly on the Client's instructions, such as sending assessment invitations; this DPA governs those tasks.

4. Approved Sub-Processors

The following Sub-Processors are approved by the Controller upon acceptance of the Main Agreement. Sub-Processors process Personal Data within the EEA unless the table states otherwise; in that case the transfer rests on the European Commission's Standard Contractual Clauses (SCCs). The current list is also published in Selection Lab's privacy statement at www.selectionlab.com/pages/privacy.

Applicable only where the Client uses the assessment concerned:

Applicable only to Clients using SmartChat (AI chat screening):

The Sub-Processors in this table apply exclusively where the Client has contracted SmartChat under the Main Agreement. For Clients without SmartChat, no Personal Data is processed by them.

5. Security measures

Selection Lab maintains security aligned with ISO 27001 standards, including:

• Access control and authentication;
• Encryption of data at rest and in transit;
• Logging and monitoring;
• Incident response and breach management procedures;
• Secure hosting within the EEA, except where the Sub-Processor tables in item 4 state otherwise;
• Annual external audits (ISAE 3000 type II or equivalent).

Reference documents