<aside> 💡 Back to Vouch: www.vouch.no.

</aside>

1. Scope and purpose of Data Processing Agreement

This Data Processing Agreement (the "DPA") delineates the respective rights and responsibilities of Vouch and and the legal entity that have signed up to the Services, as further described in correspondence with Vouch and each Job Postings (“Customer” or “Data Controller”), when the Data Processor processes personal data on behalf of the Data Controller, as part of the services offered under the Master Customer Agreement (“MCA”).

For processing not covered by the MCA, each party is considered separate controllers under the Applicable Privacy Law, unless otherwise agreed in writing between the Parties.

The DPA comprises of this document and its accompanying by the MCA. In cases of conflict between the MCA and this DPA, the latter shall prevail for matters specifically pertaining to processing of personal data.

2. Definitions

"Applicable Privacy Law" refers to the relevant versions of the EU's General Data Protection Regulation (2016/679) ("GDPR"), the Norwegian Act on the Processing of Personal Data of June 15, 2018 (the Personal Data Act), and any additional legislation concerning the processing and protection of personal data.

“Data Controller” refers to the Customer, when the processing of personal data pertains to the provision of the Services, as described in the MCA.

“Data Processor” refers to Vouch, when Vouch processes personal data on behalf of the Customer in connection with the provision of the Services, as described in MCA.

“Data Transfer” refers to a processing operation that satisfies the following cumulative requirements, as defined by the EDPB:

1. A controller or a processor (“Exporter”) is subject to the GDPR for the given processing.
2. The exporter discloses by transmission or otherwise makes personal data, subject to this processing, available to another controller, joint controller or processor (“Importer”).
3. The importer is in a third country, irrespective of whether or not this importer is subject to the GDPR for the given processing in accordance with Article 3, or is an international organisation

“Services” as defined in the MCA.

"Sub-processor" refers to an entity or individual engaged by the Data Processor as a subcontractor to process personal data under the MCA.

Terms not explicitly defined herein shall be interpreted in accordance with Article 4 of the GDPR or the MCA.

3. Scope of processing

3.1. Processing operations and controllership

Vouch will process personal data on behalf of the Customer in connection with providing the Services, as set forth in the MCA. The Customer acknowledges that the Customer is the Data Controller and that Vouch is the Data Processor for the following processing operations:

i) Collection of personal data concerning a Candidate for a specific Job Posting,

ii) Preliminary screening of Candidates for a specific Job Posting,

iii) Query a Candidate’s interest in a specific Job Posting,

iv) Forward personal data concerning a Candidate to the Customer,

v) Access and review of candidate process and the result of the hiring process,

vi) Deletion and erasure of personal data concerning Candidates that requests deletion after a candidate process, and

vii) Use of personal data concerning a Voucher in connection with payment of Referral Rewards.

For any other processing activity not covered by the Services or the DPA, each party shall be considered an individual data controller.

The Customer’s responsibility as Data Controller ceases when a specific candidate process or Job Posting is concluded or ceases to be valid, provided that the Customer transfers the personal data to Vouch, deletes or anonymizes the personal data concerned.

3.2. Categories of personal data

The nature, purpose and categories of personal data subject to this DPA will be:

i) Name,

ii) Contact details,

iii) CV data,

iv) Screening data and evaluations, and

v) Job application history