Data Processing Agreement

Effective: November 10, 2026

In short

When you run a job board on Kardow, you decide what happens to your users’ data, and Kardow handles it only to run your board. This agreement puts that in writing, as Article 28 of the GDPR requires. It is part of our Terms of Service and is accepted with them.

Related: Subprocessors.

1. Scope

This Data Processing Agreement (the "DPA") is between Kardow ("Kardow", "we", "us"), an entreprise individuelle registered in Quebec, Canada, and the customer that holds a Kardow account ("Customer", "you"). It applies when Kardow processes personal data on your behalf while providing the Services and that processing is subject to the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR or the Swiss Federal Act on Data Protection ("Data Protection Law"). It forms part of the Terms of Service (the "Terms").

Terms such as "controller", "processor", "personal data", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Customer Personal Data" means personal data Kardow processes on your behalf through the Services. "SCCs" means the standard contractual clauses in Commission Implementing Decision (EU) 2021/914.

2. Roles

You are the controller of Customer Personal Data and Kardow is your processor. You are responsible for the lawfulness of the processing, including the notices you give your users and the data you choose to collect. Kardow is a separate controller for its own account, billing and support data, which our Privacy Policy covers.

3. Instructions

Kardow processes Customer Personal Data only on your documented instructions, including with regard to transfers. Your instructions are the Terms, this DPA and your configuration and use of the Services, and they include creating aggregated or de-identified statistics as described in the Terms. If a law Kardow is subject to requires other processing, we will tell you first, unless that law forbids it. We will tell you if we believe an instruction infringes Data Protection Law.

4. Confidentiality

Persons authorised by Kardow to process Customer Personal Data are bound by confidentiality.

5. Security

Kardow implements appropriate technical and organisational measures under Article 32 of the GDPR, as described in Annex 2.

6. Subprocessors

You give Kardow general authorisation to engage subprocessors. The current list is at kardow.com/subprocessors. We will inform you of any intended addition or replacement before it takes effect, by updating that page and emailing your account owner. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the Services. Kardow imposes on each subprocessor, by contract, data protection obligations equivalent to those in this DPA, and remains liable to you for their performance.

7. International transfers

Transfers of Customer Personal Data to Kardow rely on the European Commission’s adequacy decision for Canada (Decision 2002/2/EC). Onward transfers to subprocessors outside the European Economic Area are made under the SCCs or another transfer mechanism recognised by Data Protection Law.

If that adequacy decision stops covering a transfer to Kardow, Module 2 of the SCCs applies between you (data exporter) and Kardow (data importer) and is incorporated by reference, with these choices: Clause 7 applies; Clause 9(a) Option 2 applies, with notice as in section 6; the option in Clause 11 does not apply; the supervisory authority under Clause 13 is the one competent for you; the law and courts under Clauses 17 and 18 are those of the EU Member State where you are established, or Ireland if there is none. Annexes 1 and 2 of this DPA complete the SCCs’ Annexes I and II. For UK and Swiss transfers, the SCCs apply with the UK International Data Transfer Addendum or the adjustments required under Swiss law.

8. Assistance

Taking into account the nature of the processing, Kardow will assist you by appropriate technical and organisational measures, insofar as possible, in responding to requests from individuals exercising their rights, mainly through the tools in your dashboard. If we receive such a request about your board, we will pass it to you. Taking into account the information available to us, we will also assist you with your obligations under Articles 32 to 36 of the GDPR.

9. Personal data breaches

Kardow will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information reasonably available to us that you need to meet your own notification obligations.

10. End of the Services

You can export Customer Personal Data while your subscription is active. If you ask within 30 days after it ends, we will return it to you. After that, Kardow deletes Customer Personal Data, including copies, unless a law we are subject to requires us to keep it.

11. Audits

Kardow will make available the information necessary to demonstrate compliance with Article 28 of the GDPR, and will allow for and contribute to audits by you or an auditor you mandate, on reasonable prior written notice, no more than once a year unless required by a supervisory authority, at your cost, subject to confidentiality and without access to other customers’ data.

12. General

Liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow it. The SCCs, where they apply, prevail over this DPA, and this DPA prevails over the Terms. This DPA lasts as long as Kardow processes Customer Personal Data. We may update it as we may update the Terms. Contact: support@kardow.com.

Annex 1: Description of the processing

  • Data exporter (controller): the Customer, contactable through its account owner’s email address.
  • Data importer (processor): Kardow, entreprise individuelle registered in Quebec, Canada. Contact: support@kardow.com.
  • Data subjects: job seekers and candidates, job alert and newsletter subscribers, employers and their staff, the Customer’s team members, and visitors to the Customer’s board.
  • Personal data: identity and contact details; profile and CV content; applications and answers to application questions; alert and email preferences; employer and billing details; messages; technical data such as IP address and device information.
  • Special categories: none required by the Services. They may appear in content users provide, such as CVs.
  • Nature and purpose: hosting and operating the Customer’s job board and related features under the Terms.
  • Duration and frequency: continuous, for the term of the Services and until deletion under section 10.
  • Subprocessors: as listed at kardow.com/subprocessors.

Annex 2: Technical and organisational measures

  • Encryption of data in transit (HTTPS/TLS).
  • Encryption of stored data at rest by our hosting providers.
  • Access rules that separate each board’s data.
  • CVs and application documents kept in private storage.
  • Access to production systems limited to the people who need it.
  • Regular automated backups.
  • Card payments handled by the payment provider; Kardow does not store card numbers.
  • Subprocessors bound by data processing terms.