Data Processing Agreement

1. Definitions

• GDPR means the General Data Protection Regulation (EU) 2016/679.
• Data Subject means an identified or identifiable natural person.
• Personal Data means any information relating to a Data Subject.
• Processing means any operation performed on Personal Data.
• Subprocessor means any third party engaged by Processor to process Personal Data.

2. Scope and Responsibilities

This DPA applies where and only to the extent that HuntLedger processes Personal Data on behalf of the Controller that is subject to GDPR.

3. Processing Details

Subject Matter: Provision of job application tracking services

Duration: For the term of the service agreement

Nature and Purpose: Storage and organization of job application data

Types of Personal Data:

• Contact information (email addresses)
• Job application details (company names, dates, notes)
• Technical data (IP addresses, device information)

Categories of Data Subjects: Job applicants using the HuntLedger service

4. Processor Obligations

• Process Personal Data only on documented instructions from Controller
• Ensure persons authorized to process the data are committed to confidentiality
• Implement appropriate technical and organizational security measures
• Assist Controller in fulfilling Data Subject rights requests
• Notify Controller without undue delay of any data breach
• Make available all information necessary to demonstrate compliance

5. Subprocessing

Controller grants Processor general authorization to engage Subprocessors. Current Subprocessors include:

• Google Firebase (Cloud infrastructure and authentication)
• GitHub (OAuth authentication provider, if used)
• Vercel (Hosting provider)

Processor will notify Controller of any intended changes concerning addition/replacement of Subprocessors.

6. Data Transfers

Where Personal Data is transferred outside the EEA, Processor shall ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Processing only in countries with adequacy decisions

7. Security Measures

Processor implements measures including:

• Encryption of data in transit (TLS 1.2+)
• Regular security testing and vulnerability assessments
• Access controls and authentication systems
• Data minimization principles

8. Audit Rights

Controller may request an audit no more than once annually to verify Processor's compliance. Such audits will:

• Be conducted at Controller's expense
• Provide reasonable notice
• Not interfere unreasonably with Processor's operations

9. Duration and Termination

This DPA terminates automatically upon termination of the Terms of Service or when Processor no longer processes Personal Data on behalf of Controller.

Upon termination, Processor will either delete or return all Personal Data at Controller's choice.

10. Governing Law

This DPA shall be governed by and construed in accordance with the governing law of the Terms of Service, unless required otherwise by GDPR.