Data Processing Agreement (DPA)

This page summarizes the standard DPA under which P&P Consultancy acts as a processor for recruiters/customers (controllers). To obtain a signed copy, please contact us via email: [email protected]

1. Parties and roles

The customer is the controller; P&P Consultancy is the processor.

2. Subject matter and duration

Processing of personal data to provide the subscribed services for the term of the agreement.

3. Nature and purpose

Hosting, storage, transmission, and application processing necessary to deliver recruitment and HR features.

4. Categories of data and data subjects

Candidates, recruiters, and authorized users; typical data includes contact details, CV files/metadata, booking and signing data.

5. Documented instructions

P&P processes personal data only on the controller’s documented instructions.

6. Confidentiality

Personnel are bound by confidentiality and access is strictly role-based and least-privilege.

7. Security measures

Encryption in transit/at rest, access controls, monitoring, and incident response as outlined in our Privacy & Terms.

8. Sub-processing

Controller authorizes the use of sub-processors under written agreements ensuring equivalent protections. Current list: /legal/subprocessors.

9. International transfers

Where applicable, EU Standard Contractual Clauses (SCCs) are incorporated for transfers outside the EEA.

10. Data subject rights assistance

We assist the controller in responding to requests (access, deletion, etc.) within statutory timeframes.

11. Audits and information

Upon reasonable notice, we provide information necessary to demonstrate compliance and support audits as permitted by law.

12. Incident notification

We notify the controller without undue delay of personal-data breaches per GDPR Articles 33–34.

13. Deletion and return

Upon termination or controller request, we delete or return personal data except where retention is legally required.

14. Liability and governing law

As set out in the master agreement; governed by Belgian law, unless otherwise agreed in writing.

This summary is for convenience only. The executed DPA controls in case of discrepancies.