CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

1.              INTRODUCTORY PROVISIONS

1.1.          Jobiflow s. r. o., with its registered office at Dlhé Nivy 420/90, 019 01 Ilava, Slovak Republic, Company ID No.: 57 430 501, registered in the Commercial Register of the District Court Trenčín, Section Sro, Insert 57450/R (hereinafter referred to as "Jobiflow"), issues these conditions for the processing of personal data (hereinafter referred to as "Data Processing Agreement") in the form of an addendum to the Jobiflow General Terms and Conditions for Entrepreneurs (hereinafter referred to as "GTC"), which govern contractual relations with entrepreneurs into which Jobiflow enters in connection with the use of Jobiflow Electronic Systems.

1.2.          Based on the GTC and the Agreement, this Data Processing Agreement governs the rights and obligations between Jobiflow as Processor and the Client as Controller of personal data (together as "Parties") in connection with the processing of personal data in the Electronic Systems.

1.3.          The services provided under the Agreement include activities in which the Processor may process personal data for the Controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR").

1.4.          The Parties are interested in complying with all obligations arising from the GDPR and, where applicable, other local legal regulations adopted on the basis of the GDPR, in particular Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts, as amended (hereinafter referred to as "Applicable personal data protection legislation").

1.5.          On the basis of Article 28 of the GDPR, the Controller is obliged to conclude a written personal data processing agreement with the Processor, in which the Processor shall, among other things, provide sufficient guarantees regarding the technical and organizational security of personal data protection.

1.6.          The Parties enter into this Data Processing Agreement in order to fulfill their obligations arising from the GDPR and the Applicable personal data protection legislation with the aim of ensuring the protection of personal data processed by the Parties in the performance of the Agreement.

1.7.          The Parties wish this Data Processing Agreement to apply to all personal data processing activities carried out by the Processor for the Controller in connection with the Services provided under any Agreement.

1.8.          Capitalized terms not defined in this Data Processing Agreement have the meaning assigned to them in the GTC. The terms "controller", "processor", "data subject", "personal data", "processing", "personal data breach" and other terms related to personal data protection have the meaning assigned to them in Article 4 of the GDPR.

1.9.          In the event of a conflict between this Data Processing Agreement and the GTC, the provisions of this Data Processing Agreement shall prevail with respect to the processing of personal data.

2.              SUBJECT MATTER AND PURPOSE OF THE DATA PROCESSING AGREEMENT

2.1.          The Processor shall process personal data that the Controller has obtained or obtains in connection with its business activities, or that the Processor itself obtains for the Controller for this purpose (hereinafter referred to as "Personal data"), in the course of performing the Processor's obligations arising from the Agreement.

2.2.          The purpose of the Data Processing Agreement is to define the scope of the rights and obligations of the Parties in the processing of Personal data. The Data Processing Agreement governs the rights and obligations of the Parties in the provision of the Services under Article 3.1 and applies separately to each Service provided under the Agreement.

2.3.          The Processing Agreement further specifies the scope of the Personal Data to be processed, the purpose of their processing, and the conditions and safeguards on the Processor's side regarding the ensuring of technical and organizational security of the Personal Data.

2.4.          In relation to the Personal Data of Data Subjects processed on the basis of the Controller's instructions when providing the Services, the Client acts as the controller and Jobiflow acts as the processor pursuant to Article 4(7) and (8) of the GDPR. In relation to the personal data that Jobiflow processes for its own purposes (in particular operation, security, statistics, development, and marketing of the Electronic System), Jobiflow acts as an independent controller. Processing for own purposes is governed not by this Processing Agreement, but by Jobiflow's Personal Data Processing Principles.

2.5.          The Controller is responsible for having a valid legal basis for the processing of the Personal Data within the meaning of Article 6(1) of the GDPR, or within the meaning of Article 9(2) of the GDPR if special categories of personal data are involved, and for fulfilling the information obligation towards the Data Subjects under Articles 13 and 14 of the GDPR to the extent required by the GDPR, unless otherwise agreed in this Processing Agreement. The Processor shall not be liable for the absence of, or invalidity of, the legal basis for processing on the part of the Controller.

3.              PROCESSING OF PERSONAL DATA

3.1.          The Processor shall process Personal Data for the Controller in accordance with the documented instructions of the Controller to the extent necessary for the fulfillment of the Processor's obligations under the Agreement and for the purposes of their use by the Controller within the scope of its business activities, in particular:

a)        administration of the recruitment process (publishing Job Advertisements, receiving candidate responses, evaluating candidates, and other recruitment-related functionalities) through the Service provided by Jobiflow,

b)        conducting surveys and obtaining information from the Controller's employees through the Services provided by Jobiflow,

c)        carrying out the first round of the selection procedure through the AI Avatar Interview, including the creation of an audiovisual recording, its transcription, and the automated evaluation of the match between the candidate's answers and the model answers defined by the Controller,

d)        facilitating marketing cooperation with influencers within the Influencer package, if the Client has ordered such a Service, and

e)        other activities related to the Services provided by Jobiflow.

3.2.          The processing of Personal Data under this Processing Agreement takes place only to the extent of the Services agreed in the Agreement.

3.3.          The Processor will process the personal data of job applicants and the Controller's employees (hereinafter referred to as „Data Subjects“) in the following scope:

Scope of Personal Data pursuant to Article 3.1 (i) of the Processing Agreement

Job applicants: name and surname; date of birth; address of permanent residence and contact address; academic titles; personal profile photo; contact details (telephone number, e-mail address); job title; interview confirmation (date, time, place); reasons for rejection; data provided in the job applicant's CV; other/additional data provided by the applicant during the interview; other/additional data supplemented by the Controller about the relevant applicants. When using the AI Avatar Interview, also an audiovisual recording of the interview, a text transcript of the answers, the percentage score of the match between the answers and the Controller's model answers, interview time metadata, and a record of the granting, refusal, or withdrawal of the applicant's consent

Employees of the Controller: name and surname; contact details (telephone number, e-mail address); job title; activities and logs of activities performed in the Electronic System.

Scope of Personal Data pursuant to Article 3.1 (ii) of the Processing Agreement

Employees of the Controller: name and surname; contact details (e-mail address); personal number assigned to the employee by the Controller; job title; study details.

Scope of Personal Data pursuant to Article 3.1 (iii) of the Processing Agreement

Influencers: name and surname, social media username (handle), e-mail address, contact details, profile and audience data, cooperation outputs.

Employees of the Controller: name and surname; e-mail; job title.

3.4.          If the Controller provides the Processor with, or if other Personal Data of Data Subjects are otherwise made available to the Processor in connection with activities for the Controller, or if Personal Data of other data subjects are provided to the Processor and the Processor simultaneously acts in the position of processor of such Personal Data for the Controller, the Processor is obliged to process and protect also such Personal Data in accordance with the requirements arising from (i) the GDPR, (ii) Applicable data protection laws, and (iii) this Processing Agreement.

3.5.          The Processor will process the Personal Data of the Data Subjects for the duration of this Processing Agreement.

3.6.          The categories of Data Subjects whose Personal Data are processed on the basis of this Processing Agreement are in particular: (i) job applicants responding to the Controller's Job Advertisements, (ii) employees and representatives of the Controller using the Electronic System, and (iii) influencers cooperating with the Controller within the Influencer package Service.

3.7. The Processor does not expect the processing of special categories of personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR. If the Controller inserts such data into the Electronic System (in particular through the content of an Advertisement, the applicant’s CV, or other documents), the Controller shall be solely responsible for the lawful basis for their processing.

3.8. The Processor shall not be entitled to any additional fee for the processing of Personal Data under the Data Processing Agreement, other than the remuneration under the Agreement.

4.RIGHTS AND OBLIGATIONS OF THE PROCESSOR

4.1. The Processor shall process Personal Data with due professional care so as to avoid any breach of the GDPR or Applicable personal data protection legislation.

4.2. If the Processor finds that the Controller is violating the obligations arising for it under the GDPR, it shall notify the Controller without undue delay.

4.3. The Processor shall be bound, when processing Personal Data, by the Controller’s documented instructions. Instructions must be given in accordance with this Data Processing Agreement, mostly through the relevant functionalities of the individual products/services used under the Agreement.

4.4. The Processor shall ensure that no Data Subject suffers any harm to their rights, in particular the right to human dignity, and shall also protect against unauthorized interference with the private and personal life of Data Subjects.

4.5. The Processor undertakes to fulfill the information obligation on behalf of the Controller pursuant to Article 13 GDPR, unless otherwise stipulated by the Agreement for specific products.

4.6. If a Data Subject requests information from the Processor pursuant to Article 15 GDPR regarding the processing of their Personal Data, the Processor shall provide the Data Subject with the Controller’s identification details and refer them to exercise this right with the Controller. Thereafter, the Processor shall proceed according to the Controller’s written instructions.

4.7. The Processor shall inform the Controller of any investigation carried out by the competent supervisory authority and of its outcome, if it concerns Personal Data processed for the Controller or the parameters of the Service provided to the Controller by the Processor, and shall provide information that the investigation affected these parameters. For the avoidance of doubt, requests of the competent supervisory authority relating to the processing of Personal Data that do not lead to the initiation of proceedings—inspection or administrative proceedings—shall not be considered an investigation.

4.8. The Controller shall notify the Processor of any inspection or the initiation of administrative proceedings for the imposition of corrective measures and/or a fine by the competent supervisory authority (hereinafter referred to as the “Administrative proceedings”) if the inspection or Administrative proceedings relate to (i) Personal Data processed by the Processor for the Controller or (ii) the parameters of the Service provided to the Controller, if it is expected that the performance of such inspection or Administrative proceedings may affect these parameters.

4.9. The Processor shall inform the Controller of any security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of Personal Data that are transmitted, stored, or otherwise processed (hereinafter referred to as “Personal Data Breach”). In the event of a Personal Data Breach within the meaning of Article 4(12) GDPR, the Processor shall:

a) notify the Controller of its existence electronically without undue delay, at the latest within 24 hours from discovery of the breach, to the contact email of the Controller provided in the registration in the Electronic System; the initial notification may be preliminary and may not contain all information if the Processor does not have it available at that time,

b) within 72 hours from discovery of the breach, supplement the available information pursuant to Article 33(3) GDPR, in particular: a description of the nature of the breach, the categories and estimated number of data subjects and records, the name and contact details of the responsible person or other contact point, a description of the likely consequences of the breach, and a description of the measures taken or proposed to address the breach,

c) provide the Controller with full cooperation in fulfilling its notification obligation to the supervisory authority (the ÚOOÚ SR) and, where applicable, to the affected persons pursuant to Articles 33 and 34 GDPR,

d) keep documentation of the breach pursuant to Article 33(5) GDPR for a minimum period of 5 years from the discovery of the breach.

4.10. Information about the Personal Data Breach must include at least:

a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects, and the categories and approximate amount of affected Personal Data records,

b) a description of the likely consequences of the Personal Data Breach,

c) a description of the measures the Processor has taken or proposed to take in order to address the Personal Data Breach, including any measures to mitigate possible adverse effects, and

d) the contact details of the responsible person or other contact point where further information may be obtained.

4.11. The Processor undertakes to allow audits, including inspections, to be carried out by the Controller or another auditor appointed by the Controller, and shall contribute to such audits (hereinafter referred to as the “Audit”). The Controller acknowledges that the performance of the Audit may not affect the legitimate interests of third parties (e.g. other controllers) or Data Subjects, especially as regards ensuring the confidentiality of personal data. The Controller confirms that the conditions of the Audit shall be agreed in writing (by e-mail) and that the Processor’s costs related to the Audit shall be the subject of a separate agreement on reimbursement of costs by the Controller. The Controller shall not request unreasonable cooperation from the Processor, especially if the requested information relating to the Audit is available on the product/service website and/or in the Jobiflow Personal Data Processing Policy published in the Electronic System.

4.12. The Controller is entitled to carry out an Audit no more than once every 12 months, unless special circumstances (in particular a Personal Data Breach or a justified suspicion of a breach of the Processor’s obligations) require the Audit to be carried out earlier or repeatedly. The Controller is obliged to notify the Processor of its intention to carry out an Audit at least 30 days in advance, and the Audit must be carried out in a manner that minimally disrupts the Processor’s operations. The auditor appointed by the Controller must not be a competitor of the Processor and must undertake in writing to maintain confidentiality before the Audit begins.

4.13. The Processor has carried out a data protection impact assessment in relation to the AI Avatar Interview within the meaning of Article 35 GDPR and its relevant conclusions shall be made available to the Controller upon request via the Electronic System or by e-mail. Pursuant to Article 28(3)(f) GDPR, the Processor shall provide the Controller with all cooperation necessary for the Controller to carry out its own impact assessment and for any prior consultation with the supervisory authority pursuant to Article 36 GDPR. The Controller acknowledges that the obligation to carry out an impact assessment in relation to its own selection procedure lies with the Controller as the controller of personal data; the Controller may use the Processor’s assessment conclusions as a basis.

4.14. The Processor undertakes to assist the Controller in fulfilling the Controller’s obligation to respond to requests for the exercise of Data Subjects’ rights, in particular requests for access to Personal Data, rectification or erasure of Personal Data, restriction of processing or portability of Personal Data; provided that these obligations can be fulfilled through the functionalities of the individual products, the Controller shall not require unreasonable cooperation from the Processor.

4.15. The Processor undertakes to assist the Controller in fulfilling the obligations set out in the GDPR, in particular the obligation to ensure the processing of Personal Data, to report personal data breaches, to ensure data protection impact assessments or prior consultation with the supervisory authority, taking into account the nature of the processing and the information available to the Processor.

4.16. The Processor shall ensure that persons authorized to process Personal Data on the Processor’s side are bound in writing by a confidentiality obligation or are subject to a statutory duty of confidentiality. The confidentiality obligation shall continue to apply even after the termination of the employment or other relationship of such persons with the Processor.

4.17. The Processor shall keep records of all categories of processing activities carried out on behalf of the Controller to the extent set out in Article 30(2) of the GDPR and shall make them available to the Controller or the supervisory authority upon request.

4.18. The Controller undertakes to (i) give instructions to the Processor in accordance with the GDPR, (ii) ensure that Data Subjects are informed to the extent not ensured by the Processor pursuant to Article 4.5 of the Processing Agreement, (iii) promptly inform the Processor of the exercise of a Data Subject’s rights that cannot be handled directly through the functionalities of the Electronic System, and (iv) without undue delay inform the Processor of any change in the legal basis for the processing of Personal Data.

5. TECHNICAL AND ORGANIZATIONAL SAFEGUARDS FOR THE PROTECTION OF PERSONAL DATA

5.1. The Processor undertakes that, within the meaning of Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing personal data and the risks of varying likelihood and severity for the rights and freedoms of natural persons, it shall implement all appropriate technical and organizational measures to ensure the level of protection of Personal Data.

5.2. The Processor undertakes to adopt the following organizational and technical measures:

a) without prejudice to Article 5.3 of this Processing Agreement, in the case of processing Personal Data through its own employees, the Processor shall assign this activity only to its selected employees, whom it shall instruct about their duty to maintain confidentiality regarding Personal Data and about other obligations they are required to comply with so as not to violate the GDPR or this Processing Agreement,

b) shall not entrust the processing of Personal Data to any third party without the Controller’s prior written consent; this does not exclude Articles 5.3 and 5.4,

c) shall use appropriate technical equipment and software in a manner that excludes unauthorized or accidental access to Personal Data by persons other than the Processor’s authorized employees,

d) shall store Personal Data in duly secured premises and rooms,

e) shall store written documents containing Personal Data in a secure place and shall keep proper records of the movement of such written documents,

f) shall store Personal Data in electronic form on secure servers or data carriers accessible only to authorized persons on the basis of access codes or passwords, and shall regularly back up Personal Data,

g) shall ensure remote transmission of Personal Data either only through a publicly inaccessible network or through secure transmission via public networks, in particular through a protocol enabling secure communication in a computer network. Taking into account the nature, scope, context and various serious risks, some personal data may be sent by e-mail,

h) through appropriate technical means, shall ensure the ability to restore the availability of Personal Data and access to them in a timely manner in the event of physical or technical incidents, in accordance with the parameters agreed for the respective Service under the Agreement,

i) shall ensure regular testing, assessment and evaluation of the effectiveness of the implemented technical and organizational measures to ensure the security of processing,

j) shall ensure pseudonymization and encryption of Personal Data wherever this is appropriate and possible in view of the nature of the processing and the state of technological development,

k) shall implement appropriate measures to protect login credentials and manage access permissions (in particular multi-factor authentication for administrative access) and

l) shall ensure the implementation of other measures set out on the product/service website in the Technical Specification and Security section.

5.3. The Processor is entitled to engage another processor to process Personal Data (hereinafter referred to as "Subprocessor"). The Processor shall inform the Controller by e-mail sent to the Controller’s address (Art. 7.2) and through the list of Subprocessors published in the Electronic System or in the Jobiflow Personal Data Processing Principles (hereinafter referred to as "Information Board") of all Subprocessors it intends to engage to process Personal Data or of any intended changes regarding the engagement of Subprocessors. The Controller has the right to object to the engagement of such Subprocessors in accordance with the terms of the Agreement. In the event of objections, Article 5.7 of this Processing Agreement shall apply.

5.4. If the Processor engages a Subprocessor to carry out certain processing activities, the same obligations for the protection of Personal Data as set out in this Processing Agreement must be imposed on that Subprocessor by means of a written contract, in particular the provision of sufficient guarantees as to the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the GDPR.

5.5. The Controller acknowledges that the Services of some Subprocessors listed on the Information Board may include the processing of personal data outside the EU/EEA. The Controller guarantees that any transfer of Personal Data to third countries shall take place only under the conditions set out in Articles 44 - 49 of the GDPR. If the instruments for transferring Personal Data to a third country are changed, canceled or invalidated, the Controller undertakes to adopt such measures as will achieve the level required by EU legislation. The parties undertake to provide mutual cooperation in the adoption of substitute transfer instruments and, for the period of their adoption, not to apply contractual penalties for this reason.

5.6. If the transfer of Personal Data to a third country outside the EU/EEA requires the application of standard contractual clauses approved by the European Commission within the meaning of Article 46(2)(c) of the GDPR (European Commission Decision (EU) 2021/914), the Parties agree that these clauses shall apply between them in the relevant module (in particular Module 3 — processor to processor) and are available under Commission Decision (EU) 2021/914.[1] By concluding the Processing Agreement, the Controller expressly authorizes the Processor to conclude standard contractual clauses with Subprocessors on behalf of the Controller.

5.7. Jobiflow is authorized to engage another intermediary only after prior notice to the Client at least 30 days in advance. The Client is entitled to raise reasoned objections within 15 days from receipt of the notice. If reasoned objections are raised and the Parties do not agree otherwise, Jobiflow shall not engage another intermediary unless it is necessary for the provision of the affected Service; in such a case, either Party is entitled to terminate the affected Service on the effective date of the change.

5.8. The Intermediary is obliged to implement and document the adopted and executed technical and organizational measures to ensure the protection of Personal Data in accordance with the GDPR and Applicable legal regulations on personal data protection.

6.TERM AND TERMINATION OF THE DATA PROCESSING AGREEMENT

6.1. The Data Processing Agreement becomes valid and effective on the date of execution of the Agreement and terminates no earlier than the termination of the Agreement. In the event that the Parties have concluded or will conclude another agreement, under which, among other things, the processing of Personal Data may take place, this Data Processing Agreement shall terminate simultaneously with the termination of the last of such agreements.

6.2. The Controller is entitled to terminate this Data Processing Agreement with 3 days' notice in the event that the Intermediary breaches the obligations arising for it from the GDPR or Applicable personal data protection legislation and fails to remedy such breach within 15 days from written notice by the Controller.

6.3. The Intermediary is entitled to terminate this Data Processing Agreement with 3 days' notice in the event that the Controller breaches the obligations arising for it from the GDPR or Applicable personal data protection legislation and fails to remedy such breach within 15 days from notice by the Intermediary pursuant to Art. 4.2 of this Data Processing Agreement.

6.4. Unless otherwise stated in the Agreement for specific products, after termination of the Agreement or this Data Processing Agreement, after the purpose of processing Personal Data by other means has lapsed, after withdrawal of consent (if relevant) by the Data Subject or based on a request of the Data Subject pursuant to Art. 17 GDPR, the Intermediary is obliged, according to the Controller's instructions, to destroy the relevant Personal Data or transfer them to the Controller and destroy the Personal Data in its possession. The Controller's instruction to destroy or transfer Personal Data must be delivered to the Intermediary no later than on the day of termination of the validity of the Agreement or the Data Processing Agreement, or if it occurs before the termination of the validity of the Agreement or the Data Processing Agreement, within 10 working days from the day when the Controller or the Intermediary (whichever occurs later) is informed of the termination of the purpose for which the Personal Data are processed, the withdrawal of consent or the receipt of a request pursuant to Art. 17 GDPR; otherwise the Intermediary shall destroy the Personal Data of the Data Subject on the day of termination of this Data Processing Agreement or the Agreement or after the expiry of the above-mentioned deadlines.

6.5. If the Controller does not give instructions to transfer Personal Data within 30 days from termination of the Agreement or this Data Processing Agreement, the Intermediary is entitled and obliged to carry out secure destruction of the Personal Data without further notice. This does not apply to Personal Data that the Intermediary is obliged to retain under applicable law (in particular accounting and tax regulations).

6.6. After termination of this Data Processing Agreement, the Intermediary is obliged to comply with all obligations arising from the GDPR and/or Applicable personal data protection legislation, aimed in particular at preventing any unauthorized handling of Personal Data until, according to the Controller's instructions, the Intermediary hands over such Personal Data to the Controller or carries out their secure destruction.

6.7. Termination of the Data Processing Agreement constitutes a fact that, depending on the Service provided, makes all or only some specific types of activities under the Agreement impossible.

6.8. The obligation to maintain the confidential nature of Personal Data continues even after termination of the Data Processing Agreement.

6.9. Notwithstanding the other provisions of this article, the Intermediary shall destroy the audiovisual recording from the AI Avatar Interview and its transcript no later than six (6) months after the termination of the relevant selection process, or immediately after withdrawal of consent by the applicant, whichever occurs earlier, unless the Controller gives instructions for earlier destruction or retention is necessary to prove, assert, or defend legal claims in a specific ongoing dispute. The percentage match score and the record of consent may be retained for the period under Art. 3.5 of this Data Processing Agreement.

7.LIABILITY OF THE PARTIES AND COMPENSATION FOR DAMAGES

7.1. Each Party is liable for damage caused to the Data Subject or the other Party as a result of a breach of obligations arising from the GDPR, Applicable personal data protection legislation, or this Data Processing Agreement, to the extent of its own fault.

7.2. If a fine is imposed on one of the Parties by a supervisory authority (in particular the Office for Personal Data Protection of the Slovak Republic) or a claim for damages is brought against it by the Data Subject as a result of the other Party's breach of obligations under the GDPR, Applicable personal data protection legislation, or this Data Processing Agreement, the other Party is obliged to compensate the damage thus incurred, including the imposed fine, to the extent of its responsibility for the возникновения of such fine or damage.

7.3. The total liability of the Intermediary for damages incurred by the Controller in connection with this Data Processing Agreement is limited to an amount corresponding to the price paid by the Controller to the Intermediary for the provided Services for the last 12 months preceding the occurrence of the damage. This limitation does not apply to damages caused intentionally or by gross negligence, nor to claims of Data Subjects asserted under Art. 82 GDPR, nor to fines imposed by a supervisory authority as a result of breaches of obligations exclusively on the part of the Intermediary.

7.4. The Parties undertake, in the event of a claim by the Data Subject or a supervisory authority, to provide each other with all necessary cooperation in defending and resolving such claim, in particular to exchange relevant information and documents with each other without undue delay.

8.CONTACT DETAILS

8.1. All notices, including notices of Personal Data Breach, may be delivered by e-mail to: info@jobiflow.com.

8.2. The Controller's e-mail is the contact e-mail listed in the Controller's registration in the Intermediary's Electronic system or the contact detail specified in the Agreement.

8.3. If the Intermediary designates a responsible person (DPO) pursuant to Art. 37 GDPR, it shall publish the contact details of the responsible person in the Personal Data Processing Policy and make them available also at the e-mail address pursuant to Art. 8.1 of this Data Processing Agreement.

9.FINAL PROVISIONS

9.1. The legal relations, obligations, rights and duties arising from this Data Processing Agreement, as well as amendments thereto and its interpretation, shall be governed by and interpreted in accordance with the legal order of the Slovak Republic. The contractual relations between the Controller and the Intermediary, which are not expressly regulated in this Data Processing Agreement, are governed by the provisions of the General Terms and Conditions published in the Jobiflow Electronic system.

9.2. An informative translation of this Data Processing Agreement in English may be available upon request. In the event of any differences between the English or any other foreign-language version, the Slovak language version shall prevail.

9.3. If any provision of the Data Processing Agreement is declared invalid, ineffective, apparent or unenforceable by the competent court or other authority, such provision shall be deemed deleted from this Data Processing Agreement, while the other provisions of the Data Processing Agreement shall remain valid, unless the nature of such provision or its content or the circumstances under which it was concluded imply that it cannot be separated from the other content of the Data Processing Agreement. In such case, the Parties shall conclude such amendments as will enable achievement of the same purpose, and if that is not possible, then the closest possible purpose to that originally intended by the invalid, ineffective, apparent or unenforceable provision.

9.4. The Parties undertake to resolve any dispute arising in connection with the performance of this Processing Agreement amicably. If the Parties fail to resolve the dispute amicably within 30 days, either Party shall be entitled to submit the dispute to the court of the Slovak Republic with subject-matter and local jurisdiction.

9.5. The scope of the Personal Data processed set out in Art. 3.3 of the Processing Agreement may be expanded or otherwise amended depending on the functionality of the relevant product without the need to conclude an addendum to this Processing Agreement or the Terms and Conditions.

9.6. In the event of the conclusion of this Processing Agreement, the Parties agreed that the Processing Agreement is concluded only if there is a complete concurrence of the expressions of will of the Parties.

9.7. Terms not further specified by this Processing Agreement, but stated in this Processing Agreement, shall have the meaning set out in the Terms and Conditions and the Agreement.

9.8. The Processor is entitled to unilaterally amend or supplement this Processing Agreement pursuant to Art. 19(1) and (2) of the Terms and Conditions. An amendment caused by a change in the GDPR, Applicable legal regulations on personal data protection, a decision of a supervisory authority or a court shall become effective, regardless of the period pursuant to Art. 19(1) of the Terms and Conditions, on the effective date of the relevant amendment to the legal regulation or on the date on which the decision becomes final.

9.9. This Processing Agreement together with the Terms and Conditions, the Agreement, the Price List, the Personal Data Processing Principles and the Cookie Policy constitutes the entire agreement of the Parties on the subject matter of personal data processing and supersedes all previous oral or written arrangements on the same matter.

9.10. The Processing Agreement is valid and effective from 26.5.2026..

Jobiflow s. r. o.

Appendix No. 1

List of approved sub-processors

[1] https://eur-lex.europa.eu/legal-content/SK/TXT/?uri=CELEX%3A32021D0914