Data processing agreement

DABL Technology Ltd. (Skailer) - Version 10.2026

This Data Processing Addendum (the “DPA”), including all Annexes, forms part of the Master Services Agreement (the “Agreement”) between the Customer (“Controller”) and Skailer (“Processor”), collectively referred to as the “Parties”. The DPA governs the Processing of Personal Data in connection with the provision of the services by the Processor under the Agreement (the “Services”).

1. Scope and Order of Precedence

1.1 This DPA applies to the processing of Personal Data by Skailer solely on documented instructions of Controller, for the sole purpose of providing Services, within the scope of Data Protection Regulation/s.

1.2 In case of conflict, the following applies in order: (1) EU Commission Standard Contractual Clauses (Decision 2021/914), Module Two (Controller–Processor) (“SCC”) where applicable, (2) this DPA, (3) the Agreement, to the fullest extent allowed by law.

1.3 Annexes including Annex I, II, and III form integral appendices to this DPA.

2. Roles and Definitions

2.1 The Controller determines the means and purposes for processing. Skailer acts only as Processor, solely per Controller’s documented instructions.

2.2 “Data Protection Regulation/s” means (i) Regulation (EU) 2016/679 (“GDPR”); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) any applicable national regulations implementing or transposing European or international regulations.

2.3 Key terms (“personal data”, “processing”, etc.) have the meanings defined under the GDPR.

2.4 Capitalized terms not otherwise defined in this DPA shall have the meanings given to them in the Agreement.

3. Documented Instructions and Restrictions

3.1 Skailer processes Personal Data only on documented Controller instructions.

3.2 Processing for Skailer’s own (or third-party) purposes—including training AI or marketing—is prohibited unless explicitly authorized in writing.

3.3 Controller warrants all personal data is collected lawfully and passes on required notices and consents.

3.4 Processor shall notify the Customer without undue delay if for any reason it cannot comply with any portion of this DPA or Data Protection Regulation/s, or if it becomes aware or has reason to believe that its processing may cause Customer to breach any of its responsibilities under Data Protection Regulation/s.

3.5 The Controller’s configuration and use of the Platform, including data entered, uploaded, imported or integrated by the Controller and its Users, constitute the Controller’s documented instructions. Skailer does not review, monitor or verify Personal Data entered into the Platform.

4. Data Categories and Processing Details (Annex I)

4.1 Subject to Annex I, Skailer processes data necessary for providing Services under the Agreement.

4.2 Skailer does not require special categories of personal data to provide the Services and does not apply measures specific to such data beyond those set out in Annex II. The Controller determines at its sole discretion whether to enter any special categories of personal data (including absence records that may constitute health data, attachments or custom fields) and is solely responsible for establishing an applicable condition under Article 9 GDPR, a lawful basis under Article 6 GDPR, notices to data subjects and any required data protection impact assessment. Any such data is processed as a documented instruction of the Controller, subject to the same technical and organisational measures as other Personal Data, and without any additional obligations of Skailer.

4.3 The lawful basis for processing is primarily contractual necessity or legitimate interests as detailed per data category in Annex I.

4.4 Skailer does not make automated decisions or profile data subjects for its own purposes. Features that analyse, score or summarise data (including AI features and reports) are tools enabled and used at the Controller’s discretion; the Controller is solely responsible for the lawfulness of such use and for any decisions taken in relation to data subjects.

4.5 Transfers of Personal Data to third-party services connected by the Controller (including messaging, e-mail, calendar, identity and applicant tracking services) are made on the Controller’s instruction, and such services are not Subprocessors of Skailer. Retention periods for Personal Data within the Platform are determined and applied by the Controller.

5. Confidentiality and Access

5.1 Authorized Skailer staff are subject to confidentiality commitments consistent with Skailer’s confidentiality obligations under this DPA and applicable Non-Disclosure Agreement, and receive necessary training.

5.2 Access is restricted to Service delivery only, using secure password and access practices.

6. Security Measures (Annex II)

6.1 Skailer implements appropriate technical and organizational measures in accordance with Article 32 of the GDPR as described in Annex II, aligned with recognized standards.

6.2 Measures include: encryption in transit (TLS) and at rest, multi-factor authentication, access control, secure backup and tested restoration, vulnerability monitoring, segregation of customer environments, incident response protocols, and continuous monitoring.

7. Data Subject Rights and Assistance

7.1 Skailer shall assist the Customer, taking into account the nature of the processing, through appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject’s rights set forth in Chapter III of the GDPR.

7.2 Skailer shall notify without undue delay the Customer of the requests it receives from data subjects. It will not respond to such a request itself, unless the Customer has authorized it to do so.

7.3 Skailer shall assist the Customer in ensuring compliance with the obligations set forth in Articles 35 and 36 of the GDPR, taking into account the nature of the processing and the information available to Skailer.

8. Personal Data Breaches

8.1 Skailer will notify Controller without undue delay and, in any case, within 72 hours from the moment of becoming aware of any Personal Data breach, provide reasonable cooperation, and take remediation actions described in Annex II.

8.2 Notification of any personal data breach shall include at least:

• A description of the nature of the security breach (including, where possible, the categories and approximate number of data subjects and data records affected);

• The contact details of a point of contact from which further information on the Personal Data breach can be obtained;

• Its likely consequences and the measures taken or proposed to remedy the security breach, including measures taken to mitigate any adverse effects.

When not all information can be provided at once, the initial notification will provide the information available at that time, and additional information will be provided without undue delay.

9. Subprocessing (Annex III)

9.1 Controller provides general authorization for Skailer to appoint subprocessors listed in Annex III. Skailer will inform the Customer in writing of any additions or substitutions of subprocessors at least thirty (30) days in advance so that the Customer has sufficient time to object to such changes prior to the engagement of the sub-processor(s) in question. Skailer shall provide the Customer with the necessary information to decide whether to exercise the right to object.

9.2 When Skailer engages a sub-processor, it shall do so by means of a contract that imposes on the sub-processor, in substance, the same data protection obligations as those imposed on Skailer in this DPA. Skailer shall ensure that the sub-processor complies with the obligations under this contract and the Data Protection Regulation/s.

9.3 Skailer will provide Customer, at Customer’s request and upon signature of a confidentiality agreement, a copy of the contract with the sub-processor. To the extent necessary to protect trade secrets or other confidential information, Skailer may redact the text before sharing.

9.4 Skailer uses commercially reasonable efforts to ensure subprocessor compliance with this DPA. Controller may reasonably object to new subprocessors; unresolved objections may result in termination of the affected Services, provided that Controller shall pay for all Services rendered up to the date of termination.

9.5 Skailer conducts due diligence on subprocessors and contracts to ensure equivalent data protection standards.

10. International Transfers

10.1 Restricted transfers from the EU/EEA to third countries are governed by the EU Commission’s Standard Contractual Clauses (SCC, Decision 2021/914), Module Two (Controller–Processor), incorporated by reference; SCC take priority in case of conflict.

10.2 Parties will cooperate on additional safeguards or transfer impact assessments as required by law.

10.3 Annexes including Annex I, II, and III form integral appendices to the SCC.

10.4 If the Parties’ compliance with GDPR requirements relating to cross-border transfers of Personal Data is affected by circumstances outside of the Parties’ control, including if the SCC or any other legal instrument is invalidated, amended or replaced, then the Parties will work together in good faith to reasonably resolve such non-compliance.

10.5 When Skailer uses a sub-processor involving an international transfer of data, Skailer and the sub-processor can guarantee compliance with Chapter V of the GDPR. Skailer shall provide the Customer with sufficient information to demonstrate that such assurances are in effect, subject to the signing of a confidentiality agreement if necessary.

11. Data Return and Deletion

11.1 At the Customer’s option, upon termination of Services, Skailer will delete or return all Personal Data unless otherwise required by law.

11.2 Data as well as all its copies will be deleted or returned within thirty (30) days, and any retained data will be secured and isolated.

12. AI Features

12.1 Personal data provided by Controller is not used to train or fine-tune any AI models for Skailer or third parties.

12.2 Any AI features are only performed as instructed by Controller and subprocessors engaged for AI comply with this DPA.

13. Audit

13.1 The Processor agrees that the Controller may take reasonable and appropriate steps to ensure that the Processor uses the Controller’s Personal Data in a manner consistent with the Controller’s obligations under Data Protection Regulation/s.

13.2 The Parties shall be able to demonstrate compliance with Data Protection Regulation/s:

13.2.1 The Processor shall deal promptly and adequately with inquiries from the Controller about the processing of Customer’s Personal Data.

13.2.2 The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and Data Protection Regulation/s.

13.2.3 The Processor will permit the Controller (or a mutually agreed independent third-party auditor bound by confidentiality) to audit, no more than once per calendar year, the Processor’s compliance with its obligations under this DPA, during the Processor’s regular business hours, on at least thirty (30) days’ prior written notice (email is sufficient). Audits shall be limited to those records, data and inspections strictly necessary to verify compliance with this DPA. The Controller shall use commercially reasonable efforts to minimize disruption to the Processor’s operations during any audit.

13.2.4 In the event that the Controller reasonably believes a Personal Data Breach has occurred, the minimum notice period shall be reduced to five (5) business days, rather than waived entirely.

13.2.5 All costs and expenses incurred in connection with any audit shall be borne by the Controller. All information requested pursuant to Clauses 13.2.1–13.2.2 shall be provided to the Controller free of charge.

13.2.6 As an alternative to on-site audits, the Processor may, at its option, provide the Controller with: (a) a summary of the results of its most recent independent security audit or penetration test; or (b) a completed industry-standard security questionnaire (e.g., SIG, CAIQ). The Controller shall accept such documentation in lieu of an on-site audit unless the Controller can reasonably demonstrate that the documentation is insufficient to verify compliance.

14. Liability

14.1 In the processing of personal data on behalf of the Customer, Skailer undertakes to comply with the Data Protection Regulation/s and the obligations set forth in Article 28 of the GDPR.

14.2 Skailer’s liability under the DPA is limited to its processor obligations, except as prohibited by mandatory law or SCC. Skailer is not liable for Controller’s legal basis, data collection methods, or instructions.

14.3 Skailer shall use commercially reasonable efforts to ensure that its subprocessors comply with their data protection obligations. Skailer’s liability for acts or omissions of subprocessors shall be limited to the extent that Skailer failed to exercise commercially reasonable due diligence in selecting or supervising the subprocessor, or failed to impose adequate contractual obligations.

14.4 The Controller indemnifies Skailer against any claims, damages, liabilities, costs, and expenses (including reasonable legal fees) arising out of or in connection with Controller’s instructions, Controller’s breach of data protection laws, or Controller’s failure to obtain necessary consents or legal bases for processing, including regulatory fines, data subject claims and related costs arising from Personal Data entered by the Controller or its Users, the Controller’s choice of purposes, lawful bases or Article 9 conditions, or decisions taken by the Controller using the Platform.

14.5 The Processor shall be liable to the Controller for direct damages culpably caused by a material breach of its data protection obligations under this DPA. The Processor’s aggregate liability under this DPA shall not exceed two (2) times the annual fees paid or payable by the Controller to the Processor under the Agreement in the twelve (12) months preceding the event giving rise to the claim.

14.6 Neither Party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, revenue, data, or business opportunities, regardless of the cause of action or theory of liability.

14.7 A Controller or Processor shall be exempt from liability under Article 82 of the GDPR if it proves that it is not in any way responsible for the event giving rise to the damage.

14.8 The limitations set forth in this Section 14 shall apply to the fullest extent permitted by applicable law, including under the SCC, and shall constitute the complete allocation of liability between the Parties with respect to data protection matters under this DPA.

15. Governing Law

15.1 This DPA is governed by the law of Cyprus.

16. Changes and Updates

16.1 Skailer may update the DPA solely as required to comply with changes in applicable EU/EEA data protection law, giving 30 days’ written notice. Such updates shall not materially diminish the Controller’s rights under this DPA.

16.2 The term of this DPA shall be the same as the term of the Agreement. Until the data is deleted or returned, the Processor shall continue to ensure compliance with this DPA.

Annex I — Details of Processing

Categories of data subjects:

• A) Jobseekers, References, Sourced Candidates, Referrals, Users of Platform

• B) Employees

Categories of Personal Data:

• Special categories of personal data are processed only if entered by the Controller, in accordance with Section 4.2.

• Automated analysis features are used only as enabled by the Controller, in accordance with Section 4.4.

• Candidate data retention periods and deletion timelines are determined solely by Controller.

• Skailer retains candidate data until Controller instructs deletion via system settings or direct request.

Annex II — Technical and Organizational Security Measures

• Confidentiality agreements for all staff, regular mandatory data protection training.

• Access controls: unique user logins, strong passwords, multi-factor authentication, session timeout policies.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256, AWS KMS).

• Audit logging, threat detection, vulnerability scanning and alerting.

• Daily backups with tested restoration procedures, firewalls, patch management, system change controls.

• Tenant environment segregation to prevent data mixing.

• Annual independent security assessment (SOC 2 Type II audit; application security assessment), summaries available on request.

• Subprocessor due diligence and contractual alignment with this DPA including security controls.

Annex III — Approved Subprocessors

Skailer gives thirty (30) days’ notice before adding or replacing subprocessors.

Signature

Processor: DABL Technology Ltd., Spyros Araouzos, 165, LORDOS WATERFRONT, Floor 4, office 401, 3036, Limassol, Cyprus · VAT CY 60092602N · support@skailer.com

This DPA applies to the Customer from the effective date of the Agreement. A countersigned copy is available on request at support@skailer.com.