This is the data processing agreement ("DPA") that Sections 1, 10, 12.2 and 15 of the TAP Careers Terms of Service refer to. It has two parts. Part A (Sections 3 to 11) governs TAP's processing of personal data as an Employer's processor under Article 28 of the GDPR. Part B (Section 12) governs TAP's sharing of Job Seeker data with Employers, each acting as an independent controller, so that Employers can consider Job Seekers for their Opportunities, as Section 8.2 of the TAP Careers Privacy Notice describes. Part B is the Employer C2C Data Processing Addendum referred to in Section 12.2 of the Terms. Sections 1, 2 and 13 apply to both Parts. It is published online and accepted by Employers during account creation; no signature is needed.
[tapcareers.io/legal/dpa]
This DPA is an agreement betweenTalent Acceleration Platform (TAP) B.V., registered with the Netherlands Chamber of Commerce (KVK) under number 87362449, with its registered office at Singel 542, 1017 AZ Amsterdam, the Netherlands ("TAP" or "Processor"), and the company or other organization that accepts it as an Employer (the "Employer" or "Controller"). The Employer's legal name, registration details and contacts are those it provides in its TAP Careers employer account or Order Form.
Roles.In Part A, TAP acts as processor and the Employer as controller. In Part B, TAP and the Employer each act as an independent controller. References to TAP as "Processor" and to the Employer as "Controller" apply only to Part A.
Background.The Employer uses the TAP Careers platform under the TAP Careers Terms of Service (the "Terms"). In providing those services, TAP processes certain personal data on the Employer's behalf. Section 1 of the Terms states that such processing is governed by a DPA between TAP and the Employer, which is incorporated into the Terms by reference. This document is that DPA. TAP also shares Job Seeker data with the Employer, as an independent controller, when it introduces a Job Seeker to the Employer or a Job Seeker applies to the Employer's Opportunity. Part B sets the terms for that sharing, which the Terms and the Privacy Notice also describe.
Order of Precedence.As Section 1 of the Terms provides, this DPA prevails over the Terms and the Order Form for all matters relating to the processing of personal data on the Employer's behalf (Part A). For all other matters, the Order Form and the Terms apply. Part B supplements Sections 5.3 and 12.2 of the Terms and is read consistently with them. Where Standard Contractual Clauses apply under Section 7.2 or Section 12.11, they prevail over this DPA.
Acceptance.The Employer accepts this DPA by ticking the acceptance box (or using an equivalent control) when creating a TAP Careers employer account, or by accepting an Order Form that references it. No signature is required. The person accepting confirms that they are authorized to bind the Employer, as Section 3 of the Terms provides. The Parties agree that this electronic acceptance satisfies the requirement in Article 28(9) GDPR that the contract be in writing, including in electronic form. The same acceptance binds the Employer to Part B.
Acceptance Record.TAP will keep a record of each acceptance, including the Employer entity, the accepting Employer User, the date and time, and the DPA version accepted. The Employer can request a copy from privacy@tapcareers.io.
Effective Date.This DPA takes effect on acceptance. Part A continues for as long as TAP processes Employer Personal Data, and has no practical effect until the Employer uploads, or asks TAP to manage, personal data. Part B applies from the first time TAP shares Job Seeker data with the Employer and continues for as long as the Employer holds Shared Job Seeker Data.
Capitalized terms not defined here have the meaning given in the Terms (Section 2), including Employer, Employer User, Job Seeker, Opportunity, Order Form, Content and GDPR. "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR. In this DPA:
- Data Protection Law:the GDPR, the Dutch GDPR Implementation Act (UAVG), and any other data protection law that applies to the processing under this DPA, including the UK GDPR where applicable.
- Employer Personal Data:personal data that TAP processes on the Employer's behalf in providing the Services, as described in Annex A.
- Services:the job search, talent sourcing and related recruitment services TAP provides to the Employer under the Terms and any Order Form.
- Sub-processor:any third party TAP engages to process Employer Personal Data.
- Standard Contractual Clauses (SCCs):the clauses approved by European Commission Implementing Decision (EU) 2021/914, and, for UK transfers, the UK International Data Transfer Addendum.
- Restricted Transfer:a transfer of Employer Personal Data to a country outside the European Economic Area that has no adequacy decision under Article 45 GDPR.
- Instructions:the Employer's documented instructions for processing, as set out in Section 3.
- Privacy Notice:TAP's privacy notice published at tapcareers.io/privacy-notice, as updated from time to time.
- Recruitment Purpose:has the meaning given in Section 12.3.
- Shared Job Seeker Data:personal data about a Job Seeker that TAP discloses to the Employer as a controller under Part B, as described in Annex D, including any copies the Employer makes of it.
As Section 12.2 of the Terms provides, where TAP processes personal data on the Employer's behalf as part of the Services (for example, candidate data the Employer uploads or asks TAP to manage), the Employer is the controller and TAP is its processor. Sections 3 to 11 (Part A) apply only to that processing.
Part A does not apply where TAP or the Employer acts as an independent controller. Part B governs Job Seeker data that TAP shares with the Employer, and the hire information the Employer gives TAP. The Parties' roles are:
Employer Personal Data (Annex A)
Job Seeker, Visitor, Mentor and Coach data on the platform
Terms Section 12.1; TAP Privacy Notice
Job Seeker data shared with the Employer (e.g. on application)
Part B (Section 12); Terms Sections 5.3, 12.1 and 12.2; Privacy Notice Section 8.2; Employer's candidate privacy notice
Hire information the Employer gives TAP
Independent controller (recipient)
Section 12.10; Order Form Part 4.2; Privacy Notice Section 8.2
Employer User account data
Terms Section 12.2; TAP Privacy Notice
The Parties do not act as joint controllers under Article 26 GDPR for any processing in connection with the Services.
The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex A.
2.4
Employer's Responsibilities
The Employer is responsible, as Section 12.2 of the Terms provides, for having a lawful basis for Employer Personal Data and for giving data subjects any required information. The Employer will not instruct TAP to process special category data or criminal-record data unless Data Protection Law allows it and the Employer has told TAP in writing in advance.
3.
Instructions and Processing Obligations
3.1
Documented Instructions
TAP will process Employer Personal Data only on the Employer's documented Instructions, unless Union or Member State law requires otherwise; in that case TAP will tell the Employer before processing, unless that law prohibits it. The Employer's Instructions are: (a) this DPA and Annex A; (b) the Order Form and the Terms; (c) the Employer's configuration and use of the Service's features; and (d) other reasonable written instructions consistent with these.
TAP will inform the Employer promptly if, in its opinion, an Instruction infringes Data Protection Law. TAP may suspend that processing until the Employer confirms or changes the Instruction.
TAP will not use Employer Personal Data for its own purposes, including to market to data subjects, to sell or share it with other employers, or to add it to TAP's own Job Seeker database, unless the data subject independently creates a TAP account under the Terms.
[Decide:] TAP will not use Employer Personal Data to train or improve general AI or matching models, except in aggregated and anonymized form that no longer constitutes personal data. [Alternative: allow with the Employer's opt-in.]
4.
Confidentiality of Personnel
TAP will ensure that everyone it authorizes to process Employer Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only to the extent needed to provide the Services. TAP will train such personnel on data protection appropriate to their role.
Taking into account the state of the art, costs, and the nature, scope, context and purposes of the processing and the risks to data subjects, TAP will implement and maintain the technical and organizational measures in Annex B.
TAP may update Annex B from time to time, provided the updated measures do not reduce the overall level of protection of Employer Personal Data.
The Employer is responsible for the security of its own systems and accounts, including keeping Employer User login details secure as Section 3 of the Terms requires, and for the security of Employer Personal Data once exported from the Service.
The Employer gives TAP general written authorization to engage Sub-processors. The Sub-processors approved at the date of this DPA are listed in Annex C, which is the sub-processor list referred to in Section 10 of the Terms. TAP will keep the current list available at [URL].
TAP will notify the Employer of any intended addition or replacement of a Sub-processor by updating the current Sub-Processor List at [URL]. The Employer may object on reasonable data protection grounds in writing within thirty (30) days. If the Parties cannot resolve the objection in good faith within thirty (30) days, the Employer may terminate the affected part of the Services and receive a pro-rata refund of prepaid Fees (as defined in the Order Form) for the unused period, as its sole remedy.
TAP will impose on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection as this DPA. TAP remains fully liable to the Employer for each Sub-processor's performance of those obligations.
Where TAP must replace a Sub-processor urgently for security or continuity reasons, it may do so with shorter notice, and will notify the Employer as soon as reasonably possible; Section 6.2's objection right still applies.
7.
International Transfers
TAP and its Sub-processors will make a Restricted Transfer only where a valid transfer mechanism under Chapter V GDPR applies, such as an adequacy decision (including the EU–US Data Privacy Framework for certified recipients), or the SCCs, supported where needed by a transfer impact assessment and supplementary measures.
7.2
SCCs between the Parties
If the Employer is established outside the EEA and receives Employer Personal Data from TAP, the Parties agree that Module 4 (processor to controller) of the SCCs applies and is incorporated by reference, with: Clause 7 (docking clause) included; Clause 17 governed by Dutch law; Clause 18 courts of Amsterdam; and Annexes I and II completed by Annexes A and B of this DPA. [Confirm the UK Addendum where UK employers are in scope.]
Taking into account the nature of the processing, TAP will assist the Employer by appropriate technical and organizational measures to respond to data subjects exercising their rights under Chapter III GDPR. If TAP receives a request relating to Employer Personal Data, it will forward it to the Employer without undue delay and will not respond directly, except to confirm the request was received and passed on, unless the Employer authorizes it.
8.2
Requests about TAP's Data
Requests about data TAP holds as controller under Section 12.1 of the Terms (for example, a Job Seeker's TAP profile) are handled by TAP under its Privacy Notice and are outside this DPA.
8.3
DPIAs and Consultation
TAP will provide reasonable information and assistance for the Employer's data protection impact assessments and any prior consultation with a supervisory authority under Articles 35 and 36 GDPR, where these relate to TAP's processing.
8.4
AI and Automated Tools
Consistent with Sections 5.3 and 6 of the Terms, TAP's matching, ranking and AI tools produce recommendations to support human judgment and do not make hiring decisions. On request, TAP will give the Employer reasonable information about how those tools work, the main factors they use, and their known limitations, so the Employer can meet its own transparency and Article 22 GDPR obligations.
Assistance beyond what the Service's self-service features provide may be charged at TAP's reasonable rates, unless it is needed because of TAP's breach of this DPA.
TAP will notify the Employer without undue delay, and in any case within seventy-two (72) hours, after becoming aware of a personal data breach affecting Employer Personal Data.
The notification will describe, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact point for more information. TAP may provide information in phases as it becomes available.
TAP will take reasonable steps to contain, investigate and mitigate the breach, and will cooperate with the Employer so it can meet its obligations under Articles 33 and 34 GDPR. The Employer decides whether to notify supervisory authorities and data subjects; TAP will not do so on the Employer's behalf without its consent, unless the law requires it.
TAP's notification of a breach is not an admission of fault or liability.
10.
Audits and Information
TAP will make available to the Employer all information reasonably necessary to demonstrate compliance with Article 28 GDPR, including, where available, current third-party certifications or audit reports [e.g. ISO 27001 or SOC 2; confirm], under appropriate confidentiality.
If that information is not sufficient, or a supervisory authority requires it, the Employer may audit TAP's compliance with this DPA, itself or through an independent auditor bound by confidentiality who is not a TAP competitor. Audits require at least thirty (30) days' written notice, take place during business hours, are limited to once in any 12-month period (except after a personal data breach or at a regulator's request), and must not unreasonably disrupt TAP's business or compromise other customers' data.
Each Party bears its own audit costs, unless the audit reveals a material breach of this DPA by TAP, in which case TAP bears the reasonable costs of the audit.
The Employer can delete or export Employer Personal Data through the Service at any time, and TAP will delete data within thirty (30) days after the Employer deletes it in the Service.
As Section 15 of the Terms provides, when the Order Form ends or the Employer's account is closed, TAP will handle Employer Personal Data under this DPA. TAP will delete Employer Personal Data within thirty (30) days after that date.
TAP may keep Employer Personal Data where Union or Member State law requires, only for as long as required and only for that purpose.
On request, TAP will confirm deletion in writing.
12.
Part B: Sharing of Job Seeker Data (Controller to Controller)
TAP collects and holds Job Seeker data as an independent controller, as Section 12.1 of the Terms and the Privacy Notice describe. When TAP shares Job Seeker data with the Employer under this Section 12, TAP and the Employer each act as an independent controller of their own processing. Neither Party is the other's processor for Shared Job Seeker Data, and Sections 3 to 11 do not apply to it. Where the Employer adds its own notes, ratings or interview records about a Job Seeker in the Service, TAP processes those records on the Employer's behalf under Part A.
TAP will share Shared Job Seeker Data only: (a) when it introduces a Job Seeker to the Employer for an Opportunity, after asking the Job Seeker as Section 8.2 of the Privacy Notice describes; or (b) when a Job Seeker applies to the Employer's Opportunity through the Service. TAP will:
- tell Job Seekers in the Privacy Notice that it shares their data with employers, what it shares and why;
- have its own legal basis for the disclosure [contract, where introductions are part of the service the Job Seeker signed up for (Art. 6(1)(b) GDPR), with TAP asking before each share; confirm against Privacy Notice Section 6];
- share only the categories in Annex D that are relevant to the Opportunity;
- ensure that a member of the TAP team has reviewed any AI screening result before it is shared, as Section 7 of the Privacy Notice describes; and
- not share the categories that Annex D lists as not shared, including special category data, criminal-record data, payment data, AI career coach conversations and coffee chat summaries.
The Employer will process Shared Job Seeker Data only to: (a) assess the Job Seeker for the Opportunity they were introduced for or applied to; (b) communicate with the Job Seeker about that recruitment process, including interviews and offers; (c) report a Hire to TAP under Section 12.10 and Part 4.2 of the Order Form; and (d) comply with law and establish, exercise or defend legal claims (together, the "Recruitment Purpose").
The Employer will not:
- sell, rent or license Shared Job Seeker Data;
- disclose it to any third party, other than its own processors and Affiliates that need it for the Recruitment Purpose or, for a recruiter or agency, the client employer it has named to TAP under the Order Form;
- use it for marketing, or contact the Job Seeker about anything other than the Recruitment Purpose;
- add it to a talent database or recruitment CRM outside the Service for future use without the Job Seeker's agreement;
- combine it with data from other sources to profile the Job Seeker beyond what the role reasonably requires;
- use it to train or improve AI models; or
- make a decision about the Job Seeker based solely on automated processing, including TAP's matching scores, AI summaries or screening results.
12.5
Employer's Controller Obligations
For its own processing of Shared Job Seeker Data, the Employer will:
- have its own legal basis under Article 6 GDPR;
- give the Job Seeker the information required by Article 14 GDPR, through its candidate privacy notice, within a reasonable period and at the latest at its first communication with the Job Seeker;
- limit access to Employer Users and other personnel involved in the recruitment;
- implement appropriate technical and organisational security measures under Article 32 GDPR;
- engage processors only under a written contract that meets Article 28 GDPR; and
- keep records of its processing as Article 30 GDPR requires.
12.6
Retention and Deletion
The Employer will keep Shared Job Seeker Data only for as long as needed for the Recruitment Purpose. For a Job Seeker who is not hired, the Employer will delete it within six (6) months after the end of the recruitment process, unless the Job Seeker has agreed to a longer period or the law requires the Employer to keep it. For a Job Seeker who is hired, the Employer's own employee-records policies apply from the start of employment.
12.7
Accuracy, AI Content and Assessments
Shared Job Seeker Data comes from information the Job Seeker gave TAP, their public LinkedIn profile, and content TAP generates, such as AI profile summaries and screening scores (Privacy Notice Sections 3 to 5). TAP does not verify a Job Seeker's identity, qualifications, references or right to work, and its AI content and scores support human judgment only. The Employer will make its own assessment and will tell TAP if it learns that Shared Job Seeker Data is materially inaccurate. TAP will tell the Employer without undue delay if it rectifies, erases or restricts Job Seeker data it has shared, and the Employer will then update, restrict or delete its copy as its own obligations require.
12.8
Data Subject Requests and Withdrawal
Each Party is responsible for answering data subject requests and complaints about its own processing. If a Party receives a request or complaint that concerns the other's processing, it will forward it to the other Party within five (5) business days and tell the Job Seeker where to direct it. If a Job Seeker withdraws from the Employer's recruitment process, or tells TAP they no longer want their profile shared with the Employer, TAP will tell the Employer. The Employer will then stop considering the Job Seeker and delete their Shared Job Seeker Data without undue delay, unless it must keep it to comply with law or for legal claims.
12.9
Security and Breaches
The Employer will notify TAP at privacy@tapcareers.io without undue delay, and in any case within seventy-two (72) hours, after becoming aware of a personal data breach affecting Shared Job Seeker Data. Each Party is responsible for its own notifications to supervisory authorities and Job Seekers under Articles 33 and 34 GDPR, and the Parties will cooperate reasonably on breaches that affect both of them.
12.10
Hire Information Shared with TAP
When the Employer Hires (as defined in the Order Form) a Job Seeker, it will give TAP the information that Part 4.2 of the Order Form requires, such as the start date and, where Fees depend on it, compensation, so that TAP can record the placement and invoice any fee, as Section 8.2 of the Privacy Notice describes. TAP receives that information as an independent controller. The Employer will tell Job Seekers, through its candidate privacy notice, that it shares hiring outcomes with TAP.
12.11
International Transfers
Where the Employer is established in a country outside the EEA that has no adequacy decision under Article 45 GDPR, the Parties agree that Module 1 (controller to controller) of the SCCs applies to the transfer of Shared Job Seeker Data and is incorporated by reference, with TAP as data exporter and the Employer as data importer, and with: Clause 7 (docking clause) included; the option in Clause 11(a) not used; the Autoriteit Persoonsgegevens as competent supervisory authority under Clause 13; Clause 17 governed by Dutch law; Clause 18 the courts of Amsterdam; Annex I completed by Annex D; and Annex II completed by Section 12.5 and the Employer's own security measures. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum also applies [confirm]. This replaces reliance on the derogations in Article 49 GDPR for routine disclosures to Employers. The Employer may make onward transfers only as Clause 8.7 of Module 1 allows.
If TAP reasonably believes the Employer is processing Shared Job Seeker Data in breach of this Section 12, TAP may stop sharing Job Seeker data with the Employer and, after written notice, require the Employer to delete Shared Job Seeker Data and confirm deletion in writing. These rights are in addition to TAP's rights under the Order Form and the Terms. The Employer's indemnity in Section 14 of the Terms covers its breach of this Section 12.
13.
Liability, Term and General Provisions
Each Party's liability under or in connection with this DPA is subject to the limitations and exclusions in the Order Form and, where it contains none, in Section 14 of the Terms. Nothing in this DPA limits either Party's liability to data subjects under Article 82 GDPR, or liability that cannot be limited by law. Section 14 of the Terms also sets out the Employer's indemnity to TAP.
This DPA remains in effect for as long as TAP processes Employer Personal Data or the Employer holds Shared Job Seeker Data. It survives termination of the Order Form until all Employer Personal Data has been deleted under Section 11 and all Shared Job Seeker Data has been deleted under Section 12.6.
TAP may update this DPA by publishing a new version online. The new version applies from its stated effective date. An update will not reduce the protection of Employer Personal Data or TAP's obligations under Article 28 GDPR, except where needed to comply with Data Protection Law or the guidance of a supervisory authority. TAP may update Annexes B and C as Sections 5.2 and 6 allow. As Section 16 of the Terms provides, changes to the Terms alone do not amend this DPA.
13.4
Governing Law and Jurisdiction
Consistent with Section 17 of the Terms, this DPA is governed by the laws of the Netherlands, and disputes are subject to the exclusive jurisdiction of the competent courts of Amsterdam, except where the SCCs require otherwise.
If any provision of this DPA is invalid, the rest remains in effect, and the invalid provision will be replaced with a valid one that comes closest to its purpose.
Data protection questions and notices to TAP under this DPA go to privacy@tapcareers.io. TAP sends notices to the Employer by email to the privacy or security contact in its account settings or Order Form, or, if none is given, to its account administrator. The Employer must keep these contacts current.
Annex A: Description of Processing
TAP's provision of job search and talent sourcing Services to the Employer under the Terms and the Order Form.
The term of the Order Form, plus the return and deletion period in Section 11.
Collection, storage, organization, structuring, matching and ranking, retrieval, consultation, transmission to/from Employer Users, and deletion.
Matching and shortlisting candidates against the Employer Opportunities it supplies.
Employer's employees or agents (Employer Users)
Name, contact details, interview notes and assessment results entered by the Employer, messages.
None intended. Only with the Employer's prior written notice under Section 2.4.
Continuous during the term.
As set by the Employer in the Service, and no longer than the term plus the Section 11 periods.
Annex B: Technical and Organisational Measures
[TAP to confirm each measure against its actual controls.]
Role-based access; least privilege; unique accounts per Employer User (Terms Section 3); MFA for TAP staff and [option for Employer Users]; prompt revocation of leavers.
TLS 1.2+ in transit; AES-256 or equivalent at rest.
Logical separation of each Employer's data; Employer data not visible to other Employers.
Logging of administrative access and key events; alerting on suspicious activity; log retention [x] months.
Regular encrypted backups; tested restore procedures; redundant hosting in the locations listed in Annex C.
Code review, dependency scanning, separate test environments without production personal data, periodic penetration testing [frequency].
Security and privacy due diligence on Sub-processors; written Article 28 terms.
Documented breach response process supporting Section 9 timelines.
Confidentiality undertakings; onboarding and annual privacy and security training.
Human review of AI outputs before decisions (Terms Sections 5.3 and 6); no training of general models on Employer Personal Data (Section 3.4).
Annex C: Approved Sub-processors
All Employer Personal Data
CVs and uploaded documents
EU–US Data Privacy Framework
AI summaries and CV text processing
Anthropic (via Careers AI)
Matching and enrichment signals
Google LLC, Gemini (via Careers AI)
Contact and company enrichment
Hyperdoc, Inc. dba Recall.ai
Calendar sync for interview scheduling
Names, emails, meeting times
Customer relationship management
Candidate and contact details
Twilio, Inc. dba SendGrid
Candidate communications by email
Contact details, messages
Annex D: Description of Shared Job Seeker Data (Part B)
This Annex describes the data TAP shares with the Employer under Part B. It also completes Annex I of SCC Module 1 where Section 12.11 applies. [TAP to confirm each item against what the Service actually shows Employers.]
Talent Acceleration Platform (TAP) B.V., Singel 542, 1017 AZ Amsterdam, the Netherlands; controller; privacy@tapcareers.io.
The Employer, as identified in its TAP Careers account or Order Form; controller; its privacy contact as given in its account.
Job Seekers who apply to the Employer's Opportunities through the Service, or whom TAP introduces to the Employer after asking them.
Identity and contact: name, email, phone number, LinkedIn URL, profile photo. Location and languages: country and city of residence, languages. Career profile: career level, function, skills, industries, experience, education, target roles, current job status, work-type and location preferences, availability. CV. AI-generated profile summaries. Relevant assessment information from TAP's screening: scores for English, technical readiness, setup and readiness to work, availability, motivation and professionalism, and the overall result after human review.
Gender; payment data; goals and self-assessment answers [confirm]; AI career coach conversations; coffee chat and coaching records and summaries; screening interview recordings and transcripts; survey and outcome data; sponsor details; mentor feedback about the Job Seeker [confirm; Privacy Notice Section 8.1].
None. TAP asks Job Seekers not to provide it (Privacy Notice Section 3.7) and does not share it.
The Recruitment Purpose (Section 12.3).
Disclosure by TAP through the Service (profile views, shortlists, applications and downloads), and the Employer's further processing for the Recruitment Purpose.
Each time TAP introduces a Job Seeker or a Job Seeker applies through the Service.
Retention by the Employer
As set out in Section 12.6.
Adequacy decision where available; otherwise SCC Module 1 under Section 12.11.
Competent supervisory authority
Autoriteit Persoonsgegevens (the Netherlands).
