Data Processing Agreement

Last updated: June 4, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and DataToday NV ("Processor"), operator of the AskBob platform, and governs the processing of personal data on the Controller's behalf under Article 28 GDPR.

1. Roles

For candidate and recruitment data uploaded or generated within the Service, the customer is the Controller and DataToday NV is the Processor. For the customer's own account data, DataToday NV is the Controller (see the Privacy Policy).

2. Subject Matter and Duration

The Processor processes personal data only to provide the Service for the duration of the subscription and any data-export/retention window described in the Terms.

3. Nature and Purpose of Processing

CV/resume parsing, AI-based matching and ranking, candidate and pipeline management, communications, and related recruitment workflows.

4. Categories of Data and Data Subjects

• Data subjects: candidates, the Controller's users and clients.
• Data: identification and contact details, CV content (skills, experience, education), qualifications, AI embeddings, match results, and usage metadata.

5. Processor Obligations

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (Art. 32).
• Assist the Controller with data-subject requests and with Articles 32–36.
• Notify the Controller without undue delay of any personal data breach.
• Delete or return personal data at the end of the engagement.
• Make available information necessary to demonstrate compliance and allow audits.

6. Sub-processors

The Controller authorizes the use of the sub-processors listed in the Privacy Policy (Google Cloud, OpenAI, Mistral AI, ConvertAPI, and an SMTP email relay). The Processor will inform the Controller of intended changes and impose equivalent data-protection obligations on each sub-processor.

7. International Transfers

Data is hosted in the European Union. Where a sub-processor processes data outside the EU/EEA, transfers are protected by Standard Contractual Clauses or an adequacy decision.

8. Security

Encryption in transit (TLS 1.2+) and at rest, role-based access controls, multi-tenant isolation, audit logging, and backup/disaster recovery.

9. Contact

DataToday NV — Veldkant 33 A, 2550 Kontich, Belgium — Enterprise / VAT BE 0669.633.758.
Data protection: dpo@askbob.be · Legal: legal@askbob.be