Data Processing and Data Sharing Agreement

“GDPR” means Regulation (EU) 2016/679. “Applicable Data Protection Law” means the GDPR together with applicable national implementing or supplementary legislation, including Greek Law 4624/2019, and, where relevant, the data protection law of the Business's location, including South Africa's Protection of Personal Information Act 4 of 2013 (“POPIA”).

“Platform” means the Talent-On-Board website and related services. “Candidate Data” means personal data relating to candidates who create a Platform profile, including name, contact details, location, CV/profile information, work history, skills, education, application information, VideoCV content and personal data generated by the Platform, such as matching scores, recommendations, interaction history and inferred recruitment preferences.

“Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” have the meanings given in the GDPR and, where applicable, the equivalent POPIA terms.

Talent-On-Board and the Business independently determine the purposes and means of the Candidate Data processing for which each is responsible. They act as independent and separate Controllers, not joint Controllers and not as each other's general Processor.

(a) Talent-On-Board acts as independent Controller when it collects Candidate Data at registration, hosts candidate VideoCVs, operates candidate profiles and uses AI-assisted matching to surface relevant opportunities or candidates. AI matching is a recommendation tool; it does not make the Business's final interview, rejection or hiring decision.

(b) The Business acts as independent Controller when it receives or accesses a candidate match and processes that Candidate Data for its own recruitment and hiring decisions.

(c) No service performed solely on the Business's documented instructions is included in this version. If the Parties later agree such a service, they must first document its subject matter, purpose, duration and instructions in a written schedule. Sections that refer to Processor obligations apply only to that separately documented scope.

(d) If the Business uses candidate video excerpts in employer-branding or marketing material under the candidate's separate opt-in consent, the Business acts as independent Controller for that use and is responsible for its own data-protection, advertising and consumer-protection compliance.

There is no active Processor-only scope under this version. If a later written schedule appoints Talent-On-Board to process Candidate Data solely on the Business's instructions, that schedule must identify the subject matter, duration, nature, purpose, data subjects, personal-data categories and documented instructions required by Article 28(3) GDPR.

Until such a schedule is executed, the independent-Controller roles in Section 2 govern the Parties' ordinary Platform activity.

Data subjects are candidates who register a profile and are matched or made searchable to the Business for recruitment purposes.

Candidates retain their data-protection rights. Neither Platform-generated data nor a subscription turns Candidate Data into property of Talent-On-Board or the Business. The Business receives limited access to relevant profiles under the candidate's applicable visibility settings and the Platform's access rules, not ownership of or unrestricted access to the candidate database.

Candidate Data can include name, contact details, location, CV/profile details, work history, skills, education, VideoCV image and voice, application status, and Platform communications with the Business.

Talent-On-Board does not knowingly use facial recognition or biometric identification in its ordinary matching functionality. If that changes, a new agreement and appropriate special-category safeguards must be implemented before such processing starts.

If a written Processor schedule is agreed under Section 3, Talent-On-Board shall:

1. process Candidate Data only on documented and lawful instructions;
2. ensure authorised persons are bound by confidentiality;
3. implement measures appropriate to the risk under Article 32 GDPR;
4. apply the conditions in Section 7 when engaging another Processor;
5. reasonably assist with data-subject rights and Articles 32–36 GDPR obligations;
6. at the Business's choice, delete or return Processor-scope data after that service ends, unless applicable law requires retention;
7. make information needed to demonstrate compliance available and contribute to reasonable, confidential audits on advance notice; and
8. inform the Business if an instruction appears to infringe Applicable Data Protection Law.

The Business shall:

1. maintain a valid legal basis and give candidates all notices required for its processing;
2. use Candidate Data only for the disclosed recruitment purpose and any separately consented branding use;
3. access only profiles made available under applicable candidate visibility and Platform rules, and not attempt to circumvent those controls;
4. not reproduce, distribute, scrape, sell, re-sell, re-share or export Candidate Data except through authorised Platform features;
5. apply appropriate access restrictions, retention limits and security measures;
6. honour applicable access, correction, deletion, restriction, portability and objection rights; and
7. promptly notify Talent-On-Board of a relevant data-subject request, complaint, regulatory inquiry or security incident involving Candidate Data obtained through the Platform.

Talent-On-Board uses service providers for Platform hosting, database services, video/file storage, email delivery, payments, consent-based analytics and AI-enabled functionality. The current list and purpose of each provider is published at /legal/sub-processors.

Where a provider acts as a sub-processor for a separately agreed Processor scope, the Business gives general written authorisation to use providers on that list. Talent-On-Board will give at least 14 days' notice of an intended addition or replacement, allowing reasonable data-protection objections.

If Candidate Data is transferred outside the European Economic Area, the responsible Party must use a lawful Chapter V GDPR transfer mechanism, such as an adequacy decision, the European Commission Standard Contractual Clauses, or another valid safeguard.

Cyprus, Romania and Belgium are within the EEA. South Africa is outside the EEA and is not treated by this Agreement as having an EU adequacy decision.

Each Party shall maintain technical and organisational measures appropriate to the risk, including encrypted transport, authenticated access, role-based restrictions, confidentiality duties, secure provider configurations, access review and an incident-response process.

The Business must restrict Candidate Data to personnel who need it for the relevant recruitment project and must prevent unauthorised downloading, copying and onward disclosure of VideoCVs.

Where Talent-On-Board acts within a separately agreed Processor scope, it shall notify the Business without undue delay and, in any event, within 48 hours after becoming aware of a Personal Data Breach affecting that scope, and provide information reasonably needed for the Business's Articles 33 and 34 GDPR obligations.

As independent Controllers, each Party remains responsible for investigating and notifying breaches within its own control and shall cooperate when the same incident affects both Parties.

Each Party is responsible for requests relating to processing for which it is Controller. Talent-On-Board shall reasonably assist when a request concerns Candidate Data held through the Platform, subject to identity verification and Applicable Data Protection Law.

Rights can include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and safeguards relating to automated decision-making. Requests may be sent to info@pro-universe.gr.

This Agreement remains effective while the Business account is active. Candidate Data made available for a recruitment project must not be retained by the Business beyond the end of that project unless the Business has a separate lawful basis and has provided the required notice.

On termination or the end of an agreed Processor-scope service, Talent-On-Board shall, within 30 calendar days and at the Business's election, delete or return the Candidate Data in that scope, except where applicable law requires retention. Legally retained data must be isolated from further ordinary processing.

Each Party is responsible for damage caused by processing where it has failed to comply with obligations directed to it under Applicable Data Protection Law. For any Processor scope, Article 82 GDPR applies where a Processor acts outside or contrary to lawful instructions.

This Agreement is governed by the laws of the Hellenic Republic (Greece). The courts of Athens, Greece have exclusive jurisdiction over disputes arising from this Agreement, without prejudice to mandatory data-subject rights to complain to their competent supervisory authority.

By actively checking “I accept the Data Processing and Data Sharing Agreement” during onboarding, the accepting individual confirms that they are authorised to bind the Business to this Agreement.

Talent-On-Board records the accepting account's name and email, actual acceptance timestamp, IP address, browser/user-agent context, session reference and document version as evidence of execution. The checkbox is not preselected.