Data Processing Addendum (DPA)
Applies to
Customers who process personal data on the Marty platform.
This Data Processing Addendum (“DPA”) is entered into between TEŽINSKI GRAF d.o.o., Ulica Ljudevita Posavskog 34A, 10000 Zagreb, Croatia, OIB 66900544338, operating the Marty platform (“Processor” or “Marty”), and the legal entity that accepts this DPA electronically or is otherwise bound by it under the MSA (“Customer” or “Controller”). See also the MSA, Terms and Conditions and Privacy Policy.
1 Definitions
1.1 “Candidate” means a natural person who applies for, is considered for, or is sourced for a vacancy of the Controller via the Platform.
1.2 “Controller” means the Customer, i.e. the legal entity that is party to the MSA and determines the purposes and means of Processing Personal Data on the Platform.
1.3 “Data Protection Laws” means the GDPR, the Croatian Act on the Implementation of the General Data Protection Regulation, and any other data protection laws applicable to the Processing under this DPA, including the UK GDPR and Swiss FADP where applicable.
1.4 “Employee” means a natural person employed or engaged by the Controller whose data is held in the HRIS module.
1.5 “GDPR” means Regulation (EU) 2016/679.
1.6 “Instructions” means the Controller’s documented instructions to the Processor regarding Processing, including this DPA, the MSA, and the Controller’s configuration and use of the Platform.
1.7 “Module” means a functional part of the Platform that the Controller may subscribe to or enable, namely ATS, Screening, Sourcing, Notetaker, Assessment, Candidate NPS and HRIS, as described in Annex 1.
1.8 “MSA” means the MSA between the Parties published on the Website or signed by the Parties.
1.9 “Party” means the Controller or the Processor; “Parties” means both.
1.10 “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) that the Processor Processes on behalf of the Controller under the MSA.
1.11 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data Processed by the Processor or its Sub-processors.
1.12 “Platform” means the Marty cloud-based software service, including web and mobile applications, APIs and integrations. It excludes third-party products and content created by the Controller.
1.13 “Process” or “Processing” has the meaning given in Article 4(2) GDPR.
1.14 “SCCs” means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, as amended or replaced.
1.15 “Sub-processor” means any third party, including an affiliate of the Processor, engaged by the Processor to Process Personal Data on behalf of the Controller.
1.16 “TOMs” means the technical and organisational measures described in Annex 2.
1.17 “User” means an individual authorised by the Controller to use the Platform (e.g. recruiters, hiring managers, HR administrators).
Terms not defined here have the meaning given in the GDPR or the MSA.
2 Scope and Precedence
2.1 This DPA applies to all Processing of Personal Data by the Processor on behalf of the Controller in connection with the Platform. It is incorporated into and forms part of the MSA.
2.2 The details of Processing for each Module are set out in Annex 1. An Annex applies only to the Modules the Controller has subscribed to or enabled. Annex 1a (ATS) applies to every Controller.
2.3 If the Processor introduces a new Module or a change that affects the categories of Personal Data or Data Subjects, it will update Annex 1 and notify the Controller before the change takes effect.
2.4 In case of conflict, the following order of precedence applies: (i) the SCCs, where applicable; (ii) this DPA; (iii) the MSA. A DPA signed by both Parties prevails over this click-through version.
3 Term
3.1 This DPA takes effect when the MSA takes effect and remains in force for as long as the Processor Processes Personal Data on behalf of the Controller.
3.2 Obligations that by their nature should survive (in particular Sections 5, 10 and 13) survive termination until all Personal Data has been deleted or returned.
4 Roles and Instructions
4.1 Roles. The Controller is the controller and the Processor is the processor of Personal Data. Each Party will comply with the obligations that Data Protection Laws impose on it.
4.2 Controller’s obligations. The Controller is responsible for:
- having a lawful basis for all Processing it instructs, including for any special categories of data (Article 9 GDPR);
- informing Data Subjects, including Candidates and Employees, as required by Articles 13 and 14 GDPR;
- the accuracy and lawfulness of the Personal Data it uploads or collects through the Platform;
- its decisions regarding Candidates and Employees, including decisions informed by AI outputs (Section 12).
4.3 Processing on Instructions. The Processor will Process Personal Data only on the Controller’s documented Instructions, including with regard to transfers to third countries. The Controller’s Instructions are to Process Personal Data (i) to provide the Platform and the enabled Modules as described in the MSA and Annex 1, (ii) as initiated by Users through the Platform, and (iii) as otherwise agreed in writing.
4.4 Unlawful instructions. The Processor will immediately inform the Controller if, in its opinion, an Instruction infringes Data Protection Laws. The Processor may suspend that Processing until the Controller confirms or modifies the Instruction.
4.5 Processing required by law. If Union or Member State law requires the Processor to Process Personal Data other than on Instructions, the Processor will inform the Controller of that requirement before Processing, unless the law prohibits it.
4.6 Processor’s own purposes. The Processor acts as an independent controller only to the extent strictly necessary for:
- account management, billing and contract administration regarding Users;
- security of the Platform, including fraud prevention, abuse detection and logging;
- compliance with the Processor’s legal obligations.
The Processor may also create aggregated or anonymised statistics from the use of the Platform to improve it, provided that such data no longer identifies any Data Subject or the Controller. The Processor will not use Candidate or Employee Personal Data for its own purposes, sell it, or combine it with data of other customers.
Sourcing Database. The Processor operates a database of professional profiles obtained from licensed data providers, and determines its search, matching and ranking logic, as an independent controller (the “Sourcing Database”), as described in its Privacy Policy. This DPA does not apply to that processing. Once the Controller saves a profile, imports a person, enriches contact details, adds notes or starts outreach, the Controller is the controller of that data and the Processor processes it on the Controller’s behalf under this DPA and Annex 1c.
4.7 Privacy contact. The Controller may contact the Processor regarding data protection at privacy@marty.hr.
5 Security and Confidentiality
5.1 Confidentiality. The Processor ensures that all persons authorised to Process Personal Data are bound by confidentiality obligations, contractual or statutory, that continue after their engagement ends.
5.2 Security measures. The Processor implements and maintains the TOMs in Annex 2, appropriate to the risk as required by Article 32 GDPR. The Processor reviews the TOMs at least annually.
5.3 Updates. The Processor may update the TOMs, provided the overall level of protection is not reduced. Material changes will be published or notified to the Controller.
5.4 Evidence. The Processor maintains an ISO/IEC 27001 certification for the Platform. On written request, the Processor will provide its current certificate, Statement of Applicability (summary) and a summary of the latest audit results. The Processor will inform the Controller if the certification lapses or its scope is materially reduced. Such documents are the Processor’s confidential information.
6 Sub-processors
6.1 General authorisation. The Controller grants the Processor general authorisation to engage Sub-processors. The current list is in Annex 3, split into:
- Core Sub-processors, needed to operate the Platform for all Controllers; and
- Module Sub-processors, engaged only when the Controller enables the relevant Module or feature.
6.2 Sub-processor obligations. The Processor will (i) carry out due diligence on each Sub-processor before engagement, (ii) impose by written contract data protection obligations at least as protective as those in this DPA, and (iii) remain fully liable to the Controller for each Sub-processor’s performance.
6.3 Changes. The Processor will notify the Controller of any intended addition or replacement of a Sub-processor at least 14 days before it begins Processing Personal Data, by email or via the Platform. This applies to Core and Module Sub-processors alike.
6.4 Objection. The Controller may object in writing within the notice period on reasonable data protection grounds. The Parties will discuss the objection in good faith. If no resolution is reached, the Controller may terminate the affected Module or the MSA without penalty, and the Processor will refund prepaid fees for the unused term of the terminated services. Absent an objection, the Sub-processor is deemed approved.
6.5 Emergency replacement. Where a Sub-processor must be replaced urgently for reasons outside the Processor’s control (e.g. cessation of business or a security incident), the Processor may do so immediately and will inform the Controller as soon as practicable. Section 6.4 then applies.
7 Data Subject Rights
7.1 Notification. If the Processor receives a request from a Data Subject relating to Personal Data Processed for the Controller, it will forward it to the Controller without undue delay and will not respond itself unless instructed by the Controller or required by law.
7.2 Self-service tools. The Platform enables the Controller to access, rectify, export, restrict and delete Personal Data, including Candidate profiles, assessment results, recordings and Employee records.
7.3 Assistance. Where the Controller cannot fulfil a request with the self-service tools, the Processor will assist within 5 working days of the Controller’s written request, so that the Controller can respond within the deadlines of Articles 12 to 22 GDPR.
8 Assistance, Impact Assessments and Audits
8.1 DPIAs. Taking into account the nature of Processing and the information available to it, the Processor will assist the Controller with data protection impact assessments and prior consultations with supervisory authorities (Articles 35 and 36 GDPR). The Processor may do so by providing existing documentation, including module descriptions, AI system documentation and security questionnaires.
8.2 Information. The Processor will make available all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, primarily through its ISO/IEC 27001 certificate and audit reports, other documentation, or responses to reasonable questionnaires.
8.3 Audits. Where that information does not reasonably suffice, the Controller may audit the Processing, itself or through an independent auditor bound by confidentiality, subject to the following:
- no more than once every 12 months, except where required by a supervisory authority or following a material Personal Data Breach;
- at least 30 days’ prior written notice, unless a supervisory authority requires a shorter period;
- during normal business hours, for no more than 2 consecutive working days, minimising disruption and respecting the Processor’s security policies and the confidentiality of other customers’ data;
- remote or document-based where possible; physical inspection of Sub-processor data centres is replaced by their third-party audit reports;
- at the Controller’s cost, including the Processor’s reasonable costs, unless the audit reveals a material breach of this DPA by the Processor.
8.4 Changes in law. If a change in Data Protection Laws requires changes to this DPA, the Parties will negotiate in good faith to amend it.
9 Personal Data Breach
9.1 Notification. The Processor will notify the Controller without undue delay, and in any case within 48 hours of becoming aware of a Personal Data Breach.
9.2 Content. To the extent known, the notice will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where information is not yet available, the Processor will provide it in phases without undue delay.
9.3 Mitigation. The Processor will promptly take reasonable steps to contain, investigate and remediate the breach, document its cause, and cooperate with the Controller in notifying supervisory authorities and Data Subjects.
9.4 Notification of a breach is not an acknowledgement of fault or liability.
10 Return and Deletion of Data
10.1 During the term. The Controller may export or delete Personal Data at any time using the Platform’s tools.
10.2 On termination. Upon termination of the MSA, the Controller may, within 30 days, request one complete export of its Personal Data, which the Processor provides free of charge in a machine-readable format. The Processor will then delete all Personal Data, including copies, within a further 60 days, unless Union or Member State law requires storage.
10.3 Backups. Personal Data in backups is isolated from further Processing and overwritten in the regular backup cycle, which does not exceed 90 days.
10.4 Certification. On request, the Processor will confirm deletion in writing by email.
10.5 This Section does not apply to data the Processor Processes as an independent controller under Section 4.6.
11 International Data Transfers
11.1 EEA hosting. The Processor stores and Processes Personal Data primarily within the EEA. The Processor will not transfer Personal Data to a third country except in accordance with Chapter V GDPR and this Section.
11.2 Authorised transfers. The Controller authorises transfers to the Sub-processors listed in Annex 3 that Process outside the EEA. Each such transfer is based on (i) an adequacy decision, including the EU–U.S. Data Privacy Framework where the Sub-processor is certified, or (ii) the SCCs, Module 3 (processor to processor), entered into between the Processor and the Sub-processor, together with a transfer impact assessment and supplementary measures where required.
11.3 UK and Switzerland. Where Personal Data subject to the UK GDPR or the Swiss FADP is transferred, the SCCs apply as adapted by the UK International Data Transfer Addendum or the Swiss FDPIC guidance, respectively.
11.4 Government access. The Processor will (i) challenge any request from a public authority that is not legally binding, (ii) notify the Controller of a legally binding request before disclosure, unless prohibited by law, and (iii) disclose only the minimum data required.
11.5 Controllers outside the EEA. Where the Controller is established in a third country without an adequacy decision and its use of the Platform involves a transfer of Personal Data from the Processor to the Controller, the SCCs, Module 4 (processor to controller), are incorporated by reference, with Annexes 1 and 2 of this DPA completing their annexes. Where the Controller is subject to the UK GDPR or the Swiss FADP, the UK Addendum or the Swiss adaptations apply accordingly.
12 AI Features
12.1 Scope. Some Modules use artificial intelligence, including large language models, to parse, summarise, classify, rank, transcribe or generate content (“AI Features”). AI Features are described per Module in Annex 1. Personal Data Processed by AI Features remains subject to this DPA.
12.2 No training. Neither the Processor nor its Sub-processors will use Personal Data to train or fine-tune general-purpose AI models. AI model providers are engaged with zero or limited data retention, and inputs and outputs are not used for model training.
12.3 Human oversight. AI Features support, and do not replace, human decisions. AI outputs are recommendations only, and the Platform does not make automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR. The Controller ensures that a human reviews AI outputs before taking decisions about Candidates or Employees.
12.4 No special category inference. AI Features are configured not to evaluate or infer special categories of data (e.g. health, ethnicity, religion, union membership) or to perform emotion recognition or biometric identification.
12.5 EU AI Act. The Parties acknowledge that AI systems used for recruitment and selection may be classified as high-risk under Regulation (EU) 2024/1689. The Processor, as provider, will provide the Controller, as deployer, with the information reasonably necessary to fulfil its deployer obligations, including instructions for use, information on human oversight and logging.
12.6 Configurability. The Controller may disable AI Features per Module where the Platform offers that option.
13 Liability
13.1 Each Party’s liability under this DPA is subject to the limitations and exclusions of liability in the MSA. The aggregate liability under this DPA and the MSA together does not exceed the caps set in Section 8 of the MSA, including the higher cap for data protection breaches.
13.2 Nothing in this DPA limits either Party’s liability towards Data Subjects or supervisory authorities under Article 82 GDPR, or the internal allocation of liability between the Parties under Article 82(5) GDPR.
14 Final Provisions
14.1 The Annexes form an integral part of this DPA.
14.2 If any provision of this DPA is invalid, the remaining provisions remain in force. The invalid provision will be replaced by a valid one that comes as close as possible to its purpose.
14.3 This DPA is governed by the laws of the Republic of Croatia, excluding its conflict-of-law rules. The competent court is the court at the Processor’s registered seat in Zagreb. Mandatory provisions of the SCCs on governing law and jurisdiction remain unaffected.
14.4 By accepting this DPA electronically, or by accepting the MSA, the Controller agrees to be bound by it. The person accepting confirms that they are authorised to bind the Controller.
Annex 1 – Details of Processing
Annex 1 fulfils Article 28(3) GDPR and serves as Annex I of the SCCs where applicable. It consists of one sub-annex per Module; each applies only when the Controller uses that Module.
| Annex | Module | Applies |
|---|---|---|
| 1a | ATS | If enabled |
| 1b | Screening | If enabled |
| 1c | Sourcing | If enabled |
| 1d | Notetaker | If enabled |
| 1e | Assessment | If enabled |
| 1f | Candidate NPS | If enabled |
| 1g | HRIS | If enabled |
Common to all Modules
- Users: Controller’s Users are Data Subjects in every Module: name, email, job title, phone (optional), profile image (optional), login, activity and audit log data.
- Duration: for the term of the MSA, then until deletion under Section 10, subject to retention periods the Controller configures.
- Frequency: continuous, whenever Users or Data Subjects submit data or the Platform processes it.
- Location: primarily the EU (Germany, Ireland, Netherlands). Transfers outside the EEA only to Sub-processors in Annex 3 under Section 11.
- Sub-processors: Core Sub-processors in Annex 3 apply to all Modules; Module Sub-processors are listed per Module.
Annex 1a – ATS (Applicant Tracking System)
| Item | Details |
|---|---|
| Data subjects | Candidates; Users; referees and referrers named by Candidates or Users |
| Personal data | Identification and contact data (name, email, phone, address); profile image; social profile URLs; CV and cover letter; education and employment history; skills, languages, certificates; answers to application questions; salary expectations and availability; job-related communication (emails, messages); notes, ratings, scorecards and tags added by Users; pipeline stage, status and decisions; interview scheduling data (calendar events, time slots); consents and GDPR retention status; source of application |
| Special categories | Not required. May be incidentally present in CVs or free-text answers if voluntarily provided by Candidates (e.g. health, union membership, religion). The Controller is responsible for any lawful basis and for asking only lawful questions |
| Nature and purpose | Publishing vacancies and career pages; receiving and storing applications; managing the hiring pipeline; collaboration of the hiring team; communication with Candidates by email, SMS or messaging; interview scheduling via calendar integration; job distribution to job boards; reporting; Candidate data retention and consent management |
| AI Features | CV parsing into structured fields; AI-assisted drafting of job ads and emails; AI summaries of Candidate profiles |
| Module Sub-processors | Job board distribution, calendar and messaging integration, AI model providers (see Annex 3) |
Annex 1b – Screening
| Item | Details |
|---|---|
| Data subjects | Candidates who applied to the Controller’s vacancies; Users |
| Personal data | Application materials and data from Annex 1a; screening criteria and knock-out questions set by the Controller; Candidate answers to screening questions (text, chat or voice); AI-generated outputs (match scores, criteria classification, extracted data points, summaries, explanations); User feedback, overrides and decisions |
| Special categories | Not intended. AI Features are configured to ignore special category data present in application materials and not to infer it (Section 12.4) |
| Nature and purpose | Assessing applications against criteria defined by the Controller; extracting and categorising data points; generating summaries and ranked shortlists with explanations; enabling Users to sort, filter and review; conducting AI-assisted screening conversations by chat or voice, where enabled; syncing decisions to the ATS |
| AI Features | Matching and classification against job criteria; summaries; conversational screening (chat/voice agent). All outputs are recommendations; the final decision is made by a User (Section 12.3) |
| Module Sub-processors | AI model providers; voice/telephony provider (if voice screening enabled); LLM monitoring (Langfuse) |
Annex 1c – Sourcing
This Annex distinguishes two categories of processing: (i) the Processor’s operation of the Sourcing Database and execution of searches, including matching and ranking logic, for which the Processor is an independent controller (see Section 4.6 and the Privacy Policy); and (ii) Controller-directed processing (saving Prospects, importing, enrichment, notes, outreach), for which the Processor is processor. This Annex covers category (ii) only.
| Item | Details |
|---|---|
| Data subjects | Prospective candidates saved, imported, researched or contacted by the Controller (“Prospects”); Users |
| Personal data | Name, job title, employer and education history, skills, location, public professional profile URLs (as saved from the Sourcing Database or imported); contact data obtained through enrichment on the Controller’s instruction (email, phone); outreach sequences, messages and replies; Prospect status, notes and tags; opt-out records |
| Special categories | Not processed |
| Nature and purpose | Storing and managing Prospect records the Controller saved or imported; contact enrichment on the Controller’s request; AI-assisted ranking of saved Prospects against job requirements; generating and sending outreach sequences; tracking responses; converting Prospects into Candidates in the ATS |
| AI Features | Drafting personalised outreach; ranking and match explanation of saved Prospects |
| Controller obligations | Inform Prospects under Article 14 GDPR at the latest at first contact; honour objections; comply with e-privacy rules (Terms, Section 8.2). The Platform adds a mandatory, non-removable privacy notice to the first message to each Prospect, covering both the Controller and the Processor (as controller of the Sourcing Database). Contact data obtained through enrichment, and any notes, messages and replies, are stored only in the Controller’s account; the Processor never adds them to the Sourcing Database or uses them for its own purposes. The Processor will also suppress a Prospect across the Sourcing Database if that person opts out with the Processor directly |
| Module Sub-processors | Data enrichment providers; Unipile (email/LinkedIn messaging); AI model providers |
Annex 1d – Notetaker
| Item | Details |
|---|---|
| Data subjects | Candidates; Users and other employees of the Controller participating in interviews; other participants (e.g. agency recruiters) |
| Personal data | Name, email and role of participants; calendar and meeting metadata (date, time, platform, link); audio and video recordings of interviews; transcripts with speaker identification; AI-generated summaries, scorecard drafts and notes; User notes and edits |
| Special categories | Not intended. May be incidentally captured if disclosed by participants during a conversation. No biometric identification, voice profiling or emotion recognition is performed |
| Nature and purpose | Joining online interviews via a meeting bot at the Controller’s instruction; recording, storing and transcribing interviews; generating summaries and scorecard suggestions; making recordings and transcripts available to authorised Users; attaching them to the Candidate profile in the ATS |
| Controller notes | The Controller ensures that all participants are informed of recording before it starts and that a lawful basis exists. The bot is visibly named and participants may request that it leaves the meeting |
| Retention | Recordings are retained for the period configured by the Controller; transcripts and summaries follow the Candidate’s retention in the ATS |
| Module Sub-processors | Meeting bot provider (Recall.ai); transcription provider; calendar integration; AI model providers |
Annex 1e – Assessment
| Item | Details |
|---|---|
| Data subjects | Candidates invited to assessments; Users; employees of the Controller where assessments are used internally |
| Personal data | Name, email; assessment invitations and completion status; answers, code submissions, written responses, uploaded files; one-way video responses (if video questions enabled); time spent; scores, ratings and AI-generated evaluations; User comments. Where the Controller enables anti-cheating (proctoring) features: device and browser fingerprint (e.g. browser type, operating system, screen resolution, IP address); webcam snapshots taken at intervals during the test; screen recordings or screenshots; behavioural signals (e.g. tab switching, copy-paste events, leaving full-screen); resulting integrity flags |
| Special categories | Not intended. Video responses and webcam snapshots may reveal physical appearance. Webcam snapshots are reviewed by Users only and are not used for facial recognition, biometric identification or verification, or emotion recognition; no biometric templates are created. Screen recordings may incidentally capture other content on the Candidate’s screen |
| Nature and purpose | Creating and sending skills, knowledge and cognitive tests; collecting and storing Candidate responses; automated scoring of objective questions; AI-assisted evaluation of open answers against Controller-defined rubrics; presenting results to Users; where enabled by the Controller, detecting and flagging possible cheating or impersonation to protect the integrity of the assessment |
| AI Features | Generating questions; evaluating open-ended answers against rubrics, with explanations. Results are recommendations reviewed by Users. Integrity flags indicate possible irregularities for human review and never lead to automatic disqualification |
| Controller notes | Anti-cheating features are optional and configured by the Controller, including which measures apply and how long the data is kept. Before the test starts, the Platform shows the Candidate a notice explaining which measures are active (webcam, screen recording, device fingerprint), why, and how long the data is kept; webcam and screen capture also require the Candidate’s browser permission. Device fingerprinting reads information from the Candidate’s device (Article 5(3) ePrivacy Directive); it is used solely for fraud prevention in the test the Candidate takes. The Controller is responsible for the lawful basis and for informing Candidates under Article 13 GDPR |
| Retention | Proctoring data (fingerprints, snapshots, recordings) is retained for the period configured by the Controller and deleted with the assessment result; [default retention, e.g. 90 days] |
| Module Sub-processors | Video capture (Pipe); [device fingerprinting provider, if external]; AI model providers |
Annex 1f – Candidate NPS
| Item | Details |
|---|---|
| Data subjects | Candidates who took part in the Controller’s hiring process |
| Personal data | Name and email (for sending the survey); hiring stage and vacancy; survey answers, NPS score and free-text feedback; response timestamps |
| Special categories | Not processed. Free-text feedback may incidentally contain such data |
| Nature and purpose | Sending candidate experience surveys at defined stages; collecting answers; aggregating NPS and feedback reports for the Controller. Where the Controller enables anonymous mode, results are shown in aggregated form without identifying the Candidate |
| AI Features | Sentiment and topic classification of free-text feedback; summary of feedback trends |
| Module Sub-processors | Email delivery (Core); AI model providers |
Annex 1g – HRIS
| Item | Details |
|---|---|
| Data subjects | Employees, former employees and contractors of the Controller; their next of kin / emergency contacts; Users |
| Personal data | First and last name; personal and work email and phone; home address; date of birth; nationality; gender; bank account details; copies of ID, passport, visa, work permit; employment details (role, department, manager, start date, contract type); compensation and benefits; time off records; timesheets and hours worked; employment documents (contracts, option agreements); performance and onboarding data; emergency contact name, phone and email; other data uploaded by the Controller or Employee |
| Special categories | Possible, at the Controller’s decision: health-related data in sick leave records, and other data required by employment law. The Controller is solely responsible for the lawful basis (Articles 9(2)(b) and 88 GDPR) and access restrictions |
| Nature and purpose | Maintaining employee records; employee self-service for viewing and updating own data; managing time off and attendance; document storage; onboarding and offboarding; HR reporting; transfer of hired Candidates from the ATS |
| Access | Access restricted by role. Employees can view and update their own data; sensitive fields (compensation, bank details, ID documents, sick leave) visible only to authorised HR Users |
| AI Features | None by default. Any AI Feature in HRIS will be announced under Section 2.3 |
| Module Sub-processors | Core only |
Annex 2 – Technical and Organisational Measures
This Annex serves as Annex II of the SCCs where applicable.
| Area | Measures |
|---|---|
| Security programme | Information security management system certified to ISO/IEC 27001 [certification body, certificate no., scope, valid until], with annual surveillance audits; managed via a compliance platform; policies reviewed at least annually; designated security and privacy owner |
| Physical security | Platform hosted exclusively with cloud providers holding ISO 27001 and SOC 2 certification (Microsoft Azure, MongoDB Atlas, Elastic Cloud), whose data centres apply access control, CCTV, alarm systems and environmental protection. No customer data on office premises |
| Encryption | TLS 1.2 or higher in transit; AES-256 at rest for databases, backups and file storage; secrets in a managed key vault |
| Access control | Least privilege and role-based access; unique accounts; MFA for all administrative and production access; SSO; quarterly access reviews; prompt revocation on offboarding |
| Platform access | Authentication via WorkOS with optional SSO/SAML for Controllers; role- and job-level permissions; password hashing; account lockout after repeated failed logins; session timeouts |
| Tenant separation | Logical multi-tenancy with tenant identifiers enforced in the application layer; separate development, staging and production environments; no production personal data in test environments |
| Logging and monitoring | Centralised logging of access, changes and deletions; restricted access to logs; alerting on anomalies; audit trail of User actions in the Platform |
| Secure development | Code review for every change; automated dependency and vulnerability scanning; secure SDLC; separation of duties for production deployments |
| Vulnerability management | Regular vulnerability scans; critical findings remediated with priority; independent penetration test at least annually |
| Availability and recovery | Automated daily backups with point-in-time recovery; geo-redundant storage within the EU; documented disaster recovery plan tested at least annually |
| Personnel | Confidentiality undertakings; security and privacy training on onboarding and annually; company-managed devices with full-disk encryption, screen lock and endpoint protection |
| Incident response | Documented incident response plan; breach notification per Section 9; post-incident review |
| Sub-processor management | Due diligence before engagement; DPAs with equivalent obligations; periodic review of certifications |
| Data minimisation and retention | Configurable retention periods and automated deletion of Candidate data; consent tracking; export and deletion tools for the Controller |
| AI safeguards | No training on customer data; zero or limited data retention with AI model providers; prompt and output monitoring; bias and quality evaluation of AI Features; human review of outputs |
Annex 3 – Sub-processors
The current list is also maintained at marty.hr/subprocessors. Changes are notified under Section 6.3.
Core Sub-processors
| Entity | Location of processing | Purpose | Transfer mechanism |
|---|---|---|---|
| Microsoft Ireland Operations Ltd., Dublin, Ireland | Germany (EU) | Cloud hosting, compute and storage | EU |
| MongoDB Ltd., Dublin, Ireland | Ireland (EU) | Database hosting | EU |
| Elastic N.V., Amsterdam, Netherlands | EU | Search indexing and log storage | EU |
| Sinch AB, Stockholm, Sweden | Germany and Belgium (EU) | Transactional email and candidate communication | EU |
| Cloudflare Portugal, Unipessoal Lda., Lisbon, Portugal | Global edge network | CDN, DNS, DDoS and security | DPF / SCCs |
| WorkOS, Inc., San Francisco, USA | USA | Authentication and SSO | DPF / SCCs |
| Hookdeck Technologies Inc., Dover, USA | USA | Webhook and event routing | SCCs |
| [AI model provider – to be completed] | [EU region] | LLM inference for AI Features | [EU / SCCs] |
Module Sub-processors
| Entity | Location of processing | Purpose | Module | Transfer mechanism |
|---|---|---|---|---|
| AdoptoTech d.o.o., Zagreb, Croatia | Ireland and Netherlands (EU) | [Describe the specific service, e.g. AI screening processing] | [Module] | EU |
| Langfuse GmbH, Berlin, Germany | EU [confirm region] | Monitoring and evaluation of LLM prompts and outputs | Screening, Sourcing, Notetaker, Assessment, NPS | EU |
| Recall.ai, Inc., USA | [confirm EU region] | Meeting bot, recording | Notetaker | [DPF / SCCs] |
| [Transcription provider] | [ ] | Speech-to-text | Notetaker, Screening (voice) | [ ] |
| Unipile SAS, France | EU | Email, calendar and LinkedIn messaging integration | ATS, Sourcing | EU |
| [Data enrichment provider] | [ ] | Contact enrichment | Sourcing | [ ] |
| Pipe Services SRL, Bucharest, Romania | Ireland (EU) | One-way video capture and storage | Assessment | EU |
| VONQ B.V., Rotterdam, Netherlands | EU | Job ad distribution | ATS | EU |
| Stripe Payments Europe, Ltd., Dublin, Ireland | Ireland (EU) | Payment processing (User billing data) | Billing | EU / SCCs |
| Intercom R&D Unlimited Co., Dublin, Ireland | Ireland (EU) | Customer support chat (User data) | Support | EU / SCCs |
Items in [brackets] must be confirmed before publication: LLM provider(s) and region, transcription and enrichment vendors, Recall.ai region and transfer basis, AdoptoTech’s exact role, and Langfuse hosting region.