Terms of Service, Cookie, and Privacy Policy

Acknowledgement by Employer

By selecting Confirm, you confirm that this job post accurately reflects your requirements and authorize its publication and the processing of applications in accordance with Mastersofwork.com’s Terms of Service, Cookie Policy, and Privacy Policy.

MASTERSOFWORK.COM DATA PROCESSING AGREEMENT

Controller-to-Processor Data Processing Addendum

This Data Processing Addendum (“Addendum”) forms part of the Terms of Service or other services agreement between you (“Client,” “you,” or “your”) and the business operating Mastersofwork.com (“Mastersofwork.com,” “we,” “us,” or “our”), collectively referred to as the “Agreement.”

This Addendum applies where Mastersofwork.com processes Client Personal Data on your behalf as a Processor or Service Provider in connection with the services provided under the Agreement (“Services”).

Where Mastersofwork.com processes Personal Data as an independent Controller, that processing is governed by applicable data protection law, the Agreement, and Mastersofwork.com’s Privacy Policy.

You and Mastersofwork.com are collectively referred to as the “Parties” and individually as a “Party.”

1. Definitions

Affiliate means an entity that directly or indirectly controls, is controlled by, or is under common control with a Party. “Control” means ownership of a majority of voting interests or the power to direct an entity’s management.

Applicable Data Protection Law means privacy, data protection, and data security laws and regulations applicable to the processing of Client Personal Data under the Agreement. These may include, where applicable, the European Union General Data Protection Regulation (“GDPR”), the United Kingdom General Data Protection Regulation and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), the Brazilian General Personal Data Protection Law (“LGPD”), and other applicable national, state, or local privacy laws.

Business Contact Information means business contact details relating to a Party’s personnel or representatives, including names, business email addresses, business telephone numbers, job titles, and business addresses.

Client Personal Data means Personal Data submitted, uploaded, transmitted, or otherwise made available by or on behalf of Client through the Services that Mastersofwork.com processes on Client’s behalf.

Controller, Processor, Data Subject, Personal Data, Processing, and Service Provider have the meanings assigned to them under Applicable Data Protection Law. References to a Processor include a Service Provider or Contractor where those roles apply under Applicable Data Protection Law.

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data processed by Mastersofwork.com.

Subprocessor means a third party engaged by Mastersofwork.com to process Client Personal Data on Client’s behalf.

Standard Contractual Clauses means the applicable standard contractual clauses or other approved contractual safeguards used to support international transfers of Personal Data under Applicable Data Protection Law.

2. Responsibilities of the Parties

2.1 Mutual responsibilities

Each Party shall comply with Applicable Data Protection Law in performing its obligations under the Agreement and this Addendum.

Each Party represents that it has the authority to enter into this Addendum and perform its obligations.

2.2 Client responsibilities

Client is responsible for:

Establishing a lawful basis for collecting and processing Client Personal Data.

Providing required privacy notices and obtaining necessary permissions or consents.

Ensuring that its instructions to Mastersofwork.com comply with Applicable Data Protection Law.

Ensuring the accuracy, quality, and legality of Client Personal Data.

Limiting the Personal Data submitted through the Services to information reasonably necessary for the intended purpose.

Configuring and using the Services in accordance with the Agreement and Applicable Data Protection Law.

Informing Mastersofwork.com of any specific processing restrictions that apply to Client Personal Data before submitting that information.

Client shall not instruct Mastersofwork.com to process Client Personal Data in a manner that violates Applicable Data Protection Law.

2.3 Mastersofwork.com responsibilities

Mastersofwork.com shall process Client Personal Data only on Client’s documented instructions, including instructions contained in the Agreement, this Addendum, and Client’s use and configuration of the Services, unless otherwise required by law.

Where processing is required by law, Mastersofwork.com shall inform Client of that requirement before processing unless legally prohibited from doing so.

Mastersofwork.com shall promptly inform Client if, in its opinion, an instruction infringes Applicable Data Protection Law.

3. Processing of Client Personal Data

3.1 Authorized purposes

Mastersofwork.com shall process Client Personal Data to provide, maintain, secure, and support the Services and to carry out other lawful documented instructions from Client.

The subject matter, nature, purposes, duration, categories of Personal Data, and categories of Data Subjects are described in Appendix A.

3.2 Confidentiality

Mastersofwork.com shall ensure that persons authorized to process Client Personal Data are subject to appropriate contractual or statutory confidentiality obligations.

Access to Client Personal Data shall be limited to persons who require that access to perform their duties.

3.3 De-identified information

To the extent permitted by Applicable Data Protection Law and Client’s documented instructions, Mastersofwork.com may create and use aggregated or de-identified information for service analysis, reporting, research, and improvement.

Mastersofwork.com shall implement appropriate safeguards against re-identification and shall not attempt to re-identify information maintained as de-identified, except as permitted by Applicable Data Protection Law.

3.4 Return and deletion

Upon termination or expiration of the Services, Mastersofwork.com shall, at Client’s choice, return or delete Client Personal Data and delete existing copies, unless applicable law requires continued storage.

Client shall communicate its choice through the support or account communication channels provided by Mastersofwork.com.

Where immediate deletion from backup systems is not reasonably practicable, the information shall remain protected, shall not be used for other purposes, and shall be deleted in accordance with the applicable backup retention cycle.

Where retention is legally required, Mastersofwork.com shall limit further processing to the legally required purpose and continue protecting the retained information.

4. Security Measures and Personal Data Breaches

4.1 Security measures

Mastersofwork.com shall implement and maintain appropriate technical and organizational measures to protect Client Personal Data against unauthorized or unlawful processing and accidental loss, destruction, alteration, or disclosure.

In determining appropriate measures, Mastersofwork.com shall consider the state of technology, implementation costs, the nature and purposes of processing, and the risks to individuals.

The security requirements applicable to processing under this Addendum are described in Appendix B.

Mastersofwork.com may update its security measures to address technological developments and evolving risks, provided those changes do not materially reduce the overall protection of Client Personal Data.

4.2 Breach notification

Mastersofwork.com shall notify Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

Taking into account the information available, notification shall describe:

The nature of the breach.

The categories and approximate number of affected individuals and records, where known.

The likely consequences.

Measures taken or proposed to address the breach and mitigate its effects.

A contact through which Client may obtain further information.

Information may be provided in phases where it is not available at the same time.

Mastersofwork.com shall take reasonable steps to investigate, contain, and remediate the breach and provide reasonable assistance with Client’s applicable notification obligations.

Each Party remains responsible for making notifications required of it by law. Cooperation between the Parties shall not delay legally required notices.

5. Information, Audits, and Inspections

Mastersofwork.com shall make available information reasonably necessary to demonstrate compliance with its obligations under this Addendum.

Where required by Applicable Data Protection Law, Mastersofwork.com shall allow and contribute to audits and inspections conducted by Client or an independent auditor appointed by Client.

Audits shall be subject to reasonable confidentiality, security, scheduling, and scope requirements and shall avoid unnecessary disruption to the Services or disclosure of other customers’ confidential information.

Client shall ordinarily provide reasonable advance notice. Additional or expedited audits may be conducted where required by law, requested by a competent supervisory authority, or reasonably necessary following a material security incident or evidence of noncompliance.

Any allocation of audit costs shall not prevent the exercise of rights required by Applicable Data Protection Law.

6. Data Subject and Supervisory Authority Requests

Mastersofwork.com shall provide reasonable assistance, taking into account the nature of processing, to help Client respond to requests from individuals exercising rights under Applicable Data Protection Law.

If Mastersofwork.com receives a request concerning Client Personal Data directly from a Data Subject, it shall notify Client without undue delay and shall not independently respond except on Client’s instructions or as required by law.

Client shall provide the information reasonably necessary for Mastersofwork.com to identify the relevant records and assist with the request.

Unless legally prohibited, Mastersofwork.com shall notify Client of supervisory authority communications that relate specifically to the processing of Client Personal Data on Client’s behalf.

Each Party remains responsible for its own communications and legal obligations to supervisory authorities.

7. Data Protection Impact Assessments

Taking into account the nature of processing and the information available to it, Mastersofwork.com shall provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities where required by Applicable Data Protection Law.

This assistance shall relate to Mastersofwork.com’s processing of Client Personal Data under the Agreement.

8. Subprocessors

Client generally authorizes Mastersofwork.com to engage Subprocessors to support delivery of the Services.

Mastersofwork.com shall:

Make information about relevant Subprocessors available to Client.

Provide advance notice of intended additions or replacements so that Client has an opportunity to object.

Enter into written agreements imposing data protection obligations that provide at least the protection required under this Addendum for the processing performed.

Remain responsible for the performance of its Subprocessors’ obligations as required by Applicable Data Protection Law.

Client may object in writing on reasonable data protection grounds within ten business days after receiving notice of an intended addition or replacement.

The Parties shall work in good faith to address the objection. If no reasonable resolution is available, the Parties may discontinue the affected portion of the Services in accordance with the Agreement and applicable law.

9. International Data Transfers

9.1 General requirements

Mastersofwork.com shall transfer Client Personal Data internationally only in accordance with Applicable Data Protection Law.

Where required, the Parties shall establish a valid transfer mechanism and complete any required assessments or supplementary safeguards before the relevant transfer occurs.

9.2 European Economic Area

For transfers subject to the GDPR to a destination without an applicable adequacy decision, the Parties shall use an authorized transfer mechanism, such as the applicable European Commission Standard Contractual Clauses, where appropriate.

Where Standard Contractual Clauses are used, the Parties shall complete the required selections and annex information and enter into the clauses in a legally binding manner before relying on them.

9.3 United Kingdom and Switzerland

Transfers subject to United Kingdom or Swiss data protection law shall be supported by the applicable safeguards, including any required United Kingdom transfer agreement or addendum and any necessary Swiss adaptations.

9.4 Other jurisdictions

For transfers subject to other data protection laws, including the LGPD where applicable, the Parties shall implement the transfer mechanism and documentation required by those laws.

9.5 Changes to transfer mechanisms

If a transfer mechanism becomes invalid, unavailable, or insufficient, the Parties shall cooperate in good faith to establish an appropriate alternative and implement any necessary supplementary safeguards.

Affected transfers shall be suspended where required until a lawful mechanism is in place.

10. California Personal Information

To the extent the CCPA applies and Mastersofwork.com acts as Client’s Service Provider or Contractor, Mastersofwork.com shall:

Process Client Personal Data only for the specific business purposes described in the Agreement, this Addendum, and Appendix A.

Not sell or share Client Personal Data as those terms are defined by the CCPA.

Not retain, use, or disclose Client Personal Data outside the direct business relationship with Client, except as permitted by the CCPA.

Not combine Client Personal Data with Personal Data received from other sources except as permitted by the CCPA.

Provide the level of privacy protection required by applicable CCPA obligations.

Notify Client if it determines it can no longer meet its applicable obligations.

Client may take reasonable and appropriate steps to verify that Mastersofwork.com uses Client Personal Data consistently with Client’s CCPA obligations and to stop and remediate unauthorized use.

Mastersofwork.com certifies that it understands the restrictions in this section and will comply with them.

11. Business Contact Information

Each Party may process the other Party’s Business Contact Information for contract administration, account management, billing, support, and other lawful business relationship purposes.

For this processing, each Party acts as an independent Controller and shall comply with Applicable Data Protection Law and its applicable privacy notices.

Use of Business Contact Information for marketing communications shall remain subject to applicable notice, consent, and opt-out requirements.

12. Liability

The liability provisions of the Agreement apply to this Addendum to the extent permitted by Applicable Data Protection Law.

Nothing in the Agreement or this Addendum excludes or limits liability that cannot lawfully be excluded or limited, restricts the enforceable rights of Data Subjects, or overrides mandatory provisions of applicable Standard Contractual Clauses.

13. Relationship to the Agreement

This Addendum governs the Parties’ obligations concerning Mastersofwork.com’s processing of Client Personal Data on Client’s behalf.

If this Addendum conflicts with the Agreement on that subject, this Addendum shall prevail.

If applicable Standard Contractual Clauses conflict with this Addendum or the Agreement, the Standard Contractual Clauses shall prevail to the extent of that conflict.

All other provisions of the Agreement remain in effect.

14. Severability

If any provision of this Addendum is held invalid or unenforceable, the remaining provisions shall continue in effect to the extent permitted by law.

The Parties shall cooperate to replace the affected provision with a valid provision that reflects its purpose as closely as reasonably possible.

15. Notices and Amendments

Notices relating to this Addendum shall be provided through the notice procedures in the Agreement or the account, support, or contact channels made available by Mastersofwork.com.

Client is responsible for keeping its account contact information current.

Amendments shall be documented in writing and agreed through a legally valid method, including electronic acceptance where permitted by law.

16. Changes in Law

If a change in Applicable Data Protection Law or a material change in security risks requires changes to processing under this Addendum, the Parties shall cooperate in good faith to implement the changes reasonably necessary for compliance and protection of Client Personal Data.

Where continued processing cannot lawfully occur, the affected processing shall be suspended or discontinued.

17. Governing Law and Jurisdiction

This Addendum is governed by the governing-law and jurisdiction provisions of the Agreement, except where mandatory provisions of Applicable Data Protection Law or applicable Standard Contractual Clauses require otherwise.

If the Agreement does not specify governing law or jurisdiction, those matters shall be determined under applicable law.

APPENDIX A — DESCRIPTION OF PROCESSING

A. Parties and Roles

Client: The individual or organization identified in the employer account, order, or other applicable Agreement with Mastersofwork.com.

Client contact details: The contact details maintained in Client’s account or the Agreement.

Client role: Controller of Client Personal Data processed on its behalf.

Service provider: The business operating Mastersofwork.com and providing the Services under the Agreement.

Service provider contact: The contact channels identified in the Agreement or made available on Mastersofwork.com.

Service provider role: Processor or Service Provider for processing covered by this Addendum.

B. Subject Matter and Purpose

Processing supports the delivery of the recruitment and employment-related Services selected and used by Client, including:

Creating and managing employer accounts.

Publishing and managing job postings.

Receiving, organizing, and presenting job applications.

Facilitating communications between employers and applicants.

Supporting candidate review and hiring workflows.

Providing account support and service administration.

Protecting the Services against fraud, unauthorized access, and misuse.

Performing other lawful processing documented in the Agreement or Client’s instructions.

C. Nature of Processing

Processing may include collection, recording, organization, storage, retrieval, consultation, transmission, restriction, return, and deletion of Client Personal Data as necessary to provide the Services.

D. Categories of Data Subjects

Data Subjects may include:

Job applicants and candidates.

Client’s employees and contractors.

Recruiters and hiring managers.

Authorized account users.

Other individuals whose Personal Data Client lawfully submits through the Services.

E. Categories of Personal Data

Depending on the features used and information submitted, Client Personal Data may include:

Names and contact details.

Account identifiers and authentication information.

Employer names, job titles, and professional details.

Resumes, cover letters, employment history, education, and qualifications.

Application responses and screening information.

Candidate preferences and availability.

Messages and other recruitment communications.

Hiring notes and application status information.

Scheduling information where relevant features are used.

Technical information, including IP addresses, device information, and service logs.

Other Personal Data lawfully provided by Client or at Client’s direction.

F. Sensitive Personal Data

Client shall not submit sensitive or special-category Personal Data unless necessary for a lawful purpose, permitted by the Services, and supported by the legal basis and safeguards required under Applicable Data Protection Law.

Where such information is lawfully processed, the Parties shall apply protections appropriate to its sensitivity and the applicable legal requirements.

G. Frequency

Processing occurs as needed throughout Client’s use of the Services and may be ongoing.

H. Duration and Retention

Processing continues for the duration of the Agreement and any subsequent period necessary to return or delete Client Personal Data in accordance with this Addendum.

Retention required by law remains subject to appropriate safeguards and purpose restrictions.

I. Supervisory Authorities

The competent supervisory authority shall be determined under Applicable Data Protection Law, taking into account the relevant establishment, processing activities, and affected Data Subjects.

Any transfer documentation shall identify the competent authority where required.

APPENDIX B — TECHNICAL AND ORGANIZATIONAL SECURITY REQUIREMENTS

Mastersofwork.com shall implement and maintain measures appropriate to the processing and associated risks. These requirements apply to systems and personnel involved in processing Client Personal Data, including relevant service providers.

1. Security Governance

Assign responsibility for information security and privacy.

Maintain appropriate security policies and procedures.

Review security risks and update safeguards as necessary.

Establish procedures for reporting and addressing security concerns.

2. Personnel and Confidentiality

Restrict access to authorized personnel.

Apply appropriate confidentiality obligations.

Provide security guidance and training relevant to personnel responsibilities.

Remove access when no longer required.

3. Access Management

Limit access according to job responsibilities and the principle of least privilege.

Use appropriate authentication and credential management controls.

Apply stronger authentication to privileged or remote access where appropriate to the risk.

Review permissions and promptly revoke unnecessary access.

Protect against unauthorized access attempts.

4. Data and Asset Management

Identify systems and assets used to process Client Personal Data.

Apply handling requirements appropriate to the sensitivity of the information.

Limit unnecessary copying, sharing, and retention.

Use appropriate procedures for secure disposal and deletion.

5. Infrastructure and Network Protection

Use appropriate network access controls.

Protect Personal Data during transmission using suitable encryption.

Apply appropriate protection to stored Personal Data, taking account of sensitivity and risk.

Maintain systems through security updates and vulnerability management.

Implement protections against malicious software and unauthorized activity.

6. Application Security

Apply secure development and change management practices.

Validate inputs and control access to application functions.

Protect production information during development and testing.

Assess and address vulnerabilities in software and dependencies.

Review material changes for security implications.

7. Monitoring and Incident Response

Maintain appropriate security logs and monitoring.

Establish procedures for identifying, investigating, and responding to incidents.

Limit incident information to authorized persons.

Document response activities and implement appropriate corrective measures.

Notify Client of Personal Data Breaches in accordance with this Addendum.

8. Availability and Recovery

Maintain backup and recovery arrangements appropriate to the Services.

Protect backup information against unauthorized access.

Assess the ability to restore information and service availability.

Apply appropriate continuity measures to reduce the effects of disruptions.

9. Physical Security

Apply access restrictions and environmental protections appropriate to facilities used for processing.

Assess relevant physical security protections provided by hosting and infrastructure providers.

Protect equipment and storage media against unauthorized access or removal.

10. Third-Party Management

Assess relevant security and privacy risks before engaging Subprocessors.

Establish contractual protection for Client Personal Data.

Limit third-party access to the purposes for which it is authorized.

Review material changes affecting the protection of Client Personal Data.

11. Review and Improvement

Periodically assess the effectiveness of security measures.

Address identified weaknesses according to their risk.

Maintain information reasonably necessary to demonstrate compliance with this Addendum.

INTERNATIONAL TRANSFER DOCUMENTATION

Where a transfer requires contractual safeguards, the Parties shall complete and enter into the applicable transfer documentation before relying on that mechanism.

European Commission Standard Contractual Clauses are available through the European Commission’s official publications.

The United Kingdom International Data Transfer Addendum is available through the Information Commissioner’s Office.

This Addendum does not, by itself, represent that Mastersofwork.com participates in a data privacy certification program or that separate international transfer documentation has been completed.