Data processing agreement

under Article 28(3) of the General Data Protection Regulation (GDPR)

This data processing agreement applies to every business that uses jajob.dk's hiring tools. It forms part of our terms of use and is accepted together with them. If you want a signed copy with your company's details, you can request it here — the content is the same. The Danish version prevails.

The controller: the business that has an employer account on jajob.dk ("the company")

The processor: LynBro ApS, CVR no. 46321499, Rødovre Parkvej 276, 2610 Rødovre, Denmark ("jajob.dk")

1. Background and purpose

1.1. The company uses jajob.dk to publish job ads and handle applications (pipeline, notes, scorecards, interviews, messages, invitations and, where enabled, import from the company's own applicant tracking system, ATS). When the company uses these tools to assess candidates, the company is the controller and jajob.dk processes the data on its behalf.

1.2. jajob.dk is an independent controller for job seekers' accounts and profiles, for matching, and for operating and securing the platform, see our privacy policy. This agreement covers only the processing jajob.dk carries out for the company.

1.3. The company is responsible for the lawfulness of its own processing, including having a valid legal basis, informing candidates about its recruitment, using the data only for the recruitment it was given for, and ensuring that job ads — including those imported from its ATS — are lawful and accurate.

2. The processing

Purpose	Providing jajob.dk's hiring tools to the company
Nature	Storage, display, search, structuring, sharing between the company's users, backup, deletion; AI assistance (summaries, match explanations) with no automated decisions
Data subjects	Applicants and candidates; the company's own users (team members)
Categories of data	Application, CV and profile data, answers to screening questions, contact details the candidate has chosen to share, status, notes, scorecards, interview times, messages. Special categories (Art. 9) and Danish CPR numbers must not be processed in the service
Duration	As long as the company has an account, and until the data is deleted under section 11 and jajob.dk's retention periods

3. Instructions

3.1. jajob.dk processes the data only on documented instructions from the company. The terms of use, this agreement and the company's use of the service's features constitute the instructions. Further instructions are given in writing (email is sufficient).

3.2. jajob.dk informs the company immediately if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

Only staff and suppliers of jajob.dk who need access have it, and they are bound by confidentiality.

5. Security

5.1. jajob.dk implements appropriate technical and organisational measures under Art. 32 (Annex C), including encrypted connections (TLS), passwords stored only as hashes, role-based access within the company (owner, recruiter, viewer), an audit log of actions in the company account, separation between companies, ongoing security updates, monitoring and regular backups.

5.2. The company is responsible for who it gives access to its account and for its users' passwords.

6. Sub-processors

6.1. The company gives general prior authorisation for the sub-processors listed in Annex B.

6.2. jajob.dk notifies the company at least 30 days before adding or replacing a sub-processor (email to the account owner and an update of this page). The company may object on reasonable grounds within that period; if the parties cannot agree, the company may close its account with effect from the change.

6.3. jajob.dk imposes the same data protection obligations on sub-processors as in this agreement.

7. Transfers to third countries

Transfers outside the EU/EEA take place only to the sub-processors listed in Annex B and only with a valid transfer mechanism under GDPR Chapter V (EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses).

8. Assistance

8.1. jajob.dk assists the company in responding to data subject requests (Arts. 12–22) and with Arts. 32–36, taking into account the nature of the processing. The company can handle many requests itself in the service.

8.2. If jajob.dk receives a request that concerns only the company's recruitment, it is forwarded to the company without undue delay.

9. Personal data breaches

jajob.dk notifies the company without undue delay and, where possible, no later than 48 hours after becoming aware of a breach affecting the company's data, with the information required by Art. 33(3). The company assesses and notifies the Danish Data Protection Agency and the data subjects for its own processing.

10. Documentation and audits

10.1. On request, jajob.dk makes available the information necessary to demonstrate compliance with Art. 28, such as a description of the security measures.

10.2. No more than once a year and with 30 days' written notice, the company may have an independent auditor bound by confidentiality carry out an audit. The audit must not give access to other customers' data. The company bears its own costs and pays for jajob.dk's time spent, unless the audit reveals a material breach.

11. Termination, deletion and return

Before the account is closed, or within 30 days after, the company can ask for an export of its data by writing to info@jajob.dk; jajob.dk delivers it within 30 days. jajob.dk then deletes or anonymises the data it processes for the company. Backup copies are deleted in line with the normal backup cycle, no later than 90 days afterwards. Data that the candidate holds on their own jajob.dk profile does not belong to the company and is not deleted when the company leaves.

12. Liability

12.1. The parties' liability follows the general rules of Danish law, subject to the limitations in section 10 of the terms of use. GDPR Art. 82 on liability towards data subjects is not affected.

12.2. The company indemnifies jajob.dk against third-party claims arising from the company's failure to comply with its obligations as controller.

13. Term, changes and governing law

This agreement applies as long as jajob.dk processes personal data for the company. Changes to the company's disadvantage are announced at least 30 days in advance. In case of conflict between the terms of use and this agreement, this agreement prevails as regards the protection of personal data. Danish law applies; disputes are settled by the Copenhagen City Court as the court of first instance.

Annex A — Overview of the processing

See section 2. The data is stored in the EU (Germany). A candidate's contact details are visible to the company only when the candidate has applied to the company, has accepted the company's invitation, or has chosen to show them.

Annex B — Sub-processors

Sub-processor	Service	Location
netcup GmbH	Servers and database (hosting)	Germany (EU)
Contabo GmbH	Mail server for service emails	Germany (EU)
Google Ireland Ltd.	Off-site backup (Google Drive)	EU; group companies in the USA (EU-US Data Privacy Framework)
OpenAI Ireland Ltd.	AI assistance (summaries, match explanations, translation, assistant). Data is not used to train models	Ireland (EU); processing in the USA (DPF / Standard Contractual Clauses)
Stripe Payments Europe Ltd.	Subscription payments (only the company's billing details)	Ireland (EU); group companies in the USA (DPF)

Annex C — Technical and organisational measures

• Encryption in transit (HTTPS/TLS); off-site backup in Google Drive with access limited to LynBro.
• Passwords stored only as hashes; sessions can be revoked.
• Role-based access in the company account; audit log of actions.
• Separation between companies in every query, with tests that one company cannot see another's data.
• Server access by SSH keys only; firewall; ongoing security updates; rate limiting and abuse protection.
• Monitoring of errors and uptime; logs without unnecessary personal data.
• Daily backup and an extra dump before every database change.
• AI features never make decisions about candidates; a person always decides.