Data processing agreement

Last updated: January 1, 2026

This data processing agreement ("DPA") forms part of the terms of service between Leads4Talent LLC ("processor" or "we") and the client ("controller" or "you").

1. Parties & definitions

Processor: Leads4Talent LLC, 7901 4th Street N, Suite 16801, St. Petersburg, Florida 33702, United States, email: [email protected]

Controller: The client subscribing to Leads4Talent services.

Definitions:

• Personal data: Any information relating to an identified or identifiable individual collected through your job campaigns.
• Processing: Any operation performed on personal data, including collection, storage, use, and deletion.
• Data subject: The individual whose personal data is processed (e.g., job applicants).

Applicable laws: This DPA is intended to comply with applicable data protection laws worldwide, including Regulation (EU) 2016/679 (GDPR) and the UK GDPR, where applicable.

2. Scope of processing

What we process: We process personal data solely to provide our job campaign services as described in the terms of service.

Categories of data subjects:

• Job applicants
• Prospective candidates
• Anyone submitting information through your application funnels

Categories of personal data:

• Contact information (name, email, phone number)
• Location/city
• Work history and experience
• Responses to qualification questions
• Any other information you choose to collect through your campaigns

Purpose of processing:

• Operating your application funnels
• Delivering applicant data to you by email alert, and to your ATS if an integration is set up
• Providing campaign management and optimization services
• Supporting your recruiting and hiring activities

Duration of processing: We process each job campaign's data while that campaign is active and for up to 30 days after it ends.

3. Roles & responsibilities

You (controller):

• Determine what personal data to collect and how to use it.
• Ensure you have legal basis to collect and process the data.
• Handle all personal data in compliance with applicable privacy laws.
• Respond to data subject requests (access, deletion, etc.).

We (processor):

• Process personal data only on your documented instructions.
• Implement appropriate security measures.
• Assist you in meeting your legal obligations.
• Do not use personal data for any purpose other than providing our services.
• Do not sell personal data or use it for our own marketing purposes.

4. Processing instructions

Your instructions: By using our services, you instruct us to:

• Collect personal data via your application funnels.
• Store the data in our systems while your campaign is active.
• Deliver the data to you by email alert, and to your ATS if an integration is set up.
• Process the data as needed to operate and optimize your campaigns.

Unlawful instructions: If we believe your instructions violate applicable data protection laws, we will notify you promptly.

Anonymized data: We may anonymize personal data (removing all identifiable information) and use such anonymized data for analytics and service improvement.

5. Security measures

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures may include encryption, access controls, security monitoring, employee confidentiality obligations, and vendor security assessments.

We continuously review and update our security practices to maintain an appropriate level of protection based on the nature and risks of the processing.

While we use commercially reasonable measures to protect personal data, we do not guarantee its absolute security.

6. Subprocessors

Authorization: You authorize us to engage the following subprocessors to assist in providing our services:

Subprocessor requirements: All subprocessors are contractually required to:

• Process personal data only as instructed.
• Implement appropriate security measures.
• Maintain confidentiality.
• Comply with applicable data protection laws.

Changes to subprocessors: We will notify you at least 14 days before adding or replacing any subprocessor. You may object on reasonable data protection grounds. We will work in good faith to address any legitimate concerns. If we cannot resolve a legitimate data protection objection, you may terminate the agreement in accordance with the terms of service.

Subprocessors vs. personnel: Our employees and any freelance contractors we may engage work under our direct control and instructions, and are considered our personnel, not subprocessors. All such personnel are contractually bound to confidentiality and data protection obligations consistent with this DPA. The subprocessor provisions of this DPA apply only to third-party service providers listed above.

7. Data subject rights

Your obligations: As controller, you are responsible for responding to data subject requests (access, correction, deletion, etc.).

Our assistance: We will assist you by:

• Enabling data export via CSV.
• Deleting data upon your request.
• Responding promptly to your reasonable assistance requests.

If a data subject contacts us directly, we will forward their request to you promptly.

8. Data breach notification

Our obligations: If we become aware of a personal data breach, we will notify you without undue delay and provide available details of the breach, affected data, and mitigation steps taken or proposed.

Your obligations: You are responsible for determining whether to notify data subjects or regulators, as required by applicable law.

9. Data retention & deletion

While a job campaign is active: We hold that campaign's personal data in our systems as needed to run the campaign and provide our services, and to meet any legal obligations.

When a job campaign ends: The personal data we hold in our systems for that campaign is retained for up to 30 days after the campaign ends, then deleted. A CSV export is available upon request before deletion.

After the 30-day retention period: All personal data we hold is permanently deleted from our systems unless we are required by law to retain it longer. We will notify you if this applies.

10. International data transfers

Cross-border transfers: Our services involve international data transfers (e.g., US-based company, EU-hosted servers, global subprocessors). Applicant data is stored primarily in the European Union through our subprocessors, with limited processing and transfers outside the EU as described in section 6.

Transfer mechanisms: Where required by applicable law, we rely on appropriate transfer mechanisms such as standard contractual clauses (SCCs), adequacy decisions, or other legally recognized safeguards.

Your acknowledgment: By using our services, you acknowledge that these international transfers may occur under the mechanisms described.

11. Compliance & documentation

Your rights: You may request documentation demonstrating our compliance with this DPA, including access to relevant security certifications, policies, and third-party audit reports where available.

Our cooperation: We will provide reasonable documentation and cooperate with you to enable you to verify compliance with this DPA and applicable data protection laws. We will also cooperate with supervisory authorities as legally required.

12. Liability

Our liability: We are liable for damages caused by our breach of this DPA, subject to the limitations in the terms of service.

Shared liability: Where both parties are responsible for a data protection violation, liability is allocated based on proportional responsibility.

13. Term & termination

Duration: This DPA remains in effect for as long as we process personal data on your behalf.

Termination:

• This DPA terminates automatically when your subscription ends.
• You may terminate immediately if we materially breach this DPA and fail to cure within a reasonable opportunity after written notice.
• Upon termination, we will delete or return all personal data as described in section 9.

14. Modifications

We may update this DPA to reflect changes in law or our practices. We will notify you of material changes via email at least 30 days before they take effect.

15. Governing law

This DPA is governed by the laws of the state of Florida, consistent with the terms of service.

Acceptance

This DPA is incorporated into and forms part of the terms of service. By accepting the terms of service, you accept this DPA.