This data processing agreement (hereinafter “DPA”) specifies the parties’ data protection obligations under Art. 28 GDPR for the processing of personal data that the processor carries out on behalf of the controller within the scope of the main contract for technical candidate assessment (Recruiting as a Service).
The processor is IT Titans Software GmbH, Am Emsdeich 48, 26789 Leer, Germany, registered in the commercial register under HRB 206604, represented by its managing director Rene Koch (hereinafter “Processor”). The controller is the client using the services via the platform or the main contract (hereinafter “Controller”).
In the event of conflicts between this DPA and the main contract, the provisions of this DPA prevail on data protection matters.
The term of this DPA matches the term of the main contract. It ends automatically upon its termination; the obligations to delete and return data (§ 9) continue to apply beyond that point.
The subject matter and purpose of the processing is the delivery of the agreed services to assess the technical suitability of IT applicants (CV evaluation, technical screening interview) and the provision of a clear professional assessment.
The nature of the processing includes collecting, recording, storing, organising, evaluating, using for assessment, transmitting to reviewers contractually bound to confidentiality, and deleting the data.
Processing takes place exclusively within the European Union or the European Economic Area (EU/EEA). No personal data is transferred to third countries.
Categories of data subjects: applicants (candidates) of the controller for IT positions.
Types of personal data: master data (e.g. name, contact details), CVs and application documents, references where applicable, information collected during the technical screening interview and its recordings, and the assessment results and professional verdicts derived from them.
Special categories of personal data within the meaning of Art. 9 GDPR are not part of the assignment. The controller ensures that it does not transmit such data to the processor.
The processor processes personal data exclusively on documented instructions from the controller, unless required to process by Union or Member State law; in that case, the processor informs the controller of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
The intended use of the platform within the agreed functional scope constitutes a documented instruction. Further or deviating instructions require text form.
If the processor considers that an instruction infringes data protection law, it informs the controller without undue delay. It is entitled to suspend execution of the instruction until it is confirmed or amended.
Confidentiality: the processor binds the persons authorised to process the data — including any external experts engaged — to confidentiality, unless they are already subject to an appropriate statutory duty of confidentiality.
Security of processing: the processor implements the technical and organisational measures required under Art. 32 GDPR; these are described in the section “Technical and Organisational Measures” at the end of this DPA.
Support: the processor supports the controller, to a reasonable extent, in safeguarding data subject rights (§ 8), in reporting data breaches (§ 6), in data protection impact assessments (§ 7) and in meeting accountability obligations.
The processor notifies the controller of any personal data breach that comes to its attention without undue delay, and at the latest within 48 hours of becoming aware of it.
The notification contains, to the extent available, the information required under Art. 33(3) GDPR. The processor supports the controller in meeting its notification and communication obligations under Art. 33 and 34 GDPR.
Upon request and to a reasonable extent, the processor supports the controller in any data protection impact assessments (Art. 35 GDPR) and prior consultations with the supervisory authority (Art. 36 GDPR), insofar as the processing carried out on the controller’s behalf is affected.
The processor supports the controller with appropriate technical and organisational measures in responding to data subject requests for access, rectification, erasure, restriction of processing, data portability and objection.
If a data subject contacts the processor directly, the processor forwards the request to the controller without undue delay and does not respond to it itself.
After the end of the processing, the processor deletes the personal data at the controller’s choice or returns it, unless a statutory retention obligation requires continued storage.
Deletion of individual candidates is available at any time from the application (immediate hard deletion of the database rows and associated documents). Data not restored is permanently and irreversibly removed by an automatic deletion job after the 30-day recovery window expires.
Existing backups are overwritten within the regular rotation cycles.
The controller grants the processor general authorisation to engage further processors (sub-processors). The sub-processors engaged at the time of conclusion of the contract are listed below.
The processor informs the controller at least 30 days in advance, in text form, of the intended addition or replacement of a sub-processor. The controller may object to such a change within this period on important data protection grounds. In the event of a justified objection, either party may extraordinarily terminate the affected part of the services or the main contract.
The processor contractually binds every sub-processor to a level of data protection equivalent to the requirements of this DPA. All sub-processors process exclusively within the EU/EEA.
The processor provides the controller with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, primarily through suitable documentation, attestations or certificates — including those of the sub-processors engaged.
Beyond that, the controller may carry out on-site audits after reasonable prior notice, during normal business hours, without disrupting operations and generally no more than once a year, itself or through a third party bound to confidentiality. The controller bears the reasonable costs thereby incurred at the processor.
The liability of the parties is governed by the provisions of the main contract and the mandatory rules of Art. 82 GDPR.
The law of the Federal Republic of Germany applies, excluding its conflict-of-law rules.
Amendments and additions to this DPA require text form; this also applies to the waiver of this text-form requirement.
Should individual provisions of this DPA be or become wholly or partially invalid, the validity of the remaining provisions remains unaffected.
Last updated: August 2026 · IT Titans Software GmbH · Am Emsdeich 48 · 26789 Leer · Germany.
Physical, system and data access control: the application runs on hardened cloud services within the EU/EEA. Access to personal data is restricted to authorised persons and system services; at the database level, separate roles with minimal privileges (least privilege) apply.
Tenant isolation: the data of different clients is strictly logically separated. At the database level, row-level security ensures that every query processes only the data of the respective organisation.
Authentication and access security: access is via personal user accounts with email verification and a password. Login attempts are rate-limited, sessions are time-limited, and logins are recorded.
Encryption: data is transmitted with transport encryption (TLS). The database and uploaded documents are stored encrypted at rest by the cloud services used.
Integrity and traceability: security-relevant events — including logins, role and membership changes, and deletions — are recorded in an audit log.
Availability and resilience: the database has automatic backups with recoverability. Operational monitoring and error diagnostics use telemetry scrubbed of personal data.
Deletion concept: personal data is permanently and irreversibly deleted on instruction or after the recovery window expires (see § 9).
Commissioning and transfer control: sub-processors are carefully selected, contractually bound under Art. 28 GDPR, and engaged exclusively within the EU/EEA.
| Service | Purpose | Region | Legal basis |
|---|---|---|---|
| Microsoft Azure Database for PostgreSQL | Database hosting (candidate and organisation data) | West Europe (Netherlands) | Art. 28 GDPR (data processing agreement) |
| Microsoft Azure Blob Storage | Storage of uploaded CVs and documents | West Europe (Netherlands) | Art. 28 GDPR (data processing agreement) |
| Microsoft Azure Application Insights | Operational telemetry and error diagnostics (PII-scrubbed) | Germany North (Berlin) | Art. 28 GDPR (data processing agreement) |
| Brevo (Sendinblue SAS) | Transactional email delivery | EU (France) | Art. 28 GDPR (data processing agreement) |
| Stripe Payments Europe, Limited | Payment processing and invoicing (billing) | EU (Ireland); transfers to third countries within the group are based on the EU standard contractual clauses | Art. 28 GDPR (data processing agreement) |