1import{j as e}from"./ui-U4ga2LeI.js";import{H as t}from"./main-SXAlwI8d.js";import{g as a}from"./surface-DWeJ3_Eu.js";import{B as i,a as n,b as s,c as r}from"./breadcrumb-BF69iKXy.js";import"./vendor-DYACTBzZ.js";import"./index-Jlhb9WXm.js";const x=()=>e.jsxs("div",{className:"min-h-screen",style:a,children:[e.jsx(t,{}),e.jsxs("main",{className:"max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 pt-24 pb-16",children:[e.jsx(i,{className:"mb-8",children:e.jsxs(n,{children:[e.jsx(s,{children:e.jsx(r,{href:"/",children:"Home"})}),e.jsx(s,{children:e.jsx(r,{href:"/privacy",children:"Privacy Policy"})}),e.jsx(s,{children:e.jsx(r,{children:"Data Processing Agreement"})})]})}),e.jsxs("div",{className:"prose max-w-none",children:[e.jsx("h1",{className:"text-4xl font-bold text-gray-dark mb-8",children:"Enterprise Data Processing Agreement (DPA) and Sub-Processor Disclosure"}),e.jsx("p",{className:"text-sm text-gray-medium mb-8",children:"Last updated: July 9, 2026"}),e.jsxs("section",{className:"mb-8",children:[e.jsxs("p",{className:"text-gray-medium mb-4",children:["This ",e.jsx("strong",{children:'Data Processing Agreement ("DPA")'})," is automatically incorporated into the"," ",e.jsx("strong",{children:'Terms of Service ("ToS")'})," and applies to all users of Talendary's platform, including those who connect external systems via API integrations."]}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["By using Talendary's services or enabling an integration, the"," ",e.jsx("strong",{children:'client entity ("Controller")'})," agrees to this DPA, which governs the processing of personal data under applicable data protection laws, including:"]}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["The ",e.jsx("strong",{children:"General Data Protection Regulation (GDPR)"})," (EU 2016/679)"]}),e.jsxs("li",{children:["Swedish ",e.jsx("strong",{children:"data protection regulations"})]})]}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["This DPA ensures compliance with data protection laws and outlines the rights and obligations of both"," ",e.jsx("strong",{children:'Talendary AB ("Processor")'})," and the ",e.jsx("strong",{children:"Controller"}),"."]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"1. Definitions"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"For the purposes of this DPA, the following definitions apply:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:'"Personal Data"'})," - Any information relating to an identified or identifiable natural person."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Processing"'})," - Any operation performed on personal data, such as collection, storage, alteration, retrieval, use, disclosure, or deletion."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Controller"'})," - The entity that determines the purposes and means of processing personal data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Processor"'})," - Talendary AB, which processes personal data on behalf of the Controller."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Sub-Processor"'})," - A third party engaged by Talendary AB to process personal data as part of the services."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Data Subject"'})," - An individual whose personal data is processed."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Supervisory Authority"'})," - A public authority responsible for monitoring compliance with data protection laws (e.g., Datainspektionen in Sweden)."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"2. Roles and Responsibilities"}),e.jsx("h3",{className:"text-xl font-semibold text-gray-dark mb-3",children:"2.1 Controller Responsibilities"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["The ",e.jsx("strong",{children:"Controller"})," is responsible for:"]}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["Ensuring it has a ",e.jsx("strong",{children:"lawful basis"})," for processing personal data."]}),e.jsxs("li",{children:["Providing ",e.jsx("strong",{children:"data subjects with necessary privacy notices"})," and obtaining consent where required."]}
1),e.jsx("li",{children:"Ensuring data processed through Talendary's services complies with GDPR and other applicable laws."})]}),e.jsx("h3",{className:"text-xl font-semibold text-gray-dark mb-3",children:"2.2 Processor Responsibilities"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["Talendary AB acts as a ",e.jsx("strong",{children:"Processor"})," and agrees to:"]}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["Process personal data ",e.jsx("strong",{children:"exclusively under the documented instructions"})," of the Controller."]}),e.jsxs("li",{children:["Implement ",e.jsx("strong",{children:"appropriate technical and organizational measures"})," to ensure data security."]}),e.jsxs("li",{children:["Assist the Controller in responding to ",e.jsx("strong",{children:"data subject requests"})," under GDPR."]})]}),e.jsx("h3",{className:"text-xl font-semibold text-gray-dark mb-3",children:"2.3 Reseller-Facilitated Onboarding"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"Where a Controller is onboarded through a Talendary-authorized reseller, this DPA applies directly between Talendary (as Processor) and the Controller. The reseller is not a party to this DPA and does not determine the purposes or means of processing personal data. The Controller accepts this DPA through any acceptance mechanism made available by Talendary, and the individual accepting confirms they are authorized to bind the Controller."})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"3. Data Processing Scope"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["Talendary AB processes personal data ",e.jsx("strong",{children:"strictly under the instructions of the Controller"}),", in accordance with GDPR and applicable data protection laws. Processing is limited to data provided within the platform or through supported integrations. Talendary does not access, monitor, or collect data from browser sessions, background tabs, or external applications."]}),e.jsx("p",{className:"text-gray-medium mb-4",children:"Talendary agrees to:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Process personal data only as necessary"})," to deliver its services and as instructed by the Controller."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Implement appropriate technical and organizational measures"})," to protect personal data from unauthorized access, loss, or misuse."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Support the Controller in fulfilling GDPR obligations"}),", including responding to data subject requests (e.g., access, correction, or deletion)."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Ensure that any data retained or processed aligns with the retention policies"})," agreed upon in this DPA."]})]}),e.jsx("h3",{className:"text-xl font-semibold text-gray-dark mb-3 mt-6",children:"Data Processing Limitations"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["Talendary ",e.jsx("strong",{children:"does not use personal data for AI model training"})," or for any purpose beyond delivering its recruitment-related services."]}),e.jsxs("li",{children:["Processed data will be ",e.jsx("strong",{children:"deleted or returned"})," at the ",e.jsx("strong",{children:"Controller's request"})," or upon contract termination, unless required by law."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"4. Sub-Processor Engagement"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["To provide its services, Talendary may engage ",e.jsx("strong",{children:"approved sub-processors"})," for specific functions, such as ",e.jsx("strong",{children:"data storage, cloud computing, and AI-enhanced processing"}),"."]}),e.jsx("p",{className:"text-gray-medium mb-4",children:"Talendary ensures that all sub-processors:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["Are contractually bound by ",e.jsx("strong",{children:"GDPR-compliant data protection obligations"}),"."]}),e.jsxs("li",{children:["Implement ",e.jsx("strong",{children:"appropriate security measures"})," in line with this DPA."]}),e.jsx("li",{children:"Only process data as necessary to provide their respective services."})]}),e.jsx("h3",{className:"text-xl font-semibold text-gray-dark mb-3",children:"4.1 Approved Sub-Processors"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"The Controller hereby provides general authorization for the use of the sub-processors listed in this section."}),e.jsx("div",{className:"overflow-x-auto mb-4",children:e.jsxs("table",{className:"min-w-full border-collapse border border-gray-200",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"bg-gray-50",children:[e.jsx("th",{className:"border border-gray-200 px-4 py-2 text-left text-sm font-semibold text-gray-dark",children:"Sub-Processor"}),e.jsx("th",{className:"border border-gray-200 px-4 py-2 text-left text-sm font-semibold text-gray-dark",children:"Service Provided"}),e.jsx("th",{className:"border border-gray-200 px-4 py-2 text-left text-sm font-semibold text-gray-dark",children:"Location"}),e.jsx("th",{className:"border border-gray-200 px-4 py-2 text-left text-sm font-semibold text-gray-dark",children:"Safeguards (if outside EU/EEA)"})]})}),e.jsxs("tbody",{children:[e.jsxs("tr",{children:[e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Render"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Database Storage"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"EU/EEA"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Compliant with GDPR and SCCs"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Supabase"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Database Storage & Authentication"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"EU/EEA"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Compliant with GDPR and SCCs"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Microsoft Azure"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"AI Hosting & Cloud Infrastru
1cture"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"EU/EEA"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Compliant with GDPR and SCCs"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Google Cloud (GCP)"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"AI Hosting & Cloud Infrastructure"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"EU/EEA"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Compliant with GDPR and SCCs"})]}),e.jsxs("tr",{children:[e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Mixpanel"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"User Analytics"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"EU/EEA"}),e.jsx("td",{className:"border border-gray-200 px-4 py-2 text-sm text-gray-medium",children:"Compliant with GDPR and SCCs"})]})]})]})}),e.jsx("h3",{className:"text-xl font-semibold text-gray-dark mb-3",children:"4.2 Sub-Processor Changes"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["The Controller will be ",e.jsx("strong",{children:"notified in advance of any significant changes"})," to sub-processors."]}),e.jsxs("li",{children:["If a new sub-processor is added, Talendary will ensure they meet GDPR compliance standards"," ",e.jsx("strong",{children:"before processing any personal data"}),"."]}),e.jsxs("li",{children:["The Controller may object to a new sub-processor ",e.jsx("strong",{children:"on reasonable data protection grounds"}),"."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"5. Data Subject Rights"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["Talendary AB will assist the ",e.jsx("strong",{children:"Controller"})," in fulfilling its obligations under GDPR regarding data subject rights. This includes:"]}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Access Requests:"})," Providing individuals access to their personal data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Correction Requests:"})," Allowing rectification of inaccurate or incomplete data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'Deletion Requests ("Right to be Forgotten")'})," - Ensuring data erasure when legally required."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Objection & Restriction Requests:"})," Enabling users to object to processing or request processing limitations."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Data Portability Requests:"})," Supporting structured, machine-readable data transfers."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Data Breach Notifications:"})," Informing the Controller ",e.jsx("strong",{children:"without undue delay and no later than 72 hours"})," after becoming aware of a personal data breach."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"6. Security Measures"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["Talendary AB implements ",e.jsx("strong",{children:"industry-standard security measures"})," to protect personal data from unauthorized access, alteration, or loss. These measures include:"]}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Data Encryption"})," - Personal data is encrypted ",e.jsx("strong",{children:"both in transit and at rest"}),"."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Access Controls & Authentication"})," - Multi-layered authentication and role-based access."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Data Minimization"})," - Processing only necessary data to fulfill the intended purpose."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Secure Data Backups & Disaster Recovery"})," - Regular data backups with redundancy."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Ongoing Security Assessments"}
1)," - Regular penetration testing and vulnerability scans."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Incident Response Plan"})," - A defined process to detect, contain, and mitigate security threats."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"7. Data Transfers"}),e.jsxs("p",{className:"text-gray-medium mb-4",children:["Talendary AB stores all personal data ",e.jsx("strong",{children:"within the European Union (EU)/European Economic Area (EEA)"}),"."]}),e.jsx("p",{className:"text-gray-medium mb-4",children:"If any data processing occurs outside the EU/EEA, Talendary ensures that:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["Transfers are conducted ",e.jsx("strong",{children:"under the European Commission's Standard Contractual Clauses (SCCs)"})," ","or other approved legal mechanisms."]}),e.jsxs("li",{children:["Appropriate safeguards are in place ",e.jsx("strong",{children:"to maintain compliance with GDPR"}),"."]}),e.jsxs("li",{children:["The Controller is ",e.jsx("strong",{children:"notified if a new transfer mechanism is adopted"})," that materially affects data protection."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"8. Audit Rights"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"The Controller may request an audit of Talendary's data processing practices to verify compliance with this DPA and applicable data protection laws."}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["Audits may be requested ",e.jsx("strong",{children:"once per year"})," with ",e.jsx("strong",{children:"30 days' written notice"}),"."]}),e.jsxs("li",{children:["Audits will be ",e.jsx("strong",{children:"limited to document-based reviews"})," unless a material compliance issue is identified."]}),e.jsxs("li",{children:["The audit must be conducted in a manner that ",e.jsx("strong",{children:"minimizes disruption"})," to business operations."]}),e.jsxs("li",{children:["Each party will bear its own costs ",e.jsx("strong",{children:"unless a material GDPR violation is discovered"}),"."]}),e.jsxs("li",{children:["If an external auditor is used, the auditor must ",e.jsx("strong",{children:"agree to confidentiality obligations"}),"."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"9. Liability and Indemnities"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"To the extent the parties' liability is not governed by applicable data protection laws, including the GDPR:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Talendary's liability"})," is limited to ",e.jsx("strong",{children:"direct damages"})," resulting from its own non-compliance with this DPA."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Talendary is not liable"})," for:",e.jsxs("ul",{className:"list-disc pl-6 mt-2 mb-0",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Customer misuse of the platform"}),", including processing personal data without a lawful basis."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Actions of third-party services"})," integrated by the Controller."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Indirect, consequential, or incidental damages"}),", including loss of business, profits, or reputational harm."]})]})]}),e.jsxs("li",{children:["The ",e.jsx("strong",{children:"Controller is solely responsible"})," for ensuring it has a ",e.jsx("strong",{children:"lawful basis"})," for processing personal data and obtaining necessary consents from data subjects."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"10. Termination and Data Return"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"Upon termination of the agreement, Talendary will:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Automatically delete all personal data within 30 days"}),", unless otherwise required by law or contractual obligations."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Provide a written confirmation of data deletion"})," upon request."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Offer a data export option"}
1)," before deletion, if requested by the Controller within the 30-day period."]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"11. Contact Information"}),e.jsx("p",{className:"text-gray-medium mb-4",children:"For any questions related to this DPA or data protection practices, please contact:"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Data Protection Officer (DPO):"})," André Nilsson"]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Email:"})," ",e.jsx("a",{href:"mailto:[email protected]",className:"text-primary hover:underline",children:"[email protected]"})]})]})]}),e.jsxs("section",{className:"mb-8",children:[e.jsx("h2",{className:"text-2xl font-semibold text-gray-dark mb-4",children:"12. Legal Basis & Incorporation"}),e.jsxs("ul",{className:"list-disc pl-6 text-gray-medium mb-4",children:[e.jsxs("li",{children:["This DPA is governed by the ",e.jsx("strong",{children:"laws of Sweden"})," and complies with GDPR and all relevant Swedish and EU data protection regulations."]}),e.jsxs("li",{children:["By using Talendary's Services, the Controller ",e.jsx("strong",{children:"agrees to this DPA"}),", which is incorporated into our ",e.jsx("strong",{children:"Terms of Service"})," and ",e.jsx("strong",{children:"Privacy Policy"}),"."]}),e.jsxs("li",{children:["The latest version of this DPA is always available at:"," ",e.jsx("a",{href:"https://dpa.talendary.com",className:"text-primary hover:underline",children:"dpa.talendary.com"})]}),e.jsxs("li",{children:["Talendary reserves the right to update this DPA ",e.jsx("strong",{children:"in compliance with legal and regulatory requirements"}),". If required by law, updates ",e.jsx("strong",{children:"may take effect immediately"}),", with prior notice where feasible."]})]})]})]})]})]});export{x as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.