https://www.workable.com/_next/static/chunks/pages/legal/data-protection-cb86147d813c47b9.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[8734],{10264:(e,t,r)=>{"use strict";r.d(t,{A:()=>m});var s=r(37876),i=r(14232),a=r(95062),o=r.n(a),n=r(45105),l=r.n(n),c=r(64289),d=r(15039),h=r.n(d);let u={formId:o().string.isRequired,className:o().string,formLoadingErrorMessage:o().object},p=e=>{let{formId:t,className:r}=e,{formLoadingErrorMessage:a}=e,o={...e};delete o.formLoadingErrorMessage;let[n,d]=(0,i.useState)(0);return 2===n?(0,s.jsx)("div",{id:`HubSpotForm${t}`,className:"form-loading-error",children:(0,s.jsx)(c.P,{children:a??"An error occurred while loading the form. Please try again later."})}):(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(l(),{id:"hubspot-script",src:"https://js.hsforms.net/forms/v2.js",strategy:"afterInteractive",onReady:()=>{"hbspt"in window&&(window.hbspt.forms.create({...o,target:`#HubSpotForm${t}`}),d(1))},onError:()=>{d(2)}}),(0,s.jsx)("div",{className:h()(r,"hs-form-loading"),id:`HubSpotForm${t}`,children:(0,s.jsx)("p",{children:"Loading..."})})]})};p.propTypes=u;let m=p},17053:(e,t,r)=>{"use strict";r.d(t,{$r:()=>a,TV:()=>i});var s=r(29454);let i=(e,t,r,s)=>{let i=new Date;i.setTime(i.getTime()+r),document.cookie=`${e}=${t};expires=${i.toUTCString()};domain=${s};path=/`},a=e=>{let t=s.A.get("__hs_opt_out");if(!t||"no"===t)return s.A.get(e);return null}},30581:(e,t,r)=>{"use strict";r.d(t,{A:()=>o});var s=r(17053),i=r(38837),a=r(30652);class o{static handleFormSubmit(e){let t=document.querySelector(`[data-form-id='${e}']`);t&&t.addEventListener("submit",()=>{let e,r;e=0,r=setInterval(()=>{e+=1,(()=>null!==t.querySelector(".hs-form-field .hs-error-msg"))()&&((()=>{let e=t.querySelectorAll(".hs-form-field"),r=[];[].forEach.call(e,e=>{let t=e.querySelector(".hs-error-msg"),s=e.querySelector("input, select");if(s&&t){let e=`${s.getAttribute("name")?s.getAttribute("name"):s.getAttribute("id")} : ${t.innerText}`;r.push(e)}}),r.length>0&&(0,a.UZ)("demoSubmitError",{demoErrorName:r.join(" , ")})})(),clearInterval(r)),e>=15&&clearInterval(r)},150)})}static handleInputFocus(e){Array.from(document.querySelectorAll(`[data-form-id="${e}"] .hs-form-field`)).forEach(e=>{let t=e.querySelectorAll(".hs-input"),r=e.querySelector("label"),s=()=>{r&&r.offsetHeight>=36&&e.classList.add("hs-field-expanded")};Array.from(t).forEach(t=>{"SELECT"===t.nodeName&&(t.querySelector("option:first-child").innerHTML=""),("checkbox"===t.getAttribute("type")&&t.checked||"checkbox"!==t.getAttribute("type")&&""!==t.value)&&e.classList.add("focused"),s(),t.onfocus=()=>{e.classList.add("focused"),s()},t.onblur=()=>{""===t.value&&e.classList.remove("focused")},t.onchange=s})})}static populateGCLIDValue(){let e=document.querySelectorAll('input[name="gclid"]');if(e){let t=(0,s.$r)("_gcl_aw");if(t){let r=t.split("."),s=r[r.length-1];e.forEach(e=>{e.setAttribute("data-gclid",""),e.setAttribute("value",s)})}}}static populateMetroValue(){let e=document.querySelectorAll('input[name="metro_visitor_id__c"]');if(e){let t=(0,s.$r)("wmc");if(t){let{cookie_id:r=""}=JSON.parse(t);e.forEach(e=>{e.setAttribute("value",r)})}}}static populateCompanyFromEmailInBForm(e){let t=document.querySelector(`[data-form-id='${e}']`),r=t.querySelector('input[name="email"]'),s=t.querySelector('input[name="company"][type="hidden"]');r&&s&&r.addEventListener("change",()=>{let e=r.value.split("@");e.length>1&&(s.value=`${e[1]}[VariantB]`)})}static handleFormError(){setTimeout(()=>{let e=document.querySelectorAll(".hs-error-msgs li");if(window.innerWidth<992&&e.length){let t=e[0].getBoundingClientRect().top+window.scrollY-200;window.scrollTo({top:t,behavior:"smooth"})}},50)}static handleFormReady(){let e=document.querySelector(".hs-custom-style");e&&e.classList.remove("hs-custom-style")}static handleDemoFormReady(e){o.handleInputFocus(e),o.handleFormSubmit(e),o.populateCompanyFromEmailInBForm(e),o.populateGCLIDValue(),o.populateMetroValue(),(0,i.o)(e)}}},38837:(e,t,r)=>{"use strict";r.d(t,{o:()=>h});let s=(e,t)=>{let r=document.createElement("li"),s=e.querySelector(".hs-input"),i=document.createElement("ul");s.classList.add("invalid","error"),r.innerHTML=`<li><label class="hs-error-msg hs-main-font-element">${t}</label></li>`,i.classList.add("no-list","hs-error-msgs","inputs-list","custom-list"),i.setAttribute("role","alert"),i.appendChild(r),e.a

1ppendChild(i)},i=e=>{let t=e.querySelectorAll(".hs-error-msgs.custom-list");e.querySelector(".hs-input").classList.remove("invalid","error"),t.length&&t.forEach(e=>e?e.remove():null)};var a=r(30652),o=r(5068);let n="Please enter a valid email address.",l="invalid",c="valid",d="validating",h=e=>{let t=document.querySelector(`[data-form-id='${e}']`),r=t.querySelector('input[name="email"]'),h=t.querySelector(".hs_email"),u=t.querySelector('input[name="email_validity"]'),p=t.querySelector('input[type="submit"]'),m=c,f="",b=null,g=!1,x=()=>{m=c,i(h),g&&p.click()};p.addEventListener("click",e=>{let t=r.value;if(m===d&&(g=!0,b=setTimeout(()=>x(),2200)),m===c&&f!==t||m===d||m===l)return e.preventDefault();if(m===l){let e;s(h,n),(e=h.querySelectorAll(".hs-error-msgs:not(.custom-list)")).length&&e.forEach(e=>e?e.remove():null)}}),r.addEventListener("change",e=>(()=>{let e=r.value;/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)&&m!==d&&(i(h),f=e,m=d,o.A.post("https://bpi.briteverify.com/api/public/v1/fullverify",{email:e},{headers:{"Content-Type":"application/json",Authorization:"ApiKey: bfaa9f84-4ebd-4ec4-a4b0-dd2a65aceb92"}}).then(e=>{if(e.data?.email){let{status:t}=e.data.email;if(u&&(u.value=t),(0,a.UZ)("emailValidation",{emailStatus:t}),i(h),"invalid"===t)return void(m=l,i(h),s(h,n))}return x()}).catch(e=>((0,a.xk)(e),x())).finally(()=>{g=!1,b&&clearTimeout(b)}))})())}},45105:(e,t,r)=>{e.exports=r(13209)},56896:(e,t,r)=>{"use strict";r.d(t,{TD:()=>d,TH:()=>l,TR:()=>c,X:()=>n,v:()=>

1o});var s=r(37876),i=r(22287),a=r(35687);let o=e=>(0,s.jsx)("tbody",{...e}),n=e=>(0,s.jsx)("table",{...e}),l=(0,i.X)(e=>(0,s.jsx)("th",{...e}),"th"),c=(0,a.gu)((0,i.X)(e=>(0,s.jsx)("tr",{...e}),"tr")),d=(0,a.uH)((0,i.X)(e=>(0,s.jsx)("td",{...e}),"td"))},58513:(e,t,r)=>{"use strict";r.r(t),r.d(t,{__N_SSG:()=>F,default:()=>H});var s=r(37876),i=r(14232),a=r(15039),o=r.n(a),n=r(89099),l=r(87146),c=r(93126),d=r(86353),h=r(58965),u=r(69396),p=r(35687),m=r(64289),f=r(19128),b=r(56896),g=r(7573),x=r(80487),y=r(22523),j=r(82276),v=r(38719),w=r(3855),P=r(62383),C=r(44044);let A=[{text:"Data Processing Addendum",value:"data-processing-addendum",child:!0},{text:"CCPA/CPRA Data Processing Addendum",value:"CCPA/CPRA",child:!0},{text:"Sub-processors List",value:"sub-processors",child:!1,routerPushUrl:"/subprocessors"},{text:"Technical and Organisational Security Measures",value:"security-measures",child:!0}];var S=r(19721),T=r(65036),D=r.n(T);let k=(0,x.wO)((0,g.gv)("div")),I=(0,x.qn)("div"),E=(0,p.gu)("span"),W=(0,g.Lv)(m.H2),q=(0,g.um)("div"),U=(0,p.di)(m.Sd),R=(0,p.di)(m.P),L=(0,p.gu)(m.H5),M=e=>(0,s.jsx)(f.u_,{...e}),N=e=>(0,s.jsx)(f.pS,{...e});var F=!0;let H=(0,c.A)(()=>{let e=(0,n.useRouter)(),t=(0,i.useRef)(),[r,a]=(0,i.useState)("data-processing-addendum"),[c,p]=(0,i.useState)(!1);(0,i.useEffect)(()=>{(0,S.nQ)(r,a,e)},[]),(0,i.useEffect)(()=>{(0,S.vr)(t,p)},[]);let f=(0,y.A)({desktop:()=>(0,s.jsx)(P.A,{activeTab:r,title:"Data Protection",tabItems:A,setActiveTab:a,router:e}),mobile:()=>(0,s.jsx)("div",{ref:t,className:o()(c?D()["legal-dropdown-fixed"]:D()["legal-dropdown"],"no-print"),children:(0,s.jsx)(w.A,{name:"data-protection",defaultValue:r,variant:"green800",values:A,onChange:t=>(0,S.QY)(t,e,a)})})}),g=[{title:"Definitions",urlCopy:"#definitions"},{title:"Data processing",urlCopy:"#data-processing"},{title:"Security",urlCopy:"#security"},{title:"Sub-processing",urlCopy:"#sub-processing"},{title:"Transfer of personal data outside the EEA and the UK",urlC

1opy:"#transfer-personal-data"},{title:"Liability",urlCopy:"#liability"},{title:"Term",urlCopy:"#term"},{title:"Dispute resolution",urlCopy:"#dispute-resolution"},{title:"Conflict",urlCopy:"#conflict"},{title:"Updates",urlCopy:"#updates"},{title:"Exhibit A",urlCopy:"#exhibit-a"},{title:"Exhibit B",urlCopy:"#exhibit-b"},{title:"Exhibit C",urlCopy:"#exhibit-c"}],x=()=>(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(W,{children:" Data Processing Addendum"}),(0,s.jsx)(q,{children:(0,s.jsx)(u.A,{onClick:S.sE,variant:"secondary-no-gradient-download",className:"no-print",children:"Download"})}),(0,s.jsx)("div",{className:o()(D()["table-of-contents"],"no-print"),children:(0,s.jsx)("ol",{children:g.map((e,t)=>(0,s.jsx)("li",{children:(0,s.jsx)(u.A,{href:e.urlCopy,variant:"green800",children:e.title})},t))})}),(0,s.jsxs)(m.P,{children:["This Data Processing Addendum (“",(0,s.jsx)(E,{children:"Addendum"}),"”) is incorporated into the agreement(s) between the customer (“",(0,s.jsx)(E,{children:"Customer"}),"” or “",(0,s.jsx)(E,{children:"Controller"}),"”) and the Workable entity contracting with the Customer (“",(0,s.jsx)(E,{children:"Workable"}),"” or “",(0,s.jsx)(E,{children:"Processor"}),"”) for the Customer’s use of the Services (“",(0,s.jsx)(E,{children:"Agreement"}),"”)."]}),(0,s.jsxs)(m.P,{children:["This Addendum forms part of and is subject to all provisions of the terms available at workable.com/terms (“",(0,s.jsx)(E,{children:"Terms"}),"”), or other agreements between the Controller and Processor governing the Controller’s use of the Services."]}),(0,s.jsx)(m.P,{children:"The Controller enters this Addendum on behalf of itself and, to the extent required under applicable Data Protection Laws (defined below), in the name and on behalf of its Affiliates (defined below), if authorized by Workable, acting as a Controller. For clarity, Customer’s Affiliates are permitted to use the Services pursuant to the Agreement but have not signed their separate agreement. All access to and use of the Services by the Affiliates must comply with the terms and conditions of this Addendum and any violation of the terms of this Addendum by an Affiliate shall be deemed a violation by the Controller."}),(0,s.jsx)(m.P,{children:"If a Customer has signed a Data Processing Agreement with a Workable entity or has negotiated specific data protection terms in their Workable Quote, this separate agreement shall prevail over this Addendum."}),(0,s.jsxs)(N,{className:D()["scroll-mg-t"],children:[(0,s.jsxs)("li",{id:"definitions",children:[(0,s.jsx)(m.H4,{children:"Definitions"}),(0,s.jsxs)(N,{children:[(0,s.jsxs)("li",{children:['"',(0,s.jsx)(E,{children:"Affiliate"}),'" means (i) an entity of which a party directly or indirectly owns fifty percent (50%) or more of the stock or other equity interest, (ii) an entity that owns at least fifty percent (50%) or more of the stock or other equity interest of a party, or (iii) an entity which is under common control with a party by having at least fifty percent (50%) or more of the stock or other equity interest of such entity and a party owned by the same person, but such entity shall only be deemed to be an Affiliate so long as such ownership exists.']}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Agreement"}),'" means the Workable quote or acceptance of the online Terms of Use, whichever is applicable.']}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Customer"}),"” means the entity identified in the online order form or the Work

1able Quote, as applicable."]}),(0,s.jsxs)("li",{children:['"',(0,s.jsx)(E,{children:"Data Privacy Framework"}),'" means the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce; as may be amended, superseded, or replaced.']}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Data Protection Laws"}),"” means any applicable laws and regulations in any relevant jurisdiction relating to the use or processing of Personal Data including: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) (“",(0,s.jsx)(E,{children:"EU GDPR"}),"” or “",(0,s.jsx)(E,{children:"GDPR"}),"”), (ii) the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “",(0,s.jsx)(E,{children:"UK GDPR"}),"”); (iii) the UK Data Protection Act 2018; (iv) the Privacy and Electronic Communications (EC Directive) Regulations 2003; and (v) the revised Federal Act on Data Protection (Switzerland) (the “",(0,s.jsx)(E,{children:"FDAP"}),"”); in each case, as updated, amended or replaced from time to time. The terms “",(0,s.jsx)(E,{children:"Data Subject"}),"”, “",(0,s.jsx)(E,{children:"Personal Data"}),"”, “",(0,s.jsx)(E,{children:"Personal Data Breach"}),"”, “",(0,s.jsx)(E,{children:"processing"}),"”, “",(0,s.jsx)(E,{children:"processor"}),",” “",(0,s.jsx)(E,{children:"controller"}),",” and “",(0,s.jsx)(E,{children:"supervisory authority"}),"” shall have the meanings set forth in the GDPR."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Data Subject"}),"” means a natural person who can be identified, directly or indirectly, by the Personal Data."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"EU SCCs"}),"” means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of personal data to countries not otherwise recognized as offering an adequate level of protection for personal data by the European Commission (as amended and updated from time to time)."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Instructions"}),"” means the Controller’s lawful and reasonable instructions for the Processing of Personal Data as indicated herein, by the Controller’s use of the Service or in writing by the Controller to the Processor;"]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Personal Data"}),"” means any information relating to an identified or identifiable natural person, including an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Processing"}),"” or “",(0,s.jsx)(E,{children:"to Process"}),"” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"SCCs"}),"” means i) the EU SCCs, where the GDPR applies, ii) the UK Addendum, where the UK GDPR applies."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Services"}),"” shall have the meaning set out in the Terms."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Sub-processor"}),"” means any third party engaged by the Processor, or its Sub-processor, to Process Personal Data on behalf of the Controller."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"UK Addendum"}),"” means the International Transfer Addendum or Addendum to the EU SCCs for international data transfers issued under Section 119A of the Data Protection Act 2018 and approved by UK Parliament on 21 March 2022."]}),(0,s.jsxs)("li",{children:["“",(0,s.jsx)(E,{children:"Workable"}

1),"” means the Workable entity as identified in the online order form or the Workable Quote, as applicable."]})]})]}),(0,s.jsxs)("li",{id:"data-processing",children:[(0,s.jsx)(m.H4,{children:"Data processing"}),(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"The Processor agrees to comply with Data Protection Law, and with any other applicable law to the extent it is not in conflict with Data Protection Law."}),(0,s.jsxs)("li",{children:["The Processor shall only Process the Personal Data in accordance with the Controller’s Instructions."," "]}),(0,s.jsxs)("li",{children:["Notwithstanding any other provision of this Addendum, if the law in the United Kingdom, EU or any EU member state requires the Processor to conduct Processing of the Personal Data other than in accordance with the Controller’s Instructions, such Processing shall not constitute a breach of this Addendum. The Processor shall inform the Controller of such legal requirements before carrying out such Processing unless such notification is prohibited by applicable law on important grounds of public interest. The Processor shall immediately inform the Controller if, in its opinion, an Instruction infringes Data Protection Law."," "]}),(0,s.jsx)("li",{children:"The Processor shall enable the Controller to access, rectify, erase, restrict and transmit the Personal Data Processed by the Processor. The Processor shall comply with any requests by the Controller related to the above without undue delay and in any event within 30 calendar days."}),(0,s.jsx)("li",{children:"The Processor shall notify the Controller without undue delay as to any contacts with a supervisory authority, concerning or of significance for, the Processing of Personal Data carried out on behalf of the Controller. The Processor may not represent the Controller, nor act on the Controller’s behalf, against any supervisory authority or other third party."}),(0,s.jsx)("li",{children:"The Processor shall assist the Controller in its contacts with any supervisory authority, including, upon the Controller’s instruction, by providing any information requested by the supervisory authority. For the avoidance of doubt, the Processor may not disclose Personal Data or any information on the Processing of Personal Data without the consent of the Controller."}),(0,s.jsx)("li",{children:"If a Data Subject requests information from the Processor concerning the Processing of Personal Data, the Data Subject shall be instructed to address the request to the Controller and the Processor shall assist the Controller in responding to such request as obliged by Data Protection Law. The Processor shall use appropriate technical and organisational measures to assist the Controller by, taking into account the nature of the Processing."}),(0,s.jsx)("li",{children:"In the event that a Data Subject has requested from the Customer to permanently delete all their data, and the Customer has not done so within a reasonable time, and has not notified Workable of any requirement of the Customer for Workable to retain the personal data, Workable reserves the right to remove such personal data and shall not be liable in any way for any loss or damage suffered by Customer arising from such Candidate exercising their rights."}),(0,s.jsx)("li",{children:"The Processor shall impose adequate contractual obligations regarding confidentiality and security upon its personnel which have been authorised to Process Personal Data."}),(0,s.jsxs)("li",{children:["The Processor shall provide reasonable assistance to enable the Controller to comply with the Controller’s obligations under Data Protection Law, e.g., assist with security measures, data protection impact assessments (including prior consultation), and in situations involving Personal Data breach."," "]}),(0,s.jsx)("li",{children:"The Processor shall maintain a record of all Processing activities carried out on behalf of the Controller. Upon the Controller’s request, the Processor shall promptly make the record available to the Controller in a generally readable electronic format."}),(0,s.jsx)("li",{children:"All services, assistance and co-operation provided by the Processor to the Controller, upon Controller’s request, pursuant to this Addendum shall be chargeable at Workable’s then prevailing time and materials rates for professional services or such other charges as may, at the relevant time, be agreed by the parties in writing, unless such request is made by Controller in order to investigate and mitigate the consequences of Processor’s breach of this Addendum or an incident as referred to in Clause 3.2 that has arisen as a result of any breach by the Processor."})]})]}),(0,s.jsxs)("li",{id:"security",children:[(0,s.jsx)(m.H4,{children:"Security"}),(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"The Processor shall implement appropriate technical and organisational security measures to protect the Personal Data in accordance with Data Protection Law. The Processor shall particularly observe the guidelines issued or approved by supervisory authorities."}),(0,s.jsx)("li",{children:"The Processor, to the extent permitted and required by applicable law, shall notify the Controller, in writing, without undue delay after the Processor has become aware of any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data."}),(0,s.jsx)("li",{children:"The Processor must be able to verify its compliance with this Addendum and Data Protection Law and shall maintain adequate documentation verifying the fulfilment of its obligations hereunder. Further, the Controller, or a third party approved by the C

1ontroller, may conduct audits to ensure that the Processor is complying with this Addendum and Data Protection Law. Any such audits will be carried out following the provision of reasonable written notice and not more than once in any twelve (12) month period, unless the Controller is required to in order to fulfil its obligations of Data Protection Law or to comply with a decision imposed against the Controller by a supervisory authority or a competent court of justice. The Processor shall, following the Controller’s request and without undue delay, provide necessary assistance and allow inspection of any relevant documentation and, to the extent such documentation is not deemed sufficient, its Processing facilities. Each Party shall bear its own costs related to the audit."})]})]}),(0,s.jsxs)("li",{id:"sub-processing",children:[(0,s.jsx)(m.H4,{children:"Sub-processing"}),(0,s.jsxs)(N,{children:[(0,s.jsxs)("li",{children:["The Controller acknowledges and agrees that the Processor may engage its Affiliates and the Authorised Sub-processors to access and process Personal Data in connection with the Services. The Controller hereby gives the Processor a general written authorisation to engage Sub-processors to Process the Personal Data of the Controller (“Authorised Sub-processors”). A list of Workable’s current Sub-Processors (the “List”) shall be made available to the Controller at the following link"," ",(0,s.jsx)(u.A,{href:"/subprocessors",variant:"default",children:"https://www.workable.com/subprocessors"}),", via email or through any other means made available to the Controller. The List may be updated by the Processor from time to time. The Processor provides a mechanism to subscribe to notifications concerning updates to the Sub-Processors at the bottom of the Terms of Use Page"," ",(0,s.jsx)(u.A,{href:"https://www.workable.com/terms",variant:"default",children:"(https://www.workable.com/terms)"})," ","and the Controller agrees to subscribe to such notifications where available."]}),(0,s.jsx)("li",{children:"Where Processor intends to add a new Sub-processor it shall make details of such new Sub-processor available on the Website at least 30 days (“Notice Period”) before transferring any personal data to a new Sub-processor. The Controller shall notify the Processor during the Notice Period if it objects to the new Sub-processor. If the Controller does not object to the Sub-processor during the Notice Period, the Controller shall be deemed to have accepted the Sub-processor. If the Controller has raised a reasonable objection to the new Sub-processor and the parties have failed to agree on a solution within the Notice Period, the Controller shall have the right to terminate this Addendum and the Service with a reasonable notice period, without prejudice to any other remedies available under law or contract. During the Notice Period, the Processor shall not transfer any Personal Data to the Sub-processor."}),(0,s.jsx)("li",{children:"The Processor shall enter into appropriate written agreements with all of its Sub-processors on terms substantially similar to this Addendum, including without limitation the Controller’s right to conduct audits at the Sub-processor in accordance with clause 3.3 above or ensure that the Sub-processor will conduct audits using external auditors at least once per year. The Processor shall remain fully liable to the Controller for the performance or non-performance of the Sub-processor’s obligations."}),(0,s.jsx)("li",{children:"Upon the Controller’s request, the Processor is obliged to provide information regarding any Sub-processor, including name, address and the Processing carried out by the Sub-processor."})]})]}),(0,s.jsxs)("li",{id:"transfer-personal-data",children:[(0,s.jsx)(m.H4,{children:"Transfer of personal data outside the EEA and the UK"}),(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"If the Processing carried out by the Processor includes the transfer of Personal Data to a country outside of the EEA or the United Kingdom which is not recognised by the European Commission or the United Kingdom to have an adequate level of protection in accordance with Data Protection Laws, one of the transfer mechanisms described 

1in this clause shall be applicable."}),(0,s.jsx)("li",{children:"Workable participates in and certifies compliance with the Data Privacy Framework. As required by the Data Privacy Framework, Workable (i) provides at least the same level of privacy protection as is required by the Data Privacy Framework Principles; (ii) will notify Customer if Workable makes a determination it can no longer meet its obligation to provide the same level of protection as is required by the Data Privacy Framework Principles, and (iii) will, upon written notice, take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data."}),(0,s.jsxs)("li",{children:["If the Data Privacy Framework does not apply/or is invalidated as a transfer mechanism, the Controller and the Processor agree that such transfer is made pursuant to the EU SCCs Module Two (Controller to Processor), and, if applicable, the UK Addendum, which are deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:",(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"The optional docking clause in Clause 7 does not apply;"}),(0,s.jsxs)("li",{children:["In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be as set forth in clause 4.2 of this Addendum;"," "]}),(0,s.jsx)("li",{children:"In Clause 11, the optional language does not apply;"}),(0,s.jsx)("li",{children:"All square brackets in Clause 13 are hereby removed; "}),(0,s.jsx)("li",{children:"In Clause 17 (Option 1), the EU SCCs will be governed by Greek law;"}),(0,s.jsx)("li",{children:"In Clause 18 (b), disputes will be resolved before the courts of Athens, Greece;"}),(0,s.jsxs)("li",{children:[(0,s.jsx)(E,{children:"Exhibit B"})," to this Addendum contains the information required in Annex I and Annex III of the EU SCCs;"]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(E,{children:"Exhibit C"})," to this Addendum contains the information required in Annex II of the EU SCCs; and"]}),(0,s.jsx)("li",{children:"By entering into this Addendum, the parties are deemed to have signed the EU SCCs incorporated herein, including their Annexes, as of the effective date of the Agreement."})]})]}),(0,s.jsxs)("li",{children:["If Processing of Personal Data under this Addendum includes the transfer of Personal Data, which is processed in accordance with the UK GDPR, the Data Protection Act 2018, from the Data Exporter to the Data Importer (or its premises) outside the United Kingdom (the “UK”), and such transfer is not governed by an adequacy decision made by the UK Government in accordance with the relevant provisions of the UK GDPR and the Data Protection Act 2018, such transfers are made pursuant to Module Two of the EU SCCs, as completed above, and to the UK Addendum, which will be completed as follows:",(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"In Table 1 of the UK Addendum, the Parties’ details and key contact information is located in Exhibit B section 1."}),(0,s.jsx)("li",{children:"In Table 2 of the UK Addendum, information about the version of the Approved EU SCCs, modules and selected clauses which this UK Addendum is appended to is located in clauses 5.1.1 to 5.1.3."}),(0,s.jsx)("li",{children:"In Table 3 of the UK Addendum:"}),(0,s.jsx)("li",{children:"By entering into this Addendum the Parties are deemed to have signed the UK Addendum incorporate herein, including its Annexes."})]})]}),(0,s.jsx)("li",{children:"If and to the extent there is conflict or inconsistency between the EU SCCs or the UK Addendum and any other terms in this Addendum, or the Work

1able Terms, the provisions of the EU SCCs or the UK Addendum, as applicable, shall prevail."}),(0,s.jsx)("li",{children:"If the Processing of Personal Data under this Addendum includes the transfer of Personal Data to a Sub-processor located in a country outside of the EEA or the UK which is not recognised by the European Commission or the United Kingdom to have an adequate level of protection in accordance with Data Protection Law, and the Sub- processor is not self-certified under the Data Privacy Framework, the Processor shall be entitled and obligated to enter into a supplementary agreement with the Sub-processor containing the relevant SCCs, before any Personal Data is transferred to such Sub-processor."})]})]}),(0,s.jsxs)("li",{id:"liability",children:[(0,s.jsx)(m.H4,{children:"Liability"}),(0,s.jsx)(m.Sd,{children:"The liability of each party under this Addendum shall be subject to the exclusions and limitations of liability set out in the Workable Customer Terms and Conditions."})]}),(0,s.jsxs)("li",{id:"term",children:[(0,s.jsx)(m.H4,{children:"Term"}),(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"The Controller may delete or request the return of all personal data on termination of the Services and the Processor shall act in accordance with the Controller’s instructions. Where the Controller has not deleted the personal data prior to the termination of the Services, Processor may delete all personal data at any time after 90 days following the date of termination unless otherwise required by applicable law. Until personal data is deleted or returned to the Controller, Processor shall continue to ensure compliance with the terms of this agreement."}),(0,s.jsx)("li",{children:"This requirement shall not apply to the extent that Workable is required by any applicable law to retain some or all of the personal data, in which event Workable shall isolate and protect the Personal Data from any further processing except to the extent required by such law until deletion is possible."}),(0,s.jsx)("li",{children:"This Addendum is applicable from the date of its execution and until all Personal Data is erased in accordance with clause 7.1 above."})]})]}),(0,s.jsxs)("li",{id:"dispute-resolution",children:[(0,s.jsx)(m.H4,{children:"Dispute resolution"}),(0,s.jsxs)(N,{children:[(0,s.jsx)("li",{children:"This Addendum shall be governed by and construed in accordance with the laws as specified in the Agreement. The Parties hereby submit to the jurisdiction of the courts specified in the Agreement."}),(0,s.jsx)("li",{children:"For any disputes arising out of the Standard Contractual Clauses, where the EU SCCs are applicable, the Greek Courts shall have the exclusive jurisdiction, while where the UK Addendum is applicable, the courts in the United Kingdom shall have exclusive jurisdiction."})]})]}),(0,s.jsxs)("li",{id:"conflict",children:[(0,s.jsx)(m.H4,{children:"Conflict"}),(0,s.jsx)(N,{children:(0,s.jsx)("li",{children:"In the event of any conflict or inconsistency among the following documents, the order of precedence will be: (1) the applicable terms in the Standard Contractual Clauses, or, where applicable, the UK Addendum; (2) the terms of this Addendum; (3) the Workable Agreement."})})]}),(0,s.jsxs)("li",{id:"updates",children:[(0,s.jsx)(m.H4,{children:"Updates"}),(0,s.jsx)(m.Sd,{children:"Workable may update the terms of this Addendum from time to time, provided such updates do not degrade or diminish overall Customer’s rights. Any changes Workable may make to this Addendum in the future will be notified and made available to the Customers that have subscribed to be notified for updates in the Agreement."})]})]}),(0,s.jsx)(L,{className:D()["scroll-mg-t"],id:"exhibit-a",children:"EXHIBIT A"}),(0,s.jsx)(m.H4,{children:"Data processing descriptions"}),(0,s.jsx)(m.P,{children:"Under Data Protection Law, the Processor shall only Process Personal Data in accordance with the Controller’s documented Instru

1ctions, as regulated in the Addendum. This document forms part of the Controller’s Instructions, directing the Processor on the scope, nature, and purpose when Processing Personal Data on behalf of the Controller."}),(0,s.jsx)(m.P,{children:"The Instructions may be amended in writing by the Controller from time to time, as communicated in writing to the Processor by authorized representative of the Controller or through the Controller’s use of the Service."}),(0,s.jsxs)(N,{children:[(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Scope of processing"}),(0,s.jsx)(m.Sd,{children:"The Processor shall Process Personal Data hereunder exclusively within the scope of the provision of the Service."})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Purpose of processing"}),(0,s.jsx)(m.Sd,{children:"The Processor shall Process Personal Data only for the purpose of enabling the Controller to manage its recruitment processes through the Controller’s use of the Service."})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Categories of data subjects"}),(0,s.jsx)(m.Sd,{children:"Employees, including current and former employees, trainees and interns, pre-hires, applicants and sourced candidates."}),(0,s.jsx)(m.Sd,{children:"External recruitment consultants"})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Types of personal data"}),(0,s.jsxs)("ul",{className:D()["list-not-styled"],children:[(0,s.jsx)("li",{children:"Name (name and surname)"}),(0,s.jsx)("li",{children:"Address"}),(0,s.jsx)("li",{children:"Nationality"}),(0,s.jsx)("li",{children:"Password"}),(0,s.jsx)("li",{children:"User name"}),(0,s.jsx)("li",{children:"E-mail address"}),(0,s.jsx)("li",{children:"Telephone number"}),(0,s.jsx)("li",{children:"Salary"}),(0,s.jsx)("li",{children:"Employment terms (incl salary and benefits)"}),(0,s.jsx)("li",{children:"IP-address "}),(0,s.jsx)("li",{children:"Links to social profiles"}),(0,s.jsx)("li",{children:"Resume"}),(0,s.jsx)("li",{children:"Videos"})]}),(0,s.jsx)(m.Sd,{children:"The Controller may choose to store additional information on candidates."})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Special categories of personal data"}),(0,s.jsx)(m.Sd,{children:"Processor does not anticipate processing any data falling into the special categories of data as set out in the GDPR, however, it is not possible for Processor to control the information that candidates or authorized users of the Controller choose to share with each other using the Service."})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Processing activities"}),(0,s.jsxs)("ul",{className:D()["list-not-styled"],children:[(0,s.jsx)("li",{children:"Collection"}),(0,s.jsx)("li",{children:"Registration"}),(0,s.jsx)("li",{children:"Storing"}),(0,s.jsx)("li",{children:"Accessing, reading or consultation"}),(0,s.jsx)("li",{children:"Erasure or destruction"})]})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Duration of processing"}),(0,s.jsx)(m.Sd,{children:"Personal Data shall not be Processed for a period longer than is necessary for serving its purpose. In respect of all Processing activities other than storage of the Personal Data, the Processing shall cease on expiry or termination of the Services. In relation to storage of the Personal Data, the Processing shall cease in accordance with clause 7 above."})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Sub-processor"}),(0,s.jsxs)(m.Sd,{children:["The Processor has engaged sub-processor(s) for carrying out specific Processing activities on behalf of the Controller. A full list of those sub-processor(s) can be found at the webpage presented below:"," "]}),(0,s.jsx)(u.A,{variant:"default",href:"/subprocessors",children:"https://www.workable.com/subprocessors"})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Processing location"}),(0,s.jsx)(m.Sd,{children:"Processing takes place in the following country/countries: United Kingdom, United States, Greece"})]})]}),(0,s.jsx)(L,{className:D()["scroll-mg-t"],id:"exhibit-b",children:"EXHIBIT B"}),(0,s.jsx)(m.P,{children:"The following includes the information required by Annex I and Annex III of the EU SCCs and Table 1 and 4 of the UK Addendum."}),(0,s.jsxs)(N,{children:[(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"List of parties"}),(0,s.jsx)(m.P,{children:(0,s.jsx)(E,{children:"Data exporter(s):"})}),(0,s.jsx)(m.P,{children:"Name: Customer’s entity as identified in the online order form or the Work

1able Quote, as applicable"}),(0,s.jsx)(m.P,{children:"Address: Customer’s address as identified in the online order form or the Workable Quote, as applicable"}),(0,s.jsx)(m.P,{children:"Contact person’s name, position and contact details: As identified in the online order form or the Workable Quote, as applicable"}),(0,s.jsx)(m.P,{children:"Signature and date: The date of execution of the online order form or the Workable Quote."}),(0,s.jsx)(m.P,{children:"Role (controller/processor): Controller"}),(0,s.jsx)(m.P,{children:(0,s.jsx)(E,{children:"Data importer(s):"})}),(0,s.jsx)(m.P,{children:"Name: The Workable entity identified in the online terms or the Workable Quote, as applicable."}),(0,s.jsx)(m.P,{children:"Address: The address identified in the online terms or the Workable Quote, as applicable"}),(0,s.jsxs)(m.P,{children:["Contact person’s name, position and contact details:"," ",(0,s.jsx)(u.A,{variant:"default",href:"mailto:[email protected]",children:"[email protected]"})," ","attn of DPO"]}),(0,s.jsx)(m.P,{children:"Activities relevant to the data transferred under these Clauses: ATS and HRIS service provider"}),(0,s.jsx)(m.P,{children:"Signature and date: The date of execution of the online order form or the Work

1able Quote."}),(0,s.jsx)(m.P,{children:"Role (controller/processor): Processor"})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Description of transfer"}),(0,s.jsx)(U,{children:"Categories of data subjects whose personal data is transferred"}),(0,s.jsx)(m.Sd,{children:"The personal data transferred concern the following categories of data subjects (please specify):"}),(0,s.jsxs)("ul",{className:D()["list-not-styled"],children:[(0,s.jsx)("li",{children:"Employees, including current and former employees, trainees and interns, pre-hires, applicants, and sourced candidates."}),(0,s.jsx)("li",{children:"External recruitment consultants"})]}),(0,s.jsx)(U,{children:"Categories of personal data transferred"}),(0,s.jsx)(m.Sd,{children:"The personal data transferred concern the following categories of data (please specify):"}),(0,s.jsxs)("ul",{className:D()["list-not-styled"],children:[(0,s.jsx)("li",{children:"Name (name and surname)"}),(0,s.jsx)("li",{children:"Address"}),(0,s.jsx)("li",{children:"Nationality"}),(0,s.jsx)("li",{children:"Password"}),(0,s.jsx)("li",{children:"User name"}),(0,s.jsx)("li",{children:"E-mail address"}),(0,s.jsx)("li",{children:"Telephone number"}),(0,s.jsx)("li",{children:"Salary"}),(0,s.jsx)("li",{children:"Employment terms (incl salary and benefits)"}),(0,s.jsx)("li",{children:"IP-address "}),(0,s.jsx)("li",{children:"Links to social profiles"}),(0,s.jsx)("li",{children:"Resume"}),(0,s.jsx)("li",{children:"Videos"})]}),(0,s.jsx)(m.P,{children:" The Exporter may choose to store additional information on candidates."}),(0,s.jsx)(R,{children:"Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures."}),(0,s.jsx)(R,{children:"The Importer does not anticipate processing any data falling into the special categories of data as set out in the GDPR, however, it is not possible for the importer to control the information that candidates or authorized users of the Exporter choose to share with each other using the Service."}),(0,s.jsx)(U,{children:"The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)."}),(0,s.jsx)(m.P,{children:"The frequency of the transfer is a continuous basis for the duration of the Agreement."}),(0,s.jsx)(U,{children:"Nature of the processing"}),(0,s.jsx)(m.Sd,{children:"The Importer will process and access personal data on a routinely basis as necessary to provide the Services as described in the Workable Terms. The below processing activities take place:"}),(0,s.jsxs)("ul",{className:D()["list-not-styled"],children:[(0,s.jsx)("li",{children:"Collection"}),(0,s.jsx)("li",{children:"Registration"}),(0,s.jsx)("li",{children:"Storing"}),(0,s.jsx)("li",{children:"Accessing, reading or consultation"}),(0,s.jsx)("li",{children:"Erasure or destruction"})]}),(0,s.jsx)(U,{children:"Purpose(s) of the data transfer and further processing"}),(0,s.jsx)(m.P,{children:"The Importer will process Personal Data as necessary to provide the Services under the Agreement."}),(0,s.jsx)(U,{children:"The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period"}),(0,s.jsx)(m.P,{children:"The Importer will process Personal Data for the purpose of providing the Services for the duration of the Services as identified in the Quote or until the Exporter elects to delete such Personal Data via the Workable Platform. In relation to storage of the Personal Data, the Processing shall cease in accordance with the Addendum."}),(0,s.jsx)(U,{children:"For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing"}),(0,s.jsx)(m.P,{children:"The transfer to sub-processors is on continuous basis for the duration of the Services."})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"Competent supervisory authority"}),(0,s.jsx)(m.P,{children:"Identify the competent supervisory authority/ies in accordance with Clause 13"}),(0,s.jsx)(m.P,{children:"Hellenic Data Protection Authority"})]}),(0,s.jsxs)("li",{children:[(0,s.jsx)(m.H4,{children:"List of authorised subprocessors"}),(0,s.jsxs)(m.P,{children:["The Exporter has authorized the use of the sub-processors identified at:"," ",(0,s.jsx)(u.A,{variant:"default",href:"/subprocessors",children:"https://www.workable.com/subprocessors"})]})]})]}),(0,s.jsx)(L,{className:D()["scroll-mg-t"],id:"exhibit-c",children:"EXHIBIT C"}),(0,s.jsx)(m.H4,{children:"Description of the Technical and Organisational Security Measures implemented by the Data Processor/Importer"}),(0,s.jsx)(m.Sd,{children:"The following security measures include the information required by Annex II of the EU SCCs and Table 3 of the UK Addendum:"}),(0,s.jsx)(m.Sd,{children:(0,s.jsxs)(u.A,{variant:"default",href:"/static/downloads/technical-and-organisational-security-measures.pdf?1.0 ",target:"_blank",children:["https://www.workable.com/static/downloads/technical-and-organisational-security-measures.pdf"," "]})})]}),T=()=>(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(W,{children:"Technical and Organisational Security Measures"}),(0,s.jsx)(q,{children:(0,s.jsx)(u.A,{onClick:S.sE,variant:"secondary-no-gradient-download",className:"no-print",children:"Download"})}),(0,s.jsx)(b.X,{className:D()["legal-table"],children:(0,s.jsxs)(b.v,{children:[(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TH,{children:"Technical and Organizational Security Measure"}),(0,s.jsx)(b.TH,{children:"Details"})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures of pseudonymisation and encryption of personal data"})}),(0,s.jsx)(b.TD,{children:"All Application data - including personal data such as candidates information - is always encrypted at-rest and intransit in order to ensure its confidentiality across all its lifecycle (e.g.: storage means, data flows). Personal data is stored on a microservice level to apply segregation and segmentation across the Application storage resources(e.g.: databases). Randomly generated and long UUIDs are used to correlate data to an individual."})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services"})}),(0,s.jsxs)(b.TD,{children:["Workable data is encrypted at rest and in transit using Security Best Practices and the latest recommended secure cipher suites and protocols Appropriate safeguards have been implemented to protect the creation, storage, retrieval and destruction of secrets. Workable implements Best Practices as they evolve and respond promptly to cryptographic weaknesses as they are discovered.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}

1),"The infrastructure and data are stored redundantly in multiple locations in their hosting and data storage providers. Workable uses multiple relational databases for its applications. Each database server has an independent synchronous replica in a different availability zone within the same AWS region to mitigate the risk of data lost due to hardware failure.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"In the unlikely event of a major disaster, a Business Continuity Plan (BCP) is in place to help guarantee a smooth and organized transition towards a full recovery. To ensure that production services are highly available, teams have designed infrastructure so as to have replicas/ fallbacks for all critical resources.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"To ensure that Workable infrastructure is resilient against single node or instance failure, for all critical services multiple instances are available and running. This guarantees that if a single instance fails there is at least an extra instance to serve traffic until the failure is recovered.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"In order to protect services from single zone failure of cloud providers, all critical resources have multi-zone availability. This means that when teams provision production resources they make sure that they have replicas in multiple zones, so if a single zone fails the replicas in the other zones can still serve traffic."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident"})}),(0,s.jsxs)(b.TD,{children:["Workable has documented and follows specific policies and procedures to securely take, maintain, test and restore backups of production data.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Backup data includes but is not limited to customers’ and candidates’ data, application logs and systems’ configuration, and has a retention period of at least 18 months.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"The backup configuration of a new resource is not limited to availability factors (e.g.: retention period, frequency) but also includes restoration aspects such as integrity tests and restore periodic procedure and timeline.. The enterprise cloud platforms (e.g.: GCP and AWS), where Workable infrastructure is hosted, offer strong and out of the box managed backup services ensuring data availability and integrity."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing"})}),(0,s.jsxs)(b.TD,{children:["Workable has identified a suitable, systematic approach and framework for risk assessment which is appropriate for its business, legal, regulatory and contractual requirements, and this is described in the Risk Assessment Report. Assessment (analysis and evaluation) of risks is carried out at least once a year, options for risk treatment are identified and evaluated in line with the Risk Assessment process.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Technical security assessments (such as web application penetration testing, manual source code review and configuration audit) are performed by 3rd-party security experts on a regular basis to bring independent expertise and in-depth testing.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"The ISMS is thoroughly reviewed through an Audit Program maintained by the CISO. The goal of internal and external audits is to:",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),(0,s.jsxs)(M,{children:[(0,s.jsx)("li",{children:"Identify potential non-compliance points with respect to Workable policies, procedures as well as regulatory requirements (e.g.: GDPR, CCPA, etc.) and Standards (e.g.: ISO 27001, ISO 27017, AICPA TSC.)"}),(0,s.jsx)("li",{children:"Spot opportunity for improvements"}),(0,s.jsx)("li",{children:"Document and track remediation activities"})]}),"All appropriate mitigation actions such as technical security assessments and audit findings are documented, reviewed, approved and tracked for their effective implementation."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for the protection of data during transmission"})}),(0,s.jsx)(b.TD,{children:"Data is always encrypted in-transit to ensure its confidentiality using Security Best Practices and the latest recommended secure cipher suites and protocols."})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for the protection of data during storage"})}),(0,s.jsxs)(b.TD,{children:["Data is always encrypted at-rest to ensure its confidentiality and integrity using Security Best Practices and the latest recommended secure cipher suites and protocols.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"On top of all cloud storage resources, Workable laptops and mobile devices are fully encrypted"]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring physical security of locations at which personal data are processed"})}),(0,s.jsxs)(b.TD,{children:["Offices:",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),(0,s.jsx)(M,{children:(0,s.jsx)("li",{children:"Access to the premises is protected by physical access controls such as security guards, access cards, CCTV and alarm system.Guest and external visitors’ access is handled securely through a dedicated procedure."})}),"Cloud resources:",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),(0,s.jsx)(M,{children:(0,s.jsx)("li",{children:"Workable uses subservice organizations (Google Cloud Platform and Amazon Web Services) for cloud hosting services and for providing physical controls, environmental controls, infrastru

1cture support and storage services. Workable reviews the reports and/ or certifications (e.g. SOC 2, ISO) of the subservice contractors in regard to security controls including data centers physical and environmental controls"})})]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring events logging"})}),(0,s.jsxs)(b.TD,{children:["Workable maintains an extensive, centralized logging system in the production environment. It contains information pertaining to security, monitoring, availability and access, as well as other metrics about our application ecosystem and its microservices. Production log retention is set to 18 months.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"These logs are analyzed for security events and abnormalities via logical and technical controls. Further, alerts and monitors automatically notify appropriate internal teams 24/7/365 to ensure visibility and responsiveness. These alerts also include the product availability, capacity and performance metrics.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Production operation actions (such as major system configuration update and product deployments) are performed in a controlled (segregated responsibilities, approval step) and tracked (audit logs) manner."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring system configuration, including default configuration"})}),(0,s.jsxs)(b.TD,{children:["Security best practices are taken into account during the installation of any resource in the cloud infrastructure in order to ensure that cloud infrastructure complies with Workable Security Policies.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"A production readiness checklist depicts the high level controls (e.g.: access controls requirements, encryption, patch management, backup strategy, logging requirements, etc.) that have to be met for all production systems. Each control is detailed for each type of resource (e.g.: vm, database)."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for internal IT and IT security governance and management"})}),(0,s.jsxs)(b.TD,{children:["Workable maintains reasonable and appropriate technical and organizational controls (based on best practices, i.e. ISO 27001, ISO 27017 and SOC 2 requirements) in order to protect customer data against accidental loss, destruction or alteration, unauthorized disclosure or unlawful destruction.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Workable compliance requirements are continuously monitored and reviewed and appropriate changes to Information Security Policies and technical controls are performed as needed.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"The Legal Department and DPO are responsible to ensure that all requirements from applicable legislation are communicated to the Security department. The Security Department is responsible to review the policies and procedures in order to achieve compliance with the regulatory requirements.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Workable undertakes management review of the ISMS on a regular basis (are held at not greater than six-monthly intervals) to ensure that the scope remains adequate and improvements in the ISMS process are identified.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"The agenda of Management Review Meetings covers all the items that are required by the relative standards (i.e. ISO 27001:2013, ISO 27017:2015, AICPA Trust Services Criteria, etc.).",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"All actions that are decided during the management review meeting are monitored in order to ensure their implementation and effectiveness."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for certification/ assurance of processes and products"})}),(0,s.jsxs)(b.TD,{children:["Workable holds security certifications and comply with industry-accepted standards and regulations:",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),(0,s.jsxs)(M,{children:[(0,s.jsx)("li",{children:"ISO 27001:2013, Information Security Management System"}),(0,s.jsx)("li",{children:"ISO 27017:2015, Security Controls for the Provision and Use of Cloud Service"}),(0,s.jsx)("li",{children:"SOC 2 Type I Report"}),(0,s.jsx)("li",{children:"SOC 2 Type II Report"}),(0,s.jsx)("li",{children:"SOC 3 Report"})]}),"Additionally, Technical Security Assessments (such as web application penetration testing, manual source code review, configuration audit, etc.) are performed by 3rd-party security experts on a regular basis."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring data minimisation"})}),(0,s.jsxs)(b.TD,{children:["In compliance with the GDPR / CCPA requirement, the Work

1able product provides its customers the ability to have control over their data. Data deletion requests are handled through a dedicated automated process.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"The Application enforces controls on all upload flows to ensure that only the allowed file types are stored within the system. Moreover, the terms of use clearly state the types of information that should be stored within Workable as well as the customers’ responsibility regarding its use."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring data quality"})}),(0,s.jsx)(b.TD,{children:"Users’ input is sanitized and validated by the application in regards to the business logic of the corresponding feature or product. Malformed data is thus rejected prior to be stored."})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring limited data retention"})}),(0,s.jsx)(b.TD,{children:"Workable Customers determine what Customer Data they process via Workable product. As such, Workable operates on a shared responsibility model. If a Customer is unable to delete Customer Data via the self-services functionality of the Product, then Workable deletes Customer Data upon the Customer's written request, within the timeframe specified in the Data Protection Addendum and in accordance with Applicable Data Protection Law."})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for ensuring accountability"})}),(0,s.jsxs)(b.TD,{children:["Management has defined Roles and Responsibilities to oversee implementation of the Information Security Policy across Workable (e.g. DPO has been appointed, Information Security Committee is in place as well as specific security responsibilities for Workable Team Members).",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"New employees undergo initial training during the onboarding week to understand their key responsibilities, tasks and Team's process. The Employment Agreement and the Acceptable Use Policy are signed by the end of the first week.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Employees are evaluated on a periodic basis based on their role specific goals and overall performance.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Regular meetings on SVPs / VPs level as well as Management Review Meetings (MRMs) are conducted regarding information security. The topics of these meetings include results from risk assessments, internal and external audits, security assessments, other feedback from interested parties and appropriate corrective and preventive decisions are taken. Major gaps are communicated to the Board of Directors through Management Review Meetings (MRMs).",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Internal & external information security audits are performed at least on an annual basis in order to ensure compliance with Data Protection (e.g. GDPR, CCPA) and Information Security requirements (e.g. Workable policies & procedures, ISO 27001, ISO 27017, TSC, Security Best Practices). All identified gaps are investigated, and appropriate corrective and preventive actions are implemented via formal procedures. Major gaps are communicated to the Board of Directors through Management Review Meetings (MRMs)."]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Measures for allowing data portability and ensuring erasure"})}),(0,s.jsxs)(b.TD,{children:["As a Product:",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),(0,s.jsx)(M,{children:(0,s.jsx)("li",{children:"Workable provides the appropriate tools that give Customer control over their data, ensuring compliance with GDPR / CCPA requirements. Additionally, appropriate operation procedures are in place internally in order to handle GDPR / CCPA requests in case Customer is not able to handle any data subject request."})}),"As a Company:",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),(0,s.jsxs)(M,{children:[(0,s.jsx)("li",{children:"When a critical tool or service is sunsetted, Workable asks for confirmation in writing regarding permanent data deletion."}),(0,s.jsx)("li",{children:"Physical devices such as laptops and hard drives are wiped according to the device disposal policy."})]})]})]}),(0,s.jsxs)(b.TR,{children:[(0,s.jsx)(b.TD,{children:(0,s.jsx)(E,{children:"Technical and organizational measures of sub-processors"})}),(0,s.jsxs)(b.TD,{children:["Third parties and contractors Non-Disclosure Agreements (NDA), Data Processing Agreements (DPA) and contracts are in place and contain provisions in regard to confidentiality clauses and code of conduct if applicable.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"In particular Workable enters into Data Processing Agreements with its Authorized Sub-Processors with data protection obligations substantially similar to those contained in this Agreement.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Each sub-processor agreement must ensure that Workable is able to meet its obligations to the Customer and technical and organisational measures shall be implemented in order to safeguard the protection of personal data. Sub-processors must without limitation a) notify Workable in the event of a Security Incident without undue delay so Workable may notify Customer accordingly; b) delete data when instructed by Workable in accordance with Customer’s instructions to Workable; c) not engage additional sub-processors without authorization; d) not change the location where data is processed; or e) process data in a manner which conflicts with Customer’s instructions to Workable. e) enter into a separate agreement containing the applicable SCCs, when this is required.",(0,s.jsx)("br",{}),(0,s.jsx)("br",{}),"Appropriate contracts and Service Level Agreements (SLAs) are in place to outline and communicate the terms, conditions and responsibilities for third-party providers. (e.g. Google Cloud, Amazon)."]})]})]})})]}),F=()=>(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(W,{children:"CCPA/CPRA Data Processing Addendum"}),(0,s.jsx)(q,{children:(0,s.jsx)(u.A,{onClick:S.sE,variant:"secondary-no-gradient-download",className:"no-print",children:"Download"})}),(0,s.jsxs)(N,{className:D()["numbered-p-list"],children:[(0,s.jsx)("li",{children:(0,s.jsx)(m.Sd,{children:"If Workable receives personal information of California residents from the Customer in order to provide the Services, pursuant to the Work

1able Terms, Workable does so as a Service Provider for the purposes of the California Consumer Privacy Act (Cal. Civ. Code \xa7\xa7 1798.100 et seq.) as amended by the California Privacy Rights Act purpose. (“CPRA”) (all together herein “CCPA”) to the extent applicable, and the Customer is a Business. Workable shall not sell any such Personal Information. and is receiving personal information from Customer pursuant to these Terms for a business."})}),(0,s.jsx)("li",{children:(0,s.jsxs)(m.Sd,{children:["Workable shall not sell, retain, use or disclose any personal information provided by Customer pursuant to these Terms except as necessary for the specific purpose of performing the services to the Customer pursuant to these Terms, or otherwise as set forth in these Terms or as permitted by the CCPA. The terms “Business Purpose”, “Consumer” “Personal Information,” “Service Provider,” “Sale,” and “Sell” are as defined in the CCPA."," "]})}),(0,s.jsx)("li",{children:(0,s.jsx)(m.Sd,{children:"Workable shall comply with all obligations applicable to Service Providers under the CCPA, including by providing Personal Information provided by the Customer under the Terms, the level of privacy protection required by the CCPA. An outline of Workable minimum security standards can be found here."})}),(0,s.jsx)("li",{children:(0,s.jsx)(m.Sd,{children:"Customer shall disclose Personal Information to Workable only for the limited and specified purposes."})}),(0,s.jsx)("li",{children:(0,s.jsx)(m.Sd,{children:"Customer agrees that Workable may engage other Service Providers and its Affiliates (see here) to assist Workable in providing the Services to the Customer under these Terms. In the event that Workable engages a new Service Provider requirements set forth in the CCPA. (“Sub-Processor” Workable shall: (i) notify Customer of such engagement via the notification mechanism described in section 11.8 of the Terms at least thirty (30) days before enabling a new Sub-Processor, and (ii) enter into a written contract with the Sub-processor requiring Sub-processor to observe all of the applicable."})}),(0,s.jsx)("li",{children:(0,s.jsx)(m.Sd,{children:"To the extent required by CCPA, Workable shall allow Customer to conduct inspections or audits in accordance with Sections 11.4.7 of the Terms."})}),(0,s.jsx)("li",{children:(0,s.jsx)(m.Sd,{children:"The liability of each party under this Addendum shall be subject to the exclusions and limitations of liability set out in the Agreement."})})]})]});return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(C.A,{title:"Data Protection"}),(0,s.jsx)(d.Xs,{children:(0,s.jsx)(h.A,{children:(0,s.jsxs)(l.xA,{fluid:!0,children:[(0,s.jsx)(k,{children:(0,s.jsx)(v.A,{clickableLink:{text:"Legal",urlCopy:"/legal"},title:"Data Protection",activeTab:A.find(e=>e.value===r).text})}),(0,s.jsxs)(l.fI,{children:[(0,s.jsx)(l.fv,{xs:12,md:12,lg:3,children:(0,s.jsx)(f,{})}),(0,s.jsx)(l.fv,{xs:12,md:12,lgOffset:1,lg:8,children:(()=>{switch(r){case"CCPA/CPRA":return(0,s.jsx)(F,{});case"security-measures":return(0,s.jsx)(T,{});default:return(0,s.jsx)(x,{})}})()})]}),(0,s.jsx)(j.A,{}),(0,s.jsx)(I,{children:(0,s.jsx)(u.A,{variant:"go-to-top-arrow",onClick:S.iR})})]})})})]})},{title:"Workable Data Protection Policies | Privacy, DPA, Sub-Processors",description:" Access Workable’s Data Protection Agreement, CCPA/CPRA addendum, sub-processor list, and security measures.",canonical:"https://www.workable.com/legal/data-protection"})},63044:e=>{e.exports={divider:"terms-form_divider__BvEIJ","orange-container":"terms-form_orange-container__gcG5G","footer-newsletter-inner":"terms-form_footer-newsletter-inner___7ZOV","newsletter-container":"terms-form_newsletter-container__BL8_x"}},82276:(e,t,r)=>{"use strict";r.d(t,{A:()=>y});var s=r(37876);r(14232);var i=r(15039),a=r.n(i),o=r(87146),n=r(10264),l=r(64289),c=r(7573),d=r(30581),h=r(58965),u=r(49906),p=r(35687),m=r(63044),f=r.n(m);let b=(0,c.nW)((0,c.on)(l.H3)),g=(0,u.xA)(h.A),x=(0,p.o8)(l.Sd),y=()=>(0,s.jsx)("div",{className:a()(f().divider,"no-print"),children:(0,s.jsx)(g,{className:f()["orange-container"],children:(0,s.jsx)("div",{className:f()["footer-newsletter-inner"],children:(0,s.jsx)(o.fI,{center:"xs",middle:"xs",children:(0,s.jsx)(o.fv,{lg:6,md:8,sm:10,children:(0,s.jsxs)("div",{className:f()["newsletter-container"],children:[(0,s.jsx)(b,{children:"Stay up-to-date on our updates"}),(0,s.jsx)(x,{children:"Occasionally, we need to update our Terms or Sub-processors. If you’d like to receive an email notification when we do, just tell us where to send it:"}),(0,s.jsx)("div",{id:"form",className:"hs-form form-inline form-animated",children:(0,s.jsx)(n.A,{portalId:"4532585",formId:"4791c758-0233-48aa-8bfa-e038435b6242",css:"",onFormError:d.A.handleFormError,onFormReady:()=>{d.A.handleFormReady(),d.A.handleInputFocus("4791c758-0233-48aa-8bfa-e038435b6242"),d.A.populateGCLIDValue(),d.A.populateMetroValue()},onFormSubmitted:()=>{window.dataLayer&&window.dataLayer.push({event:"Event",eventCategory:"Form",eventAction:"Submitted",eventLabel:"Terms Form"})}})})]})})})})})})},97459:(e,t,r)=>{(window.__NEXT_P=window.__NEXT_P||[]).push(["/legal/data-protection",function(){return r(58513)}])}},e=>{e.O(0,[4186,2216,5068,7201,3126,1241,2464,636,6593,8792],()=>e(e.s=97459)),_N_E=e.O()}]);
2//# sourceMappingURL=data-protection-cb86147d813c47b9.js.map