Data Processing Agreement

Revised: 17 October 2026

Effective date: The date stated in the publication notice, after the applicable advance notice period.

Operator: 360 Agency Middle East FZ LLC, Creative City, Fujairah, United Arab Emirates

Contact: admin@stafffinder.io | Website: www.stafffinder.io

This agreement governs only personal data processing genuinely performed by Staff Finder on an employer’s documented instructions. It supplements the Employer Terms. It does not transfer control of Staff Finder’s own candidate database or verification process to employers.

1. Introduction

This DPA forms part of the Employer Terms and applies where applicable data protection law requires a controller and processor arrangement for a specific employer service. Mandatory requirements of UAE Federal Decree Law No. 45 of 2021 and any other applicable data protection law take priority. A service is not treated as processor activity merely because an employer uses the platform.

2. Roles of the Parties

For processing performed solely on an employer’s documented instructions, 360 Agency Middle East FZ LLC acts as Processor and the employer acts as Controller. The actual activity determines the roles.

Staff Finder acts as an independent controller for its candidate database, candidate registration, verification, professional evaluations, matching, presentation and visibility, platform security, payments and business administration. Employers act as independent controllers for their own recruitment decisions, candidate interactions and subsequent use of disclosed data. Those independent controller activities fall outside the processor obligations in this DPA and are governed by applicable law, the Privacy Policy and Employer Terms.

3. Scope of Processing

Where provided solely on the employer’s instructions, processing may comprise hosting employer controlled recruitment records and facilitating communications or workflows within that employer’s account. The subject matter is the agreed employer service; duration is the service term and the deletion period in Section 10. Operations may include collection, storage, organisation, transmission, access control and deletion for that service. Staff Finder’s independently determined candidate database, verification, matching, security and payment processing are outside this processor scope.

4. Types of Data Processed

Within the processor service, data may include candidate and employer representative names, contact details, recruitment correspondence, interview or application records and employer supplied information necessary for the agreed workflow. Data subjects are the relevant candidates, referees where applicable and employer representatives. The employer must not instruct processing of unnecessary sensitive data or unlawful recruitment criteria. Additional high risk or materially different processor services require an updated documented scope before processing.

5. Processor Obligations

The Processor shall:

(a) Process personal data only on documented instructions from the Controller, including with respect to transfers, unless required to do so by applicable law, in which case the Processor shall inform the Controller before processing unless prohibited by law;

(b) Not process personal data for any purpose other than those specified in this DPA and the Employer Terms, and shall not sell, rent, or otherwise use personal data for its own commercial purposes beyond platform operation;

(c) Ensure that all personnel authorised to process personal data are subject to binding confidentiality obligations;

(d) Assist the Controller, insofar as reasonably possible and taking into account the nature of processing, in responding to data subject rights requests (access, rectification, erasure, restriction, portability) under applicable law;

(e) Assist the Controller in ensuring compliance with security obligations, breach notification requirements, data protection impact assessments, and prior consultation obligations under applicable law;

(f) Maintain records of processing activities carried out on behalf of the Controller as required by Article 8(7) of the PDPL;

(g) Make available to the Controller all information necessary to demonstrate compliance with this DPA, and permit and contribute to audits and inspections conducted by or on behalf of the Controller, upon reasonable prior written notice of no less than 10 business days.

6. Security Measures

The Processor implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or misuse. These include access controls, encryption in transit and at rest, regular security reviews, and secure infrastructure provided by certified cloud hosting services. Measures are reviewed and updated periodically in line with evolving risks.

7. Personal Data Breach Notification

Upon becoming aware of a personal data breach affecting data processed under this DPA, the Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware, or earlier where required by applicable law. The notification shall include, to the extent available: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address the breach.

The Processor shall cooperate with the Controller in any required notifications to regulatory authorities or affected data subjects.

8. Subprocessors

The employer provides general written authorisation to use subprocessors for the agreed processor service, subject to this Section and the applicable service schedule. The current relevant subprocessors, their tasks, locations and transfer arrangements must be identified and made available before the relevant processor activity begins. The Processor imposes appropriate equivalent obligations and remains responsible for subprocessor performance as required by law and subject to Section 12. A provider used only for Staff Finder’s independent controller operations is not automatically an employer subprocessor.

The Processor shall notify the Controller of any intended changes to the subprocessor list (additions or replacements) by updating Schedule A and providing notice via the platform or email. The Controller may object to any new subprocessor within 14 days of notification on reasonable data protection grounds by writing to admin@stafffinder.io. If the parties cannot resolve the objection, the Controller may terminate the affected services without penalty.

9. International Transfers

The Processor transfers data under this DPA only on documented instructions, including the agreed service configuration, or as otherwise required by law. Before a cross border transfer it establishes a mechanism or exception actually permitted by each applicable law and any necessary supplementary safeguards. A provider contract or foreign privacy framework is not assumed to constitute an approved UAE transfer mechanism. Where GDPR transfer rules apply, the relevant GDPR Chapter V requirements must also be met.

Details of the transfer mechanisms applicable to each subprocessor are available on request by contacting admin@stafffinder.io.

10. Data Retention and Post-Termination

On termination of a processor service, or a valid documented instruction, the Processor shall at the Controller’s election delete or return data processed solely on its behalf within 30 days, unless law requires retention or a shorter period applies. This does not allow an employer to demand deletion or return of Staff Finder’s entire independently controlled candidate database. Candidate account deletion is handled under the Privacy Policy, including immediate removal from employer visibility and deletion within 48 hours subject to limited lawful exceptions. Retained records are restricted to their lawful purpose.

11. Data Subject Rights

Users may request access, correction, restriction, or deletion of their personal data in accordance with the PDPL and other applicable data protection laws. Such requests should be directed to admin@stafffinder.io. The Processor will assist the Controller in responding to requests within the timeframes required by applicable law.

12. Responsibility and Liability

Each party is responsible for its own compliance with this DPA and applicable data protection law. Any liability arises only where the applicable legal requirements for that liability are established. This DPA does not create an automatic entitlement to compensation.

To the fullest extent permitted by applicable law, the Processor does not indemnify, defend or hold harmless the Controller against fines, penalties, third party claims, legal fees, settlements or other losses. The Controller may not bind the Processor to a settlement, admission or payment obligation without the Processor’s prior written agreement. This does not prevent a court or competent authority from imposing liability where required by applicable law.

To the fullest extent permitted by applicable law, the Processor is not liable for losses attributable to the Controller’s unlawful instructions, misuse or unauthorised disclosure of personal data, hiring decisions, or failure to carry out its own legal obligations. Candidate statements, profile status, assessments and hiring outcomes remain subject to the exclusions in Section 9 of the Employer Terms. Those exclusions do not excuse the Processor’s own breach of a mandatory data protection obligation.

To the fullest extent permitted by applicable law, the Processor excludes liability to the Controller for indirect or consequential losses, loss of profit, revenue, business opportunity or anticipated savings arising from this DPA. This clause does not exclude compensation that applicable law requires to be recoverable.

Nothing in this DPA excludes or limits any liability or obligation that cannot lawfully be excluded or limited, including liability for fraud, fraudulent misrepresentation, gross fault or gross negligence where exclusion is prohibited, or death or personal injury caused by negligence. Nothing restricts data subjects’ mandatory rights or the powers of a competent regulator. Responsibility for subprocessors under Section 8 remains subject to this Section 12 and mandatory applicable law.

This DPA does not set a monetary liability cap and does not refer to a monetary cap in the Employer Terms. The absence of a monetary cap is not a promise to indemnify the Controller and does not expand liability beyond that arising under this DPA and applicable law.

13. Duration

This DPA remains in force for the duration of the employer’s use of the platform and the associated Employer Terms and Conditions. Clauses relating to confidentiality, post-termination data handling, liability, and governing law survive termination of this DPA.

14. Governing Law

This agreement is governed by the laws of the United Arab Emirates with jurisdiction of the courts of Fujairah.

Schedule A — Subprocessors

This schedule identifies provider categories relevant to the platform. The actual list for any employer processor service must specify the legal entity, task, location and transfer mechanism before that activity begins. The named examples below are not a representation that every provider processes every employer’s data.

Hosting and database services: AWS and Supabase where used for the relevant processor service. Actual service entities, processing locations and transfer mechanisms are supplied in the service specific list.

AI services: OpenAI, Anthropic or another identified provider only where enabled for the processor service with appropriate instructions, notice, authorisation and safeguards. Identify the actual provider before enabling it.

Payment services: Stripe or another identified payment provider. Processing for Staff Finder’s own billing or a provider’s independent legal purposes is controller activity rather than employer processor activity.

Analytics and advertising for Staff Finder’s own service purposes fall outside this employer processor schedule and are addressed in the Privacy and Cookie policies with any required consent.

Messaging and communications: identify the actual email, notification and call providers processing employer instructed records in the relevant service list before that use begins.

Maintain a current service specific subprocessor list, provide it through the platform or on request to admin@stafffinder.io, and follow the change notice and objection process in Section 8. Do not commence an employer processor activity requiring a formal schedule until that schedule and the necessary safeguards are in place.