Teamtailor (“us”, “we”, “our”) welcomes you, our Customer (“you”), to the Teamtailor service, an applicant tracking system and employer branding platform provided by Teamtailor AB, allowing our customers and users to manage their recruitment and onboarding processes (the “Service”).
These terms and conditions, together with the following documents and appendices, constitute the entire agreement between Teamtailor and the Customer (individually a “party” and collectively “parties”). They are together referred to as the “Agreement”:
the Order Form
the terms and conditions
the data processing agreement (“DPA”);
the following appendices:
Appendix 1 - Description of the processing
Appendix 2 - Technical and organisational measures
If there is any conflict or ambiguity between the terms of any of the documents listed above, a term contained in a document higher up in the list will prevail. If the conflict or ambiguity relates to data processing of personal data, the DPA will prevail.
If you get access to the Service prior to the start date of the Agreement, as outlined in the Order Form, the terms of this Agreement will apply to your use of the Service.
1. Service
The Service is available on app.teamtailor.com and as multi-platform mobile applications.
The features available in the Service are described here: https://www.teamtailor.com/en/all-features/.
2. Use of the Service
The Customer and its representatives, such as employees (“Users”) are granted a non-exclusive, non-transferable, non-sublicensable, revocable licence to use the Service in accordance with this Agreement.
You are, however, able to add other companies within your company group as so-called “Authorised Companies” by listing them in the Order Form. All employees of such companies are then able to use the Service in accordance with this Agreement as Users.
Both Users and Authorised Companies will be referred to as Users in the context of this Agreement.
3. Customer obligations
Users must use the Service in accordance with applicable laws and in accordance with this Agreement. You are responsible for all activities, actions, omissions and content provided by any Users when using the Service. Both parties will provide reasonable assistance to facilitate compliance with applicable laws and the terms of this Agreement, to the extent such assistance is necessary for the proper use of the Service, or as required under this Agreement.
When using the Service, please ensure that all Users respect the rights of others, including any intellectual property, privacy and other rights of third parties who may have an interest in or right in connection with the content being uploaded.
You confirm that you have read and will follow the core principles outlined in the Teamtailor Code of Conduct (the "Code"). These principles are applicable to you, except where it is explicitly stated that they apply solely to Teamtailor.
We expect Users not to:
publish, post or - in any other way express - any material or information that is inappropriate, defamatory, infringing, obscene, pornographic, racist, terrorist, politically slanted, indecent or in any other way unlawful;
copy, reproduce, alter, modify, create derivative works, publicly display, republish, upload, post, transmit, resell or distribute the Service, any part thereof or any material or information that you receive, or are granted access to, from us,
monitor the Service availability, performance or functionality for any competitive purpose or purpose beyond the intended purpose of the Service. For example,you agree not to access the Service for the purpose of developing or operating a competitive product or service or copying the Service features or user interface, or
violate the restrictions on the Service, work around, bypass or circumvent any of the technical limitations of the Service, use any tool to enable features or functionalities that are otherwise disabled in the Service, or decompile, disassemble or otherwise reverse engineer the Service.
use the Service in a deceptive, manipulative, or fraudulent manner, including but not limited to using the Service to mislead others, misrepresent your identity or intentions, create or facilitate misleading job postings or opportunities, or otherwise engage in activities that are inconsistent with the intended use of the Service.
The Customer shall at all times remain responsible for the Users use of the Service.
Teamtailor reserves the right to disable the Customer’s access to the Service in the event of breach of this Section 3, but will provide written notice thereof. Teamtailor will take commercially reasonable steps to use the least invasive method to address the breach, Access will be enabled after rectification, unless the Agreement is terminated under section 16 of this Agreement.
4. Our obligations
Teamtailor undertakes that the Service will be provided with reasonable skill and care and in accordance with industry standards.
If the Service does not comply with the above statement, Teamtailor will, at its own cost, use all reasonable commercial efforts to promptly correct any deviation or provide the Customer with a replacement to meet the desired performance.
Furthermore, the Customer acknowledges that:
Teamtailor does not warrant that the Customer’s use of the Service will be uninterrupted or error-free;
Teamtailor does not warrant that the Service or information obtained by it will meet any Customer requirements or expectations not included in this Agreement; and
Teamtailor is not responsible for any delays, delivery failures or any other loss or damage resolution from the transfer of data over a communication network (such as the internet) out of Teamtailor’s control.
5. User accounts
You, as the company registering for the Service, are solely responsible for the confidentiality of your passwords, or of other access protocols that have been provided and for any use of your account. You are also responsible for selecting an access protocol that is suitable for your business needs, among the different access protocols offered by Teamtailor - as described here.
You are responsible for all activities and actions performed on your account and using your selected access protocol. You must notify us immediately upon becoming aware of any breach of security or unauthorized use of your account. We will not be liable for any cost, loss, damages, or expenses arising out of your failure to maintain the security of your user accounts or your third-party login credentials.
You must ensure that your Users provide accurate and complete registration information anytime registering to the Service.
6. Customer service
You can contact us for questions and support through a) email support@teamtailor.com and b) chat on www.teamtailor.com or when you are logged in to your account.
7. Service level
We will use all commercially reasonable efforts to provide you the Service continuously. However, we cannot guarantee that the Service will be free from interruptions, delays or errors caused by our systems or other third party service providers, general internet disruptions or force majeure events.
From time to time, we may perform maintenance and upgrades to the Service, which may result in interruptions, delays or errors in the Service. We will use all commercially reasonable efforts to notify you in advance of any planned maintenance, by subscribing to https://status.teamtailor.com, where we also notify about unplanned downtime and our historical availability. We will try to ensure that maintenance is scheduled outside of normal business hours.
8. Fees and payment
The Service is provided on an annual basis for the fees detailed in the Order Form, in accordance with the payment details provided in the Order Form. Prices mentioned in this Agreement do not include Value Added Tax (VAT) or any other applicable taxes. The Customer must pay us without deducting taxes, unless mandated by law. If taxes must be withheld, the Customer must pay an extra amount to ensure we receive full payment.
Invoices for any new contract period of twelve (12) months, “Renewal Period”, will be sent yearly in advance.
Teamtailor has the right to adjust the fees for the upcoming Renewal Period. We will provide the Customer with a written notice at least sixty (60) days in advance of any price adjustment. Such adjusted fee will be applicable from the start of the upcoming Renewal Period and this Agreement will be considered amended with the updated fee. If the Customer does not agree with the adjustment, either party may choose to terminate the Agreement in accordance with section 16.
The Customer has the right to adjust the number of Authorised Companies or platforms listed in the Order Form, which may result in a decrease or increase in the fees for the applicable contract period. Any modifications to the number of platforms shall be in writing and agreed by both parties.
Each party is responsible for the fees and other charges their bank or other electronic transfer system may add to payments made.
9. Data protection
When you sign up for and use the Service, we collect and use a limited amount of personal data about your business representatives and Users for our own purposes, i.e. as a so-called data controller under the GDPR.
Our Privacy Policy contains information about the different purposes for which we use this personal data, the personal data that is collected, what rights the affected individuals have in relation to our use of their personal data, etc.
All processing of Customer Personal Data (as defined in the DPA) will be performed as described in the DPA.
10. Intellectual property
All copyrights, trademarks, trade names, logos and other intellectual property rights held and used by us, as part of the Service (including graphics, icons, scrips, source codes etc), are our property or our third party licensors’ property. The Service and other information, including associated intellectual property rights, provided and made available by us, remain our exclusive property or our third party licensors’ property. You or your Users may not use the property for commercial purposes other than in connection with the use of the Services in accordance to this Agreement or for any other purpose without our prior written consent.
Each party shall without delay notify the other party of any suspected or actual intellectual property infringement related to the Service. Any content added or generated by you or your Users to the Service, will remain your property. You warrant that you own or have the right to use such property.
11. Limitation of liability
In no event will we, our subsidiaries, affiliates or any respective officers, employees, directors, agents or partners be liable for:
Loss of contracts;
Loss of goodwill or reputation;
Loss of profit, loss of revenue or loss of anticipated business or earnings; or
Any other indirect, consequential or special losses, damages or liabilities, arising out of or in connection with this Agreement.
To the extent permitted by law, our total liability to you for all other losses arising under or in connection with this Agreement, including indemnification, will be limited to the total sums paid by you for the Service during the period of twelve (12) months preceding the claim.
Nothing in this Agreement, will limit our liability resulting from our fraud or fraudulent misrepresentation, gross negligence, wilful misconduct, for death or personal injury resulting from our negligence or to the extent limitations or exclusions herein are prohibited by applicable law.
12. Indemnification
Each party agrees to defend, indemnify, and hold the other party and its respective directors, agents, affiliates and representatives harmless from and against any claim (including all third-party claims), and expense (including without limitation reasonable attorneys’ fees) arising out of or relating to:
(a) your or Users’ wrongful or improper use of the Service in breach of Section 3;
(b) either party's violation of any third party right, including but not limited to any right of privacy, publicity rights or intellectual property rights; and
(c) either party’s breach of the Confidentiality provisions in the Agreement.
Our indemnification towards you shall not apply to in the event that you are using the Service in a modified form in combination with materials or software not provided by us, nor for any content, information or data provided by you, your Users or candidates when using the Service.
A party that wants to seek indemnification under this section, shall follow the below:
Promptly notify the other party in writing about the claim
Provide the indemnifying party all reasonable cooperation in defence and settlement of such claim; and
Provide the indemnifying party with sole authority to settle the claim.
13. Confidentiality
In the context of this Agreement “Confidential Information” refers to any information that is proprietary or confidential to the disclosing party or that the disclosing party needs to keep confidential, e.g. under an obligation towards a third party. Confidential Information may be of technical, business or other nature. However, Confidential Information does not include any information that: (i) was known to the receiving party before receiving the same from the disclosing party in connection with this Agreement; (ii) is independently developed by the receiving party; (iii) is acquired by the receiving party from another source without restriction as to use or disclosure; or (iv) is or becomes part of the public domain through no fault or action of the receiving party.
The recipient of Confidential Information will not disclose, share or otherwise make available Confidential Information to any third party, without the express written consent of the disclosing party, except for when required by law.
You understand and agree that we will disclose your Confidential Information to the subprocessors used in the provision of the Service, as described in Section 6 of the DPA.
Both parties shall treat the Confidential Information with the same degree of care as they would their own confidential information and must take all reasonable measures to protect the confidential information from unauthorised access or disclosure.
The confidentiality undertaking as described above will remain in force three (3) years after the termination of the Agreement, except for trade secrets which must be kept confidential as long as they qualify as trade secrets.
14. External interfaces and Third Party Service
You can choose to access the Service via external interfaces (e.g. APIs). You can also choose to integrate the Service with third-party technologies and services (“Third-Party Services”), such as those available on our Marketplace, or otherwise requested or created by you. Our external interfaces are made available on an as-is basis, with no guarantee of fitness for any specific purpose, availability, completeness or particular content. We are not responsible or liable towards you with respect to the functionality or availability of our external interfaces, or any data created or obtained through them. When you access our external interfaces, we expect you to::
Comply with the obligations on you as a Customer, just as for your access to the Service, as described in Section 3 above.
Keep the access protocols that you are provided (the API keys) confidential, and otherwise comply with the same obligations as for User accounts in the Service, as described in Section 5 above.
In case you choose to integrate towards Third-Party Services, you expressly instruct us to share data with and give access to the third party. Any use of a Third-Party Service is subject to the terms and conditions between you and such third party.
We are not responsible or liable to you or any Third-Party Service provider with respect to the functionality or availability of any Third-Party Service; or any data obtained through the use of any Third-Party Services. Note that our use of subprocessors to provide the Service is not considered use of a Third Party Service. Instead, we are liable for their acts and omissions, as described in Section 6 of the DPA.
15. Changes to the Service
Teamtailor can make changes to the Service whenever required to improve, maintain or for other business critical purposes. These changes may include upgrades, bug fixes, patches, error corrections, modifications, enhancements, improvements, or new features called “Updates”.
We will not make intentional changes that significantly harm the Service’s features and functionality. If Teamtailor makes a change that significantly harms the Customer’s operations, Teamtailor will inform the Customer in writing thirty (30) days in advance of such change. Teamtailor and the Customer shall in good faith try to find an alternative solution to solve the harm. If not possible within thirty (30) days from the written notice of the Customer, the Agreement shall be terminated with immediate effect.
16. Term and termination
This Agreement shall be valid for a period as detailed in the Order Form, referred to as “Initial Contract Period”. The Agreement will be automatically renewed for an upcoming Renewal Period of twelve (12) months, unless either party provides written notice of termination to the other party, at least one (1) month prior to end of the current contract period.
Either party may also terminate this Agreement immediately, by providing the other party with written notice under the following circumstances:
If the other party commits a material breach of this Agreement and fails to rectify the breach within thirty (30) days after receiving written notice to do so.
If the other party commits a material breach of any term of this Agreement that cannot be rectified.
If the other party becomes subject to bankruptcy proceedings, ceases to carry on business, or goes into liquidation.
Termination under this section shall be made in writing, to you by sending an email to the contact details in the Order Form and to us, by contacting support@teamtailor.com or your customer success manager via email.
If you terminate this Agreement prior to the end of the applicable contract period, you will not be entitled to any refund of any fees paid or relieved from any fees payable.
Upon termination, your and Users' right to access the Service will be revoked. Regarding returning or erasure of Customer Personal Data, see more details in the DPA.
17. Force Majeure
Neither party shall be responsible for delays and defects outside of their control. If either party is delayed by an event outside its control, they must inform the other party as soon as possible and take steps to minimise the effect of the delay. In such cases, the affected party will not be held liable for any resulting defects or delays.
18. Governing law
This Agreement will be governed by and construed in accordance with the laws of Sweden, without giving effect to any choice of law or conflict of law provisions. Any dispute, controversy or claim arising out of or in connection with this Agreement shall be settled by public courts in Sweden.
19. Assignment
You may not assign, transfer or delegate any rights or obligations under this Agreement without our written consent, which shall not be unreasonably withheld.
20. Entire agreement
This Agreement constitutes the entire agreement between the parties, and supersedes all prior or contemporaneous agreements, understandings, negotiations and discussions, whether oral or written, relating to the subject matter of this Agreement, including non-disclosure agreements entered into.
21. Variation
No modification or amendment to this Agreement shall be valid unless in writing and approved by both parties.
Data Processing Agreement
About and summary
This DPA is part of and subject to the terms of the Agreement. It describes what responsibilities you and Teamtailor have when it comes to processing of Customer Personal Data under the Agreement. In sum, it states that:
We can only use Customer Personal Data to provide the Service to you, as described in the Agreement.
You are responsible for your own compliance with Applicable Data Protection Law when using the Service, and Teamtailor for complying with the parts of Applicable Data Protection Law that apply to a processor / service provider.
We will help you comply with many aspects of Applicable Data Protection Law. You have assessed how Teamtailor will be doing this, and are satisfied with the measures Teamtailor will take.
1. Definitions
These definitions are used:
Applicable Data Protection Law means any law about protecting information about physical persons, which applies to a party’s processing of Customer Personal Data under the Agreement. This can for example include: EU Regulation 2016/679 (GDPR); the UK General Data Protection Regulation (UK GDPR); the UK Data Protection Act of 2018; and/or the California Consumer Privacy Act (CCPA).
Customer Personal Data means data that is (i) subject to Applicable Data Protection Law; (ii) processed in your customer account in the Service, or is otherwise processed by or on behalf of you under the Agreement, based on your instructions; and (iii) which Teamtailor is only allowed to process on your behalf. It does not include personal data for which we are the data controller, as described in section 9 in the terms and conditions.
Data Subject Requests means requests from individuals whom Customer Personal Data refers to, to exercise their rights under Applicable Data Protection Law.
EU SCCs means the sets of standard contractual clauses published by the EU Commission on June 4, 2021.
Subprocessor means any processor that Teamtailor uses to process Customer Personal Data.
Subprocessor Change Date means the date when Teamtailor intends to start using a new subprocessor, or replace an existing one.
Supervisory Authority means a public authority that investigates and enforces compliance with an Applicable Data Protection Law.
Third Country Transfer means (i) where the GDPR applies, a transfer of Customer Personal Data to a country, territory or international organization outside of the EU/EEA; (ii) where the UK GDPR applies, a transfer of Customer Personal Data from the UK to another country, territory or international organization.
TOMS means the technical and organizational measures that we maintain to make sure that Customer Personal Data is secure when processed in the Service. The TOMS are described in Appendix 2.
UK Transfer Addendum means the International Data Transfer Addendum to the EU SCC, published by the UK Information Commissioner’s Office on March 21, 2022.
Other terms have the meaning given to them in Applicable Data Protection Law. For example, the terms controller, processor, processing, data subject, and personal data breach have the meaning given to them in the GDPR. The terms sell, share, and service provider have the meaning given to them in the CCPA.
2. Your responsibilities
You decide and control which type of Customer Personal Data is processed in the Service, for which purposes and for how long. For this reason, you are the sole controller of the Customer Personal Data. As the sole controller, you are responsible for:
Making all contractual arrangements necessary for you to be able to act as the sole controller, for example with other companies in your company group.
Ensuring that there is a legal basis for all processing of the Customer Personal Data.
Ensuring that the data subjects get all information they are entitled to under Applicable Data Protection Law, for example through appropriate privacy notices.
Ensuring that the processing of Customer Personal Data otherwise fulfills the requirements in Applicable Data Protection Law.
Providing us with documented instructions on how to process the Customer Personal Data. You have done so by way of this DPA, and the rest of the Agreement.
3. Our responsibilities
We will act as your processor / service provider. We will not process, sell, retain, use, or disclose Customer Personal Data for any other purpose than providing the Service in accordance with your instructions, as described in this DPA and in the rest of the Agreement, unless required to do so by (i) Union or Member State law; or (ii) by third-country law that ensures an essentially equivalent level of protection of the Customer Personal Data; to which we are subject. In such a case, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
We will inform you if, in our opinion, instructions given by you infringe Applicable Data Protection Law.
The parties acknowledge and agree that our access to Customer Personal Data is not part of the payment exchanged by the parties under the Agreement.
4. Security and confidentiality
You have assessed the risks involved with the processing of the Customer Personal Data in the Service, and concluded that the TOMS ensure a level of security that is appropriate to the risks involved.
We will make sure that all our employees (and similar representatives) who have access to Customer Personal Data commit to keep it confidential.
5. Personal data breaches
We will notify you about a personal data breach affecting the Customer Personal Data. The notice will be sent without undue delay, and at least within 48 hours of Teamtailor becoming aware of the personal data breach.
The notice will be sent to the email address that you have provided for your “privacy manager” in the Service. If you haven’t provided an email address for your “privacy manager” in the Service, the notice will be sent to the email address for your “career site manager” in the Service.
If this information is available to us when sending the notice, the notice will include a description of:
The nature of the breach, i.e. what has happened to the Customer Personal Data.
What parts/type of Customer Personal Data is affected by the breach.
Which categories of data subjects, and approximate number of data subjects, are affected by the breach.
Our assessment of the likely consequences of the breach.
The measures that we have already taken and, if applicable, still plan to take to investigate and address the breach.
If we don’t have all of this information when first notifying you, we will execute the notification in phases - as relevant information becomes available.
If you decide to notify a personal data breach affecting the Customer Personal Data to a Supervisory Authority, to the data subjects, or the public, you will make reasonable efforts to provide us with advance copies of the notice(s), and give us an opportunity to provide any clarifications or corrections to them.
6. Subprocessors
The Teamtailor group uses subprocessors when providing the Service. A continuously up to date overview of the subprocessors we use, the function they perform in the Service, etc. is available:
In the list of subprocessors for our EU Region - if you have selected to have the Customer Personal Data processed in our EU Region.
In the list of subprocessors for our US Region - if you have selected to have the Customer Personal Data processed in our US Region.
In the list of subprocessors for our APAC Region - if you have selected to have the Customer Personal Data processed in our APAC Region.
You are aware of and instruct us to use the current subprocessors. You generally authorise us to use subprocessors when providing the Service, provided that we notify you before starting to use a new subprocessor or replacing an existing one, so that you can object to the change.
We will notify you about our intention to start using a new subprocessor or replace an existing one, at least fourteen (14) calendar days before the Subprocessor Change Date. The notice will be sent to the email address that you have provided for your “privacy manager” in the Service. If you haven’t provided an email address for your “privacy manager” in the Service, the notice will be sent to the email address for your “career site manager” in the Service.
You can object to the change by sending an email to legal@teamtailor.com stating that you object, and the reason(s) for objecting. We will assess whether we can reasonably satisfy the objection, for example by taking any steps that you request. If we aren’t able to solve the issue, the change will take effect, and either party can, for a period of fourteen (14) calendar days after the Subprocessor Change Date, terminate the Agreement without any cost, penalty or liability.
With all current subprocessors and when engaging a subprocessor, we will make sure that general confidentiality and the data protection obligations in this DPA are imposed on the subprocessor. If the subprocessor fails to fulfill these obligations, we will be liable towards you, in accordance with and subject to the limitations in this DPA.
7. Third Country Transfers
We are only allowed to make Third Country Transfers of Customer Personal Data when the Third Country Transfer is based on your written instruction and is executed in line with the transfer requirements in Applicable Data Protection Law. The transfer can for example be based on:
That the country in which the data importer is based is subject to an adequacy decision recognized by Applicable Data Protection Law.
That the data importer is subject to an adequacy decision recognized by Applicable Data Protection Law,and has fulfilled all requirements needed to rely on the adequacy decision - when applicable.
That the data importer enters into the EU SCC or UK Transfer Addendum.
You are aware of and instruct us to perform the Third Country Transfers that take place, or may take place, when we use our current subprocessors. If we notify you of the use of a new subprocessor in accordance with Section 6 above, which involves or may involve a Third Country Transfer, your continued use of the Service will be considered an instruction on us to execute the relevant Third Country Transfer.
8. Additional assistance
Provided that we are able to do so, considering the information about and access to Customer Personal Data that we have in providing the Service to you, we will assist you in:
Providing information relevant for your data protection impact assessment of the Service and your consultation with a Supervisory Authority.
Keeping a record of the processing activities that we do on your behalf.
Responding to Data Subject Requests.
If a data subject contacts Teamtailor directly and makes a Data Subject Request to us, we will not act on it ourselves. Instead, we will encourage the data subject to contact you, by referring him/her to your career site or by submitting a Data Subject Request directly to you.
If you need our assistance with a Data Subject Request or any other process mentioned above, please contact our Customer Support and provide all information we need to understand the scope of the request, and assess what possibilities we have to assist you with it.
9. Audits
We will allow you to audit our compliance with our obligations as your data processor / service provider under the Agreement. This will, as a first option, be done by providing the information and documentation that you reasonably ask for.
If (i) the requested audit scope is addressed in our SOC 2 audit report issued by a third party auditor in the past twelve (12) months; and (ii) we provide such a report to you confirming there are no known material changes in the controls audited; you agree to accept the findings presented in the third party audit report, rather than requesting an audit of the same controls covered by the report.
If you think it is necessary, we will also allow you (or another party assigned by you, provided that the other party is accepted by us and keeps the information it accesses confidential) to inspect our processing of the Customer Personal Data.
You can request an audit once per year, for which each party will cover its own costs. Additional audits (exceeding one per year) can also be requested, at your sole cost.
Unless an audit is requested by a Supervisory Authority (in which case the circumstances will be adjusted to the Supervisory Authority’s request), you need to provide written notice thirty (30) days in advance of the audit. The audit will be conducted during our normal business hours. It will not involve physical access to the servers on which the Service is hosted; not involve disclosure of commercially sensitive parts of the agreements with our subprocessors; and must be performed so that it does not compromise the security of our systems or premises.
10. Erasure and return of Customer Personal Data
When the Agreement is terminated, you should - within thirty (30) days of the termination of the Agreement - instruct us to return and/or destroy all Customer Personal Data from the Service. We will comply with this instruction as soon as reasonably practicable, and at least within sixty (60) days after the termination of the Agreement.
If you have not requested erasure or return of the Customer Personal Data within those thirty (30) days, we will delete all Customer Personal Data as soon as reasonably practicable, and at least within sixty (60) days after the termination of the Agreement.
APPENDICES
Appendix 1 - Description of the processing
What processing will happen, and for which purposes?
The purpose of the processing is to allow you to use the Service. We will also process Customer Personal Data for purposes that are necessary to enable and support your specific use of the Service, such as logging, troubleshooting and investigating and managing incidents.
You fully control which features in the Service will be used and which information is to be collected from individuals.
Who are the data subjects?
The Service is designed to be used to manage your employer branding, recruitment and onboarding processes. For these purposes, a customer normally only needs to process personal data about:
The customer's Users (usually employees, representatives, consultants, individuals referring a candidate)
Different types of candidates, e.g. individuals visiting the company’s career site, individuals connecting with the company, job applicants, referred and sourced candidates. This may also include a candidate who has been selected for a position, e.g. because the candidate will be onboarded to the position in the Service.
Individuals listed as a reference by a candidate
However, you fully decide and control what Customer Personal Data is actually processed in the Service.
What type of Customer Personal Data will be processed?
A customer is expected to collect and process the personal data that is necessary to perform its employer branding, recruitment and onboarding activities.
This usually consists of personal data related to the candidates, such as:
Names
Emails
Photos and videos
Answers to questions part of the recruitment process
Messages with the recruiting User
CV
IP-number
Other information provided by the candidates and/or partners integrated to the Service.
Onboarding information
Personal data is also processed about the Users, such as:
Name
Company email address
Messages with candidates
Different actions taken in the Service.
Personal data is also processed about individuals listed as a reference by a candidate, such as:
Name
Contact details
Messages with references
However, you fully decide and control what Customer Personal Data is actually processed in the Service.
For how long will Customer Personal Data be processed?
The customer, as the data controller, decides how long different types of personal data will be stored, and for which purposes. A number of retention/deletion settings are offered in the Service for this purpose.
If Customer Personal Data is deleted in the application, it is immediately deleted from your account and only maintained in our backups. Our backups are generally retained for ten (10) days.
However, for some features in the Service, we use subprocessors that retain the personal data they process on your behalf for up to thirty (30) days after deletion.
Our processing of Customer Personal Data will stop after the termination of the Agreement, as described under “Erasure and return of Customer Personal Data” in section 10 of the DPA.
Note that a limited amount of personal data is also stored in logs:
Teamtailor keeps application and infrastructure logs which contain personal data such as IP-addresses, IDs to objects in Teamailor, and user email addresses. The application- and infrastructure logs are stored for 365 days, and Teamtailor acts as a data controller in collecting and keeping these logs.
Teamtailor keeps logs of candidate-related events, which contain personal data such as all data provided in job-applications, and in operations performed in the Teamtailor application by users. The logs of candidate-related events are stored for twenty-eight (28) days, and Teamtailor acts as your data processor in collecting and keeping these logs.
You can also choose to activate an audit log functionality, to be able to keep track in detail of your Users’ activities in the Service. You decide for how long these logs are kept, and you can find information about the events collected in these logs here. Teamtailor acts as your data processor in collecting and keeping these logs.
Appendix 2 - TOMS
The following document contains TOMs as implemented by Teamtailor.
Measures to Ensure Confidentiality (Art. 32 para. 1 lit. b of the GDPR)
Physical access control
Customer Personal Data is stored in physical data centres certified according to ISO27001, ISO27017, ISO27018, ISO27701, ISO22301, CSA STAR CCM v4.0, SOC2 Type
Physical access to the data centre facilities is strictly controlled and limited to selected staff at the hosting provider.
Protection against environmental hazards such as heat, fire and water damage is in place.
There is no unauthorised physical access to data centres.
Logical access control
Logical access controls are designed to manage access to information and system functionality based on authority levels and job functions (granting access on a need-to-know and least privilege basis).
All Teamtailor representatives have unique IDs and passwords, and strong and phishing resistant authentication methods are used where possible.
Granted system access is reviewed regularly and access is revoked/changed when employment terminates or in case of changes in job functions.
Access to Customer Personal Data is restricted to selected Teamtailor staff. Teamtailor employees are only accessing or interacting with Customer Personal Data when necessary to provide services requested by the Customer.
All endpoint devices of Teamtailor representatives use strong passwords, local firewalls, automatic time based locking and encrypted storage.
Separation of control
Customer Personal Data is processed in systems that are dedicated to the provision of the Service. The Customer Personal Data will not be shared or distributed to other systems, services or applications.
Production and test environments are separated and do not share any data.
Within individual databases, data is segregated with logical access control.
Customer Personal Data is not used for purposes other than providing the Service.
Human resource security
All Teamtailor representatives are bound by confidentiality, non-disclosure provisions and undergo continuous security awareness training.
Onboarding and offboarding procedures are in place.
Segregation of duties is applied where it is practically possible.
Measures to Ensure integrity (Art. 32 para. 1 lit. b of the GDPR)
Transfer control
All communication, over the internet and on internal networks, are encrypted with at least TLS version 1.2.
Data stored in Teamtailor’s application is encrypted at rest with at least file-system level encryption.
Change management
Change management procedures and tracking mechanisms are in place to test, approve and track all material changes to the Service .
Code changes are automatically blocked if vulnerabilities in third party dependencies are identified or if static code analysis identifies unsafe patterns.
All changes are peer reviewed.
System monitoring
Application and infrastructure events are logged, monitored and automatically analysed to record and detect divergent user access and system activity.
Logs are protected from loss and manipulation.
Measures to Ensure Availability and Resilience (Art. 32 para. 1 lit. b of the GDPR)
Resilience
Teamtailor’s infrastructure and components are designed to withstand intermittent and as well as high constant loads.
Vulnerability screening, patch management and anti-malware protection are implemented to prevent, identify and mitigate against identified security threats, viruses and other malicious code.
Measures to Quickly Restore the Availability of Personal Data after a Physical or Technical Incident (Art. 32 para. 1 lit. c of the GDPR)
Disaster recovery plan
Disaster recovery plans are designed to maintain service and/or recovery from foreseeable emergencies or disasters.
Backups are stored off-site and encrypted.
Restore tests are done at least every six (6) months.
Incident management
Incident management procedures are in place to ensure a systematic approach to identify, mitigate, learn and report incidents related to our technology and information assets.
Procedures for periodical review, assessment, and evaluation (Art. 32 para. 1 lit. d of the GDPR; Art. 25 para. 1 of the GDPR)
Teamtailor runs an information security program with dedicated staff responsible for the development, implementation and maintenance of the program.
Information risk assessments are used to systematically evaluate threats and vulnerabilities in terms of the impact they could imply and the probability to occur. Such assessments are performed at least annually or at major business changes.
