Data Processing Addendum

1. Scope & Definitions

This Data Processing Addendum ("DPA") applies to the processing of personal data in connection with the recruitment services, talent queries, and applicant tracking systems provided on **THE COMMUNITY** (operating under **Mindblowing Jobs**).

Terms used herein such as "Personal Data", "Data Subject", "Processing", and "Supervisory Authority" shall have the meanings mapped to them in the General Data Protection Regulation (GDPR) and other applicable regional privacy legislations.

2. Controller & Processor Roles

The parties acknowledge and agree that:

• Hiring Companies / Partner CROs: Act as **Data Controllers** regarding candidates they search for, invite to apply, interview, or import into their internal ATS databases from the Platform.
• Mindblowing Jobs: Acts as a **Data Processor** (or in some contexts, independent Joint Controller depending on operations) in processing platform search indices, credential records synced from Mindblowing Jobs Academy, and routing CVs.

3. Processor Obligations

Mindblowing Jobs covenants that it will process all Personal Data in accordance with the following terms:

• Documented Instructions: Process personal records solely under the documented instructions of the Controller or to execute requested candidate-to-employer routes.
• Personnel Confidentiality: Ensure that all engineering, operations, and support staff authorized to handle personal candidate profiles have committed themselves to strict confidentiality agreements.
• Data Subject Rights Support: Assist Data Controllers, through appropriate technical measures, in responding to requests from candidate Data Subjects exercising GDPR/CCPA rights (e.g. data access or erasure requests).

4. Approved Subprocessors

Data Controller grants general authorization to Mindblowing Jobs to engage sub-processors to run database pipelines. Our current approved sub-processors are:

We will notify corporate recruiting managers 30 days prior to onboarding new database subprocessors.

5. Security & Breach Notification

We implement state-of-the-art administrative and physical protection protocols (including database encryption at rest, secure SSL transit, and automated access logs).

In the event of a verified security incident resulting in the unauthorized access, disclosure, or alteration of Controller personal data, Mindblowing Jobs will notify affected Controllers within **72 hours** of breach confirmation, providing full telemetry detail to assist Controller compliance.

6. International Data Transfers

If processing involves transferring candidate data outside of regional zones (such as the EEA or Switzerland), the parties agree to execute standard contractual clauses (SCCs) to ensure equivalent protection safeguards.

For further technical alignment regarding our security annexes, please write to support@mindblowingjobs.com.