Data Processing Agreement (DPA)

1. Parties and scope

1.1 This Data Processing Agreement (“DPA”) is entered into between the Customer (the “Controller”) and CVtoBrand as defined in Article 1.1 of the CVtoBrand Terms of Service (“CVtoBrand”, the “Processor”), and forms part of those Terms (the “Terms”). CVtoBrand discloses its full legal identity to the Controller on request, as set out in Article 1.1 of the Terms.

1.2 This DPA applies to all personal data that CVtoBrand processes on behalf of the Customer when providing the Service, as described in Annex A.

1.3 Notices to CVtoBrand under this DPA, including notifications of personal data breaches, data subject requests and objections to sub-processors, are sent to [email protected]. Notices under this DPA may validly be given by email in accordance with Article 19.4 of the Terms.

2. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject” and “personal data breach” have the meaning given in the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Other capitalised terms have the meaning given in the Terms.

3. Subject, nature, purpose and duration

CVtoBrand processes personal data only to provide the Service: converting the text that the User’s browser extracts from CVs into CV profiles in the Customer’s house style, in the chosen language and version (with or without the candidate’s identifying details), storing those profiles in the Customer’s Workspace for the retention period set by the Controller, and making them available for PDF export. CV source files and photos are not stored by CVtoBrand; photos remain on the User’s device. The processing lasts for the term of the Terms and until deletion under Article 13. Details are in Annex A.

4. Responsibilities of the Controller

4.1 The Controller is solely responsible for the lawfulness of the processing and for complying with the laws and regulations of its own country and of any other country that applies, including having a lawful basis, informing data subjects, deciding what data to upload, setting retention periods, deciding whether to anonymise, and sharing Output with third parties.

4.2 The Controller ensures that its instructions comply with the law and that it does not upload more personal data than necessary. If special categories of personal data are included in CVs, the Controller alone is responsible for that.

4.3 CVtoBrand does not check whether the Controller’s processing is lawful and gives no legal advice.

5. Instructions

CVtoBrand processes personal data only on the Controller’s documented instructions, which consist of these Terms, this DPA and the Controller’s use of the Service’s functions, unless processing is required by law; in that case CVtoBrand informs the Controller beforehand where permitted. CVtoBrand informs the Controller if, in its opinion, an instruction infringes the GDPR, without being obliged to assess instructions.

6. Confidentiality

CVtoBrand ensures that persons authorised to process the personal data are bound by confidentiality.

7. Security

CVtoBrand takes appropriate technical and organisational measures, taking into account the state of the art, costs and the risks of the processing, as described in Annex B. The Controller confirms that it has assessed these measures and considers them appropriate for its processing.

8. Sub-processors

The Controller gives general authorisation for the use of the sub-processors listed in Annex C. CVtoBrand informs the Controller in advance of new or replaced sub-processors; the Controller may object on reasonable grounds within 14 days. If no solution is found, the Controller may terminate the affected part of the Service as its sole remedy. CVtoBrand imposes on each sub-processor the same data protection obligations as set out in this DPA, by contract, and remains responsible towards the Controller for the performance of its sub-processors’ obligations in accordance with Article 28(4) GDPR.

9. International transfers

Personal data is only transferred outside the European Economic Area if appropriate safeguards are in place in accordance with Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses.

10. Assistance

Taking into account the nature of the processing, CVtoBrand assists the Controller with reasonable measures in responding to data subject requests and in meeting its obligations on security, data protection impact assessments and prior consultation. Requests that data subjects send to CVtoBrand directly are forwarded to the Controller. CVtoBrand may charge reasonable costs for assistance beyond the standard functions of the Service.

11. Personal data breaches

CVtoBrand notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s personal data, and provides the information reasonably available to help the Controller meet its own notification obligations. Notifying supervisory authorities and data subjects is the Controller’s responsibility.

12. Information and audits

CVtoBrand makes available all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it and bound by confidentiality. CVtoBrand may first provide documentation, certifications or audit reports; the Controller considers in good faith whether these suffice. Audits take place at most once a year, after at least 30 days’ notice and during business hours, unless (i) a supervisory authority requires otherwise, (ii) a personal data breach affecting the Controller’s data has occurred, or (iii) there are reasonable indications that CVtoBrand does not comply with this DPA. Audits are at the Controller’s expense, unless the audit shows a material breach by CVtoBrand.

13. Return and deletion

13.1 Generated CV profiles are stored in the Controller’s Workspace only for the retention period set by the Controller’s admin in the Service (currently 7, 14, 30, 60 or 90 days; default 14 days). Changing the retention period does not extend profiles that already exist. When the period ends, the profile is deleted. Audit log entries (no CV content) are kept for no longer than 12 months.

13.2 CV source files are read in the User’s browser and are not stored by CVtoBrand. Photos remain on the User’s device. The text extracted from a CV is sent to the AI service only for conversion and is not stored by CVtoBrand’s application. Any temporary retention by the AI provider, for example for caching or abuse monitoring, is governed by Google Cloud’s terms for Vertex AI, under which customer data is not used to train Google’s models without permission. PDFs the Controller exports are outside the Service and are the Controller’s responsibility.

13.3 When the Controller deletes its account (in the Service where that function is available, or by request to [email protected]), or the Terms end in any other way, including by termination or non-renewal, a cancellation period of 10 days starts. During this period the Controller can export any Output it still needs (if necessary, CVtoBrand restores access on request, for export only) and, if it requested the deletion itself, undo the deletion. The export function is the way personal data is returned to the Controller, and this period is the Controller’s last opportunity to use it. CV profiles whose own retention period ends earlier are deleted at that earlier time.

13.4 When the cancellation period ends, CVtoBrand permanently deletes all personal data of the Controller’s Workspace, including User accounts, CV profiles, settings, audit logs and usage data, without undue delay and no later than 30 days after the end of the cancellation period; until then, that data is not processed for any other purpose. On request, CVtoBrand confirms the deletion by email. The only exception is invoice and payment records that CVtoBrand must keep under Dutch law (Article 2:10 Dutch Civil Code and Article 52 General State Taxes Act); these are kept for 7 years, are limited to what is needed for that purpose and contain no CV or candidate data.

13.5 Back-ups: if back-up or recovery features of CVtoBrand’s sub-processors hold copies of personal data, those copies are used only to restore the Service after an incident, remain protected by the measures in Annex B and are deleted or overwritten when their fixed retention period ends. Deleted data may also remain in the sub-processors’ internal back-up and disaster-recovery systems for a limited period before it is permanently overwritten, in accordance with their data processing terms (Annex C).

14. Liability

The exclusions and limitations of liability in the Terms (Article 13) apply in full to this DPA. To the extent permitted by mandatory law, CVtoBrand is not liable for damage, fines or claims resulting from the Controller’s processing, instructions or non-compliance with any law or regulation, and the Controller indemnifies CVtoBrand in accordance with Article 14 of the Terms. Nothing in this DPA limits the rights of data subjects under Article 82 GDPR.

15. Term, precedence and law

This DPA applies for as long as CVtoBrand processes personal data on behalf of the Controller. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. This DPA is governed by the same law and jurisdiction as the Terms. Article 19.2 of the Terms (English version prevails) applies to this DPA.

Annex A · Description of the processing

• Data subjects: candidates, job seekers and professionals whose CVs the Controller uploads; the Controller’s Users; contact persons named in CVs or Output (such as recruiters and references).
• Categories of personal data: the text extracted from CVs, such as name, contact details, date of birth, work history, education, skills, languages, certificates and other information the CV contains; recruiter contact details and reference numbers added to Output; User account data. CV source files and photos are not received or stored by CVtoBrand; photos remain on the User’s device.
• Special categories: CVs may incidentally contain special categories of personal data (Article 9 GDPR) or data on criminal convictions (Article 10 GDPR). The Service is not designed for them and the Controller should remove them where they are not necessary. If they are uploaded, the Controller is responsible for the applicable exception and legal basis; CVtoBrand processes them under the same measures as all other personal data (Annex B).
• Nature and purpose: receiving the text extracted from CVs in the User’s browser, automated (AI-assisted) restructuring and translation, applying the Controller’s branding, removing identifying details on request, storage in the Workspace for the retention period set by the Controller, and PDF export.
• Duration: the term of the Terms plus the deletion period in Article 13.

Annex B · Technical and organisational measures

Access and authentication

• All access to the app requires an account login. A second factor (authenticator app or phone) is required for operational access.
• Role-based access per Workspace (admin and recruiter); platform administration is a separate role.
• The database does not allow direct read or write access from browsers (deny-all security rules); all data access runs through server-side functions that check the User’s Workspace and role.
• The app uses Firebase App Check (reCAPTCHA Enterprise) to help protect the back end against abuse.
• CVtoBrand gives access to production data only to persons who need it to provide, secure or support the Service and who are bound by confidentiality (Article 6).

Data minimisation and separation

• Logical separation of customer Workspaces (multi-tenant isolation).
• CV source files are read in the User’s browser and are not uploaded or stored by CVtoBrand. Only the extracted text is sent to the back end and to the AI service. Photos remain on the User’s device and are only added to the PDF there.
• Application logs contain no CV text and no access tokens.

Retention

• Generated CV profiles are kept only for the retention period chosen by the Workspace admin (7, 14, 30, 60 or 90 days; default 14) and are then deleted.
• Invitations expire after a limited period (normally 7 days).
• When a customer account is deleted or the agreement ends, a cancellation period of 10 days applies; after that, all data of the Workspace is deleted without undue delay and no later than 30 days later (Article 13).
• Audit log entries contain no CV content and are kept for no longer than 12 months.

Encryption and network

• Encrypted connections (HTTPS/TLS) between browser, app and back end.
• Security headers on the app, including X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy and Permissions-Policy.
• Data at rest is encrypted by the cloud provider’s default encryption.

Location and providers

• Back-end functions run in Google Cloud region europe-west4 (Netherlands). AI processing uses Vertex AI in the EU multi-region. The database and the other services used are listed with their locations in Annex C.
• AI processing uses Google Cloud’s Vertex AI (enterprise terms), not a consumer AI service.

Back-ups and continuity

• Back-up or recovery copies, if any, are used only to restore the Service after an incident and are subject to the same measures and deletion rules (Article 13.5).

Organisation

• Persons with access to personal data are bound by confidentiality (DPA Article 6).
• Personal data breaches are reported to the Controller in accordance with DPA Article 11.

Annex C · Sub-processors

CVtoBrand uses the following sub-processors. Status: 9 November 2026.

CVtoBrand does not use a separate file storage service for CVs: source files are read in the User’s browser and photos remain on the User’s device.