JobJitsu
Get started

Data Processing Agreement (DPA)

pursuant to Art. 28 GDPR
Integral part of the Terms and Conditions (T&C) of JobJitsu
Effective: August 2026

This is the English translation of the German "Auftragsverarbeitungsvertrag (AVV)".
In case of discrepancies, the German version shall prevail.

The processor within the meaning of this agreement is Thomas Gießel, Samoastraße 22, 13353 Berlin, operator of the JobJitsu platform (hereinafter "JobJitsu"). The controller is the respective customer under the main agreement (T&C).

This agreement is concluded in electronic form as part of the T&C; no signature is required (Art. 28 (9) GDPR).

§ 1 Subject Matter and Term

  1. This agreement governs the processing of personal data by JobJitsu as processor on behalf of the respective customer as controller.

  2. Processing is carried out exclusively in connection with the use of the platform "JobJitsu" and on the basis of the main agreement (T&C).

  3. The term of this agreement corresponds to the term of the main agreement.

§ 2 Nature and Purpose of Processing

  1. Processing is carried out solely for providing the platform services, in particular:
    • storage of job advertisements
    • receipt and provision of applications
    • provision of management functions
  2. No processing for own purposes takes place. Excepted is the compilation of aggregate service statistics: in order to measure and develop its own performance, JobJitsu evaluates how many applications a job advertisement receives, what processing status they have, in which period they arrive and by which route the advertisement was reached. This processing takes place outside this agreement, under JobJitsu's own responsibility (Art. 6(1)(f) GDPR); details are set out in the privacy policy. The result is always an aggregate and is not used in support of measures or decisions regarding any particular natural person. No assessment of individual persons, no profiling, no linking of a person across several job advertisements or controllers, and no disclosure of the results to third parties take place.

§ 3 Categories of Personal Data

Depending on use, the following data may in particular be processed:

Applicant data

  • name
  • contact details
  • information on language skills
  • application documents
  • additional submitted information
  • data arising in the course of the procedure (processing status, history of processing, notes made by the controller)
  • special categories of personal data (Art. 9 GDPR), insofar as applicants voluntarily provide them in their documents (e.g. information on health or a severe disability)

§ 4 Categories of Data Subjects

  • applicants

§ 5 Instructions

  1. Processing is carried out exclusively on documented instructions of the controller – including with regard to transfers of personal data to a third country – unless JobJitsu is required to process by Union or Member State law to which JobJitsu is subject. In such a case, JobJitsu informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

  2. Instructions generally result from the use of the platform.

  3. If JobJitsu considers an instruction to infringe data protection law, it informs the controller without undue delay; execution of the instruction may be suspended until it is confirmed or amended.

§ 6 Confidentiality

Persons with access to personal data are bound by confidentiality obligations.

§ 7 Technical and Organizational Measures

  1. JobJitsu implements appropriate measures pursuant to Art. 32 GDPR.

  2. These include in particular:

    • hosting and database within the EU
    • encryption in transit (TLS) and at rest
    • role-based access restrictions
    • regular backups with point-in-time recovery
    • logging and monitoring
    • separation of development and production environments
    • regular security updates

§ 8 Sub-processors

  1. Only service providers processing personal data within the scope of this agreement qualify as sub-processors. Ancillary services (e.g. telecommunications, maintenance) do not constitute sub-processing.

  2. The controller grants general authorization for the engagement of the sub-processors listed in the service provider list.

  3. JobJitsu informs the controller in text form (e.g. by email) at least 14 days before adding or replacing a sub-processor. The controller may object to the change within 14 days on important data protection grounds.

  4. Where, in the event of an objection, JobJitsu cannot provide the service without the sub-processor concerned, either party is entitled to terminate the main agreement.

  5. JobJitsu imposes on sub-processors the same data protection obligations pursuant to Art. 28 GDPR and remains responsible to the controller for their compliance.

§ 9 Third-Country Transfers

  1. Processing takes place within the EU/EEA as a rule.

  2. Where personal data is transferred to a third country – in particular by sub-processors – this occurs only where an adequacy decision of the European Commission exists or appropriate safeguards within the meaning of Art. 46 GDPR (in particular EU Standard Contractual Clauses) are in place.

  3. Transfers marked in the service provider list are deemed instructed by the controller on a documented basis.

§ 10 Assistance Obligations

  1. Taking into account the nature of the processing, JobJitsu assists the controller by appropriate technical and organizational measures, insofar as this is possible, in responding to requests for exercising the data subject's rights (Chapter III GDPR).

  2. Taking into account the nature of the processing and the information available to JobJitsu, JobJitsu assists the controller in ensuring compliance with the obligations under Art. 32 to 36 GDPR, in particular with the notification of personal data breaches, a data protection impact assessment and a prior consultation of the supervisory authority.

§ 11 Notification of Data Breaches

  1. JobJitsu informs the controller without undue delay of any personal data breaches that come to its knowledge.

  2. The notification includes, as far as available, a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available is provided in phases without undue further delay.

§ 12 Evidence and Audits

  1. Upon request, JobJitsu provides the controller with the information necessary to demonstrate compliance with this agreement. Such evidence may also be provided by way of current certifications, attestations or audit reports.

  2. Where such evidence is insufficient, JobJitsu allows for audits, including inspections, by the controller or an auditor mandated by it and bound to confidentiality – subject to reasonable prior notice, during normal business hours, no more than once per year (more frequently in the event of a substantiated cause), and without impairing operations or the security of other customers.

§ 13 Retention, Deletion and Return

  1. Upon termination of the main agreement, JobJitsu, at the controller's choice, returns or deletes the personal data and deletes existing copies within 30 days of termination, unless statutory retention obligations apply.

  2. During the term of the agreement, applicant data is stored for six months from the receipt of the respective application. After that period JobJitsu anonymizes the data so that it can no longer be attributed to a person. Remaining non-personal information – such as the number, status and period of applications – may continue to be used for statistical purposes.

  3. This period constitutes a documented instruction of the controller within the meaning of § 5. The controller ensures that it is compatible with its own retention obligations and interests. Deviating instructions by the controller in text form remain unaffected; their technical feasibility is to be agreed separately.

  4. JobJitsu informs the controller in text form before applications for a job ad are anonymized for the first time, so that the controller can access the data in good time. This information is generally provided one month in advance.

  5. Paragraph 1 does not apply to a log of the actions by which persons who have access to the controller's data on behalf of JobJitsu change, delete or disclose that data via the platform. JobJitsu keeps this log for twelve months to demonstrate the lawfulness of processing (Art. 5(2) GDPR) and to ensure the security of processing (Art. 32 GDPR). It contains only identifiers and the type, time and outcome of each action, no content, and is deleted automatically once that period has passed.

§ 14 Liability

Liability is governed by the provisions of the T&C.