Legal
Data Processing Addendum
Annex to the Terms & Conditions for Providers
Effective Date: 20 September 2026
This Data Processing Addendum (the "DPA") forms part of the Terms & Conditions for Providers (the "Agreement") between:
Controller: the Provider organisation that accepts the Agreement ("you", "Controller")
Processor: Talent Journey, LDA, NIPC 518824799, Rua da Baldrufa, nº 239, 2º Fração T, 4990-035 Ponte de Lima, Portugal ("we", "Processor")
It applies when we process personal data on your documented instructions in order to provide the Platform. It does not apply where we act as an independent controller (for example Provider-staff accounts, our billing of you, and security of the Platform as described in the Privacy Policy).
If there is a conflict between this DPA and the rest of the Agreement about data processing, this DPA prevails.
1. Definitions
Terms in the GDPR have the same meaning here. "Personal Data", "Processing", "Data Subject", "Sub-processor", and "Personal Data Breach" have their GDPR meanings. "Services" means Platform access under the Agreement.
2. Description of Processing
The subject matter, duration, nature, purpose, types of personal data, and categories of data subjects are set out in Schedule 1.
3. Instructions
We will process Personal Data only:
- On your documented instructions, including those in the Agreement, this DPA, and settings you configure in the Platform; and
- As required by EU or Member State law, in which case we will tell you before processing unless the law prohibits that notice.
The Agreement, your use of the Platform, and this DPA are your complete instructions. Additional instructions must be in writing. If we believe an instruction infringes the GDPR or other Union or Member State data-protection law, we will tell you.
4. Confidentiality of Personnel
We will ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5. Security
Taking into account the state of the art, costs, the nature of the processing, and the risk to data subjects, we will implement appropriate technical and organisational measures under Article 32 GDPR, including as appropriate:
- Encryption in transit
- Access control on a need-to-know basis
- Authentication of authorised users
- Logging of relevant access
- Backup and restoration arrangements in the EU
- Processes for testing and evaluating security
A general description is in the Privacy Policy. A more detailed description is available to you on reasonable request, subject to confidentiality.
You are responsible for measures on your side (staff access, device security, and the lawfulness of data you upload).
6. Sub-processors
You give general written authorisation for us to engage Sub-processors in the categories in Schedule 1.
We will impose data-protection obligations on Sub-processors that are in substance no less protective than this DPA, including Article 32 security duties.
We remain liable to you for the Sub-processor's performance of those obligations.
We will tell you of intended additions or replacements of Sub-processors on at least fourteen (14) days' notice (email or Platform notice), except where an urgent replacement is needed for security or continuity, in which case we will notify as soon as possible.
You may object on reasonable data-protection grounds within that period. If you object and we cannot reasonably accommodate it, you may terminate the affected Services as your sole remedy.
A current list of Sub-processors is available on request at privacy@talentjourney.tech.
7. International Transfers
We will not transfer Personal Data outside the EU/EEA except:
- To a country covered by an adequacy decision; or
- Under the European Commission's Standard Contractual Clauses (or another valid Chapter V GDPR mechanism), with supplementary measures where required; or
- On your documented instruction (for example you or Your Client submit a file to an embassy outside the EEA).
Where SCCs are used, you authorise us to enter them on your behalf as needed for Sub-processor transfers, or we will ensure the Sub-processor is bound by them.
8. Assistance with Data-Subject Rights
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, to fulfil your duty to respond to requests under GDPR Chapter III.
If we receive a request from a data subject that clearly relates to your controllership, we will redirect the person to you and notify you, unless we are legally required to respond ourselves. We will not respond substantively as controller of that case content.
9. Assistance with Security, Breaches, DPIAs, and Consultations
Taking into account the nature of processing and information available to us, we will assist you with:
- Article 32 (security)
- Articles 33 and 34 (Personal Data Breaches)
- Articles 35 and 36 (DPIAs and prior consultation)
on reasonable request. If the assistance goes beyond what is strictly required to provide the Platform, we may charge reasonable costs, notified in advance.
10. Personal Data Breach
We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Personal Data we process for you, and in any event in time to help you meet the Article 33 72-hour clock where that clock applies to you.
The notice will describe, to the extent then known: the nature of the breach; categories and approximate numbers of data subjects and records; likely consequences; measures taken or proposed; and a contact point. We may provide information in phases.
We will reasonably cooperate with your investigation and notifications. That cooperation is not an admission of fault.
11. Deletion or Return
When the Agreement ends, or earlier if you instruct us in the Platform or in writing, we will, at your choice, delete or return Personal Data, and delete existing copies, unless EU or Portuguese law requires storage (for example tax records that we hold as controller, or a legal hold).
Backup copies will expire in the ordinary backup cycle. Export tools and the 30-day post-termination export window in the Provider Terms apply.
12. Audits and Information
We will make available information reasonably necessary to demonstrate compliance with Article 28 and this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you mandate, subject to:
- Reasonable written notice (at least thirty (30) days, unless a supervisory authority requires faster action)
- Confidentiality
- No more than one audit per twelve (12) months unless a breach or authority request justifies another
- No access to other customers' data or to information that would compromise security
We may satisfy an audit with up-to-date third-party certifications or audit reports where they reasonably cover the request. On-site inspection, if still needed, will be during business hours with minimal disruption. You bear your auditor's costs; we bear our internal costs unless the audit shows a material breach of this DPA attributable to us.
13. Records and Cooperation with Authorities
We will maintain Article 30(2) records for this processing and cooperate with the CNPD or other competent authority as required by law.
14. Liability
Liability under this DPA is subject to the caps and exclusions in the Provider Terms, except that nothing limits either party's liability to a data subject under Articles 82 GDPR, or any liability that cannot be limited by law.
Each party remains liable to data subjects as the GDPR provides (controller vs processor).
15. Term
This DPA lasts for as long as we process Personal Data for you under the Agreement and until deletion or return under Section 11.
16. Governing Law
This DPA follows the governing law and courts of the Provider Terms.
Schedule 1 — Description of Processing
Subject matter: Hosting and operation of the Talent Journey Platform so the Controller can manage relocation and related cases for the Controller's own company and talent clients.
Duration: The term of the Agreement, plus any post-termination retention required by the Agreement, this DPA, or law.
Nature and purpose: Storage, retrieval, transmission, display, backup, and related processing of case files, messages, and account data, solely to provide the Platform on the Controller's instructions.
Categories of data subjects:
- Talents and family members the Controller invites or records
- Staff of the Controller's client companies
- Other individuals whose data the Controller (or those talents) upload (for example landlords' contacts)
Types of personal data:
- Identity and contact data
- Employment and immigration-related data
- Documents uploaded to cases (which may include passport copies, civil-status documents, qualifications, and similar)
- Platform messages and case notes the Controller's users create
- Special-category data (for example health certificates) and criminal-record data (police certificates) only if the Controller uploads them for immigration or related procedures
We do not decide to collect special-category data; you do, and you must have an Article 9/10 GDPR basis.
Categories of Sub-processors:
- EU-hosted cloud infrastructure, hosting, and backup
- Email, messaging, and support tooling
- Security and monitoring tooling
Controller obligations (summary): You determine purposes and means; you provide GDPR notices to data subjects; you ensure a lawful basis; you configure access for your staff; you handle data-subject requests as controller.
Processor obligations (summary): We host and process only as instructed, keep data in the EU unless Section 7 applies, and support you as this DPA requires.
END OF DATA PROCESSING ADDENDUM
This DPA is effective as of 20 September 2026 and is incorporated into the Terms & Conditions for Providers.