Last Updated: November 10, 2025
This Data Processing Agreement (“DPA”) forms part of the Agreement between Subscriber and RightMatch. Subscriber and RightMatch are each referred to as a “Party” and collectively as the “Parties”.
Except as modified below, the terms of the Agreement shall remain in full force and effect. Notwithstanding anything to the contrary in the Agreement, if there is a conflict between this DPA and the Agreement, this DPA will control. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
Definitions. The terms used in this DPA shall have the meanings set forth in this DPA or as defined by Applicable Privacy Law, whichever is broader. Capitalized terms not otherwise defined herein or defined by Applicable Privacy Law shall have the meaning given to them in the Agreement. The following terms have the meanings set forth below:
“Affiliate” means an entity that owns or controls, is owned or controlled by, or is under common control or ownership with either RightMatch or Subscriber, respectively.
“Applicable Privacy Law” shall mean applicable data privacy, data protection, and cybersecurity laws, rules and regulations to which RightMatch is subject, including, but not limited to, (a) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its implementing regulations (“CCPA”), (b) the EU General Data Protection Regulation 2016/679 including the applicable implementing legislation of each Member State (“EU GDPR”), (c) the UK Data Protection Act 2018 and the UK General Data Protection Regulation as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) (“UK GDPR” and together with the EU GDPR, the “GDPR”), (d) the Swiss Federal Act on Data Protection of 19 June 1992, as amended (“FADP”), (e) any other applicable law with respect to any Personal Data in respect of which the RightMatch is subject to, and (f) any other data protection law and any guidance or statutory codes of practice issued by any relevant Privacy Authority, in each case, as amended from time to time and any successor legislation to the same.
“Data Subject” shall mean an identified or identifiable natural person.
“EEA” means the European Economic Area.
“Personal Data” shall mean (a) personal data, personal information, personally identifiable information, or similar term as defined by Applicable Privacy law or (b) if not defined by Applicable Privacy Law, any information that relates to a Data Subject; in each case, to the extent Processed by RightMatch, on behalf of Subscriber, in connection with RightMatch’s performance of the Services.
“Privacy Authority” shall mean any competent supervisory authority, attorney general, or other regulator with responsibility for privacy or data protection matters.
“Process”, “Processing” or “Processed” shall mean any operation or set of operations, as defined in the Applicable Privacy Law, performed upon Personal Data whether or not by automatic means, including collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using, disclosing, making available, aligning, combining, blocking, erasing and destroying Personal Data.
“Security Breach” means a breach of RightMatch’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in RightMatch’s possession, custody or control. Security Breaches do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
“Services” shall mean the services as described in the Agreement, including the provision of the RightMatch Platform, or any related order form or statement of work.
“Standard Contractual Clauses” means (a) with respect to restricted transfers (as such term is defined under Applicable Privacy Law) which are subject to the EU GDPR and other Applicable Privacy Laws pursuant to which the same have been adopted, the Controller-to-Processor standard contractual clauses, as set out in the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to GDPR, as may be amended or replaced by the European Commission from time to time (the “EU SCCs”), and (b) with respect to restricted transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual of 21 March 2022, as may be amended or replaced by the UK Information Commissioner’s Office from time to time (the “UK SCCs”).
“Subprocessor” means an entity engaged by RightMatch to assist in fulfilling its obligations with respect to providing the Services pursuant to the Agreement or this DPA, insofar as such an entity Processes Personal Data on behalf of RightMatch.
Processing Requirements.
RightMatch shall comply with Applicable Privacy Law in the Processing of Personal Data and only Process Personal Data for the purposes of providing the Services and in accordance with Subscriber’s instructions, and as may subsequently be agreed between the Parties in writing. RightMatch shall promptly inform Subscriber if (a) in RightMatch’s opinion, an instruction from Subscriber violates Applicable Privacy Law; or (b) RightMatch is required by applicable law to otherwise Process Personal Data, unless RightMatch is prohibited by that law from notifying Subscriber under applicable law. RightMatch will notify Subscriber after making the relevant determination that it can no longer meet its obligations under Applicable Privacy Law. Subscriber will have the right to take reasonable and appropriate steps to (c) ensure that RightMatch uses Personal Data in a manner consistent with Subscriber’s obligations under Applicable Privacy Laws; and (d) upon reasonable notice, stop and remediate the unauthorized Processing of Personal Data by RightMatch. The details of processing are set forth in Section B of Exhibit A.
The parties acknowledge that RightMatch has not and will not receive any monetary or other valuable consideration in exchange for their receipt of the Personal Data, and that any consideration paid by Subscriber to RightMatch under the Agreement relates only to RightMatch’s provision of the Services. RightMatch shall not (a) sell or share (as such terms are defined under the CCPA) Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than for the specific purpose of performing the Services, including retaining, using, or disclosing Personal Data for a commercial purpose other than providing the Services; (c) retain, use, or disclose Personal Data outside of the direct business relationship between the Subscriber and RightMatch; or (d) combine the Personal Data with any other personal information, except as permitted under Applicable Privacy Law.
To the extent RightMatch receives deidentified data from Subscriber or the Services allow for the deidentification of Personal Data, RightMatch represents and warrants that it shall not reidentify, attempt to reidentify, or direct any other party to reidentify any Personal Data that has been deidentified. For the avoidance of doubt, RightMatch is permitted to deidentify Personal Data through a reliable anonymization procedure and use such deidentified data for its own business purposes, including without limitation for security and fraud detection and research and development of new products and services, provided such deidentified data cannot reasonably be linked to Personal Data, directly or indirectly.
RightMatch shall ensure that persons authorized to access Personal Data commit themselves to confidentiality or are under an appropriate obligation of confidentiality.
Through the Services, RightMatch may collect data related to users’ use of the Services (“Usage Data”). Usage Data may include Personal Data. The Parties acknowledge and agree that with respect to Usage Data, RightMatch is an independent controller. RightMatch will process Usage Data as a controller (a) to manage the relationship with Subscriber; (b) to monitor, investigate, prevent and detect fraud, security incidents and other misuse of the Services; (c) for identity verification purposes; (d) to comply with legal or regulatory obligations; and (e) as otherwise permitted under this Agreement or applicable law. Company may also process Usage Data as a controller to provide, optimize, and maintain the Services.
Cooperation.
Data Subject Requests. In the event of a Personal Data request from a Data Subject related to Subscriber is made directly to RightMatch, RightMatch shall inform the requestor that RightMatch is not authorized to directly respond to the request, and recommend the requestor submit the request directly to Subscriber, unless legally compelled to respond under the law applicable to such a request. Subscriber shall bear the responsibility for responding to all such requests. In the event Subscriber requires support from RightMatch in responding to a request from a Data Subject, it may contact RightMatch for assistance. To the extent legally permitted, Subscriber shall be responsible for any costs arising from RightMatch’s assistance.
Data Protection Impact Assessments. To the extent required by Applicable Privacy Laws, RightMatch shall, upon receipt of written request by Subscriber, (a) make available to Subscriber such information as is reasonably necessary to demonstrate Subscriber’s compliance with Applicable Privacy Laws to the extent applicable to the Services, and (b) reasonably assist Subscriber in carrying out any privacy impact assessment.
Privacy Authorities. RightMatch shall provide to Subscriber such co-operation, assistance and information as Subscriber may reasonably request to enable it to comply with its obligations under Applicable Privacy Law and co-operate and comply with the directions or decisions of a relevant Privacy Authority, in each case (a) solely to the extent applicable to Subscriber’s provision of the Services, and (b) within such reasonable time as would enable Subscriber to meet any time limit imposed by the Privacy Authority.
Security of Personal Data. RightMatch shall maintain, during the term of the Agreement, appropriate technical and organizational security measures designed to protect Personal Data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access, as set forth in the Trust Center. RightMatch shall ensure the reliability of any employees who Process Personal Data. Subscriber is responsible for secure and appropriate use of the Services, to ensure a level of security appropriate to the risk in respect of the Personal Data.
Subscriber Obligations. Subscriber shall (a) comply with all applicable laws, including Applicable Privacy Laws, in respect of its use of the Services; (b) ensure that any instructions provided to RightMatch are at all times in accordance with Applicable Privacy Laws; (c) collect all Personal Data in accordance with Applicable Privacy Laws and obtain and maintain all consents and rights necessary for the Processing of Personal Data by RightMatch; and (d) maintain at all times the accuracy, quality, and legality of Personal Data.
Subprocessors.
As part of the provision of the Services, RightMatch may engage Sub-processors to Process Personal Data on Subscriber’s behalf. Subscriber hereby grants RightMatch a general authorization to appoint and use the Subprocessors currently listed in Exhibit C. RightMatch shall provide Subscriber prior notice of any additional or replacement Subprocessors. After being notified, Subscriber must notify RightMatch within fourteen (14) business days of any reasonable objection it has to such Subprocessors. In the event Subscriber provides a reasonable objection, RightMatch will use commercially reasonable efforts to make a change in processing under the Agreement to avoid Processing of Personal Data by such Subprocessor. If RightMatch is unable to make available such change within a reasonable period of time, Subscriber may terminate the Services provided under the Agreement in respect only to those services which cannot be provided by RightMatch without the use of the objected-to Subprocessor, by providing written notice to RightMatch. The Parties agree that Subscriber’s non-response to a notification of any additional or replacement Subprocessors will be taken as the Subscriber’s approval of such additional or replacement Subprocessor.
RightMatch shall remain liable for any Processing of Personal Data by each such Subprocessor as if it had undertaken such Processing itself.
RightMatch will contractually impose data protection obligations on its Subprocessors that are no less onerous than those imposed on RightMatch under this DPA.
Breach Notification.
Notification to Subscriber. Unless otherwise prohibited by applicable law, RightMatch shall notify Subscriber without undue delay after RightMatch confirms a Security Breach. Such notification shall include, to the extent such information is available, (a) a detailed description of the Security Breach, (b) the type of data that was the subject of the Security Breach and (c) the identity of each affected person (or, where not possible, the approximate number of Data Subjects and of Personal Data records concerned). In addition, RightMatch shall communicate to Subscriber (d) the name and contact details of RightMatch’s data protection officer or other point of contact where more information can be obtained, (e) a description of the likely consequences of the Security Breach, (f) a description of the measures taken or proposed to be taken by RightMatch to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects.
Investigation. RightMatch shall take prompt action to investigate the Security Breach and shall use industry standard, commercially reasonable efforts to mitigate the effects of any such Security Breach in accordance with its obligations hereunder.
Audit Rights. Subscriber may audit RightMatch’s compliance with its obligations under this DPA up to once per year and on such other occasions as may be required by Applicable Data Privacy Laws, including where mandated by Subscriber’s Privacy Authority. RightMatch will contribute to such audits by providing Subscriber or Subscriber’s Privacy Authority with the information and assistance that RightMatch considers appropriate in the circumstances and reasonably necessary to conduct the audit. To request an audit, Subscriber must submit a proposed audit plan to RightMatch at least two weeks in advance of the proposed audit date and any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. RightMatch will review the proposed audit plan and provide Subscriber with any concerns or questions (for example, any request for information that could compromise RightMatch security, privacy, employment or other relevant policies). RightMatch will work cooperatively with Subscriber to agree on a final audit plan. Nothing in this Section 8 shall require RightMatch to breach any duties of confidentiality. If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Subscriber’s audit request and RightMatch has confirmed there have been no known material changes in the controls audited since the date of such report, Subscriber agrees to accept such report in lieu of requesting an audit of such controls or measures. The audit must be conducted during regular business hours, subject to the agreed final audit plan and RightMatch’s safety, security or other relevant policies, and may not unreasonably interfere with RightMatch business activities. Any audits are at Subscriber’s sole expense. Subscriber shall reimburse RightMatch for any time expended by RightMatch and any third parties in connection with any audits or inspections under this Section 8 at RightMatch’s then-current professional services rates, which shall be made available to Subscriber upon request. Subscriber will be responsible for any fees charged by any auditor appointed by Subscriber to execute any such audit.
Deletion of Personal Data. RightMatch shall return and/or delete Personal Data in accordance with the applicable provisions in the Agreement. If RightMatch determines that continued retention is required and/or permitted by Applicable Privacy Laws and/or mandatory applicable law, RightMatch shall ensure the confidentiality of such Personal Data and shall extend the protections of this DPA to such Personal Data.
Transfers out of the EEA. If Subscriber transfers Personal Data out of the EEA to RightMatch in a country not deemed by the European Commission to have adequate data protection, such transfer will be governed by the EU SCCs, the terms of which are hereby incorporated into this DPA. In furtherance of the foregoing, the Parties agree that:
Subscriber will act as the data exporter and RightMatch will act as the data importer under the EU SCCs;
for purposes of Annex I to the EU SCCs, the categories of data subjects, data, special categories of data (if appropriate), and the Processing operations shall be as set out in Section B to Exhibit A;
for purposes of Annex II to the EU SCCs, the technical and organizational measures shall be as set out in Exhibit B;
The optional docking clause in Clause 7 of the EU SCCs shall be included;
the audits described in Clause 8.9 of the EU SCCs shall be performed in accordance with Section 8 of this DPA;
Section 6 (Subprocessors) of this DPA shall constitute the procedures for RightMatch to request general authorization for Subprocessors under Clause 9(a)(Option 2) of the EU SCCs;
the optional language in Section 11(a) of the EU SCCs shall not be included;
for Clause 13, the following language shall apply: The supervisory authority with responsibility for ensuring compliance by the data exporter with the GDPR shall act as competent supervisory authority;
Option 1 of Clause 17 shall apply, and the EU SCCs will be governed by the law of the Member State of the supervisory authority with responsibility for ensuring compliance by the data exporter with the GDPR; and
For Clause 18, any dispute arising from the EU SCCs shall be resolved by the courts of the Member State of the supervisory authority with responsibility for ensuring compliance by the data exporter with the GDPR.
Transfers out of the UK. If Subscriber transfers Personal Data out of the UK to RightMatch in a country not deemed by the UK Government to have adequate data protection, such transfer will be governed by the UK SCCs, the terms of which are hereby incorporated into this DPA. RightMatch shall provide a copy of the signed version of the UK SCCs to Subscriber upon request. In furtherance of the foregoing, the Parties agree that Tables 1 through 4 of the UK SCCs shall be satisfied by the following information:
Table 1: Reference to Table 1 shall be satisfied by the information in Section A of Exhibit A.
Table 2: For Table 2, the version of the Approved EU SCCs shall be the EU SCCs, Controller to Processor module.
Table 3: Reference to Table 3 shall be satisfied by the information in Exhibits A, B, and C.
Table 4: For Table 4, the Exporter and Importer shall have the rights outlined in Section 19 of the UK SCCs.
Transfers out of Switzerland. For transfers from Switzerland, references in the EU SCCs shall be interpreted to include the following applicable terminology and statutory terms: (a) the Federal Data Protection and Information Commissioner is the competent supervisory authority; (b) Swiss law (or the law of a country that allows and grants rights as a third party beneficiary for contractual claims regarding data transfers pursuant to the FADP shall be the applicable law for contractual claims under Clause 17 of the EU SCCs; (c) Switzerland is to be considered as a Member State within the meaning of the EU SCCs; (d) data subjects with their regular place of residence in Switzerland are allowed to bring a lawsuit in Switzerland against either the data exporter or the data importer in accordance with Clause 18(c) of the EU SCCs; and (e) references to the GDPR are to be understood as references to the FADP.
Limitation of Liability. The liability of each Party and each Party’s Affiliates under this DPA shall be subject to the exclusions and limitations of liability set out in the Agreement and shall not be modified by this DPA. Any claims brought by a party or its Affiliates under this DPA, whether in contract, tort or under any other theory of liability, shall be subject to the exclusions and limitations set forth in the Agreement, as permitted by applicable law.
Amendments. The Parties acknowledge and agree that, to the extent the Services contemplate the processing of Personal Data that is subject to Applicable Privacy Laws that require additional terms in this DPA, the Parties shall enter into an amendment to this DPA that addresses such additional terms.
EXHIBIT A
LIST OF PARTIES
Data exporter(s):
| Name: | As set forth in the Agreement. |
|---|---|
| Address: | As set forth in the Agreement. |
| Contact person’s name, position and contact details: | As set forth in the Agreement. |
| Activities relevant to the data transferred under these Clauses: | Receipt of the Services under the Agreement. |
| Signature and Date: | The signature in the Agreement shall satisfy this signature requirement. |
| Role (Controller or Processor): | Controller |
Data importer(s):
| Name: | Freelancer Hub, Inc. dba RightMatch |
|---|---|
| Address: | As set forth in the Agreement. |
| Contact person’s name, position and contact details: | As set forth in the Agreement. Inquiries/messages related to this DPA can be sent to engineering@rightmatch.app. |
| Activities relevant to the data transferred under these Clauses: | Provision of the Services under the Agreement. |
| Signature and Date: | The signature in the Agreement shall satisfy this signature requirement. |
| Role (Controller or Processor): | Processor |
| Categories of data subjects whose personal data is transferred | Contact Information, e.g. email address, telephone number, and address; Device information and identifiers, e.g. IP address, cookie IDs, device type, advertising and app identifiers; Audio and video recordings; Personal data for verification purposes, including (but not limited to) identification; and Information that may be present on an applicant’s resume, including employment and education information. |
|---|---|
| Categories of personal data transferred | Subscriber employees and job applicants. |
| Sensitive data transferred (if applicable) | If and only to the extent required to be Processed in order to provide the Services under the Agreement, Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership may be collected. |
| The frequency of the transfer (whether the data is transferred on a one-off or continuous basis) | On a continuous basis during the term of the Agreement. |
| Nature of the processing | As described in the Agreement. |
| Purpose(s) of the data transfer and further processing | As described in the Agreement. |
| The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period | Duration of performance of the Services. |
| For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing | As described in the Agreement. |
The competent supervisory authority shall be the supervisory authority that has jurisdiction over the data exporter.
EXHIBIT B
SECURITY MEASURES
RightMatch has implemented and maintains comprehensive technical and organizational safeguards, which contain those safeguards described below:
Organizational management and dedicated staff responsible for the development, implementation and maintenance of the RightMatch’s information security program.
Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to RightMatch’s organization, monitoring and maintaining compliance with the RightMatch’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.
Data security controls which include, at a minimum, logical segregation of data, restricted (e.g. role-based) access and monitoring, and utilization of commercially available industry standard encryption technologies for Personal Data that is transmitted over public networks (i.e. the Internet) or when transmitted wirelessly or at rest or stored on portable media (i.e. laptop computers).
Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, (e.g. granting access on a need-to-know and least privilege basis, use of unique IDs and passwords for all users, periodic review and revoking/changing access promptly when employment terminates or changes in job functions occur).
Password controls designed to manage and control password strength, expiration and usage including prohibiting users from sharing passwords and requiring that the RightMatch’s passwords that are assigned to its employees: (a) be at least eight (8) characters in length, (b) not be stored in readable format on the RightMatch’s computer systems; (c) must have defined complexity; and (d) newly issued passwords must be changed after first use.
System audit or event logging and related monitoring procedures to proactively record user access and system activity.
Physical and environmental security of data centers, server room facilities and other areas containing Personal Data designed to: (a) protect information assets from unauthorized physical access, (b) manage, monitor and log movement of persons into and out of the RightMatch’s facilities, and (c) guard against environmental hazards such as heat, fire and water damage.
Operational procedures and controls to provide for configuration, monitoring and maintenance of technology and information systems, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from the RightMatch’s possession.
Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to the RightMatch’s technology and information assets.
Incident management procedures designed to allow RightMatch to investigate, respond to, mitigate and notify of events related to the RightMatch’s technology and information assets.
Network security controls designed to protect systems from intrusion and limit the scope of any successful attack.
Vulnerability assessment, patch management and threat protection technologies, and scheduled monitoring procedures designed to identify, assess, mitigate and protect against identified security threats, viruses and other malicious code.
Disaster recovery procedures designed to maintain service and/or recovery from foreseeable emergencies or disasters.
EXHIBIT C
LIST OF SUBPROCESSORS
Subscriber has authorized the use of the following Subprocessors:
| (Sub-)processor | Subject matter and nature of processing | Country in which the sub-processing will take place | |
|---|---|---|---|
| 1. | Amazon Web Services, Inc. | Server hosting, File storage, Video encoding, Audio transcriptions, Caching | USA, via network/API |
| 2. | MongoDB Inc. | Database hosting, Data storage, Search | USA, via network/API |
| 3. | OpenAI Inc. | AI models | USA, via network/API |
| 4. | Vercel Inc. | Website hosting, Server hosting | USA, via network/API |
| 5. | Microsoft Corporation | Audio transcriptions | USA, via network/API |
| 6. | Kombo Technologies GmbH | Applicant Tracking System (ATS) integration | USA, via network API |