1. Background and scope

1.1 This Data Processing Agreement (the "DPA") forms part of the agreement between openjobs and the customer using the Platform (the "Customer"), namely the Terms of Service for Employers and the plan or service terms displayed in the portal (together, the "Agreement").

1.2 This DPA governs the processing of personal data by openjobs on behalf of the Customer in connection with the Platform. Where there is a conflict regarding data protection matters, this DPA prevails over the rest of the Agreement.

1.3 openjobs connects AI talent with companies deploying next generation AI.

2. The entity you contract with

2.1 The Platform is operated by Jean Martin Inc. and Jean Martin Systems India Private Limited. The entity that acts as processor under this DPA, and the law that governs it, are determined by the country in which the Customer is established:

2.2 Meaning of "openjobs". In this DPA, "openjobs", "we", "us" and "our" mean the entity identified at clause 2.1 as the Customer's contracting entity, and where the context requires, its affiliates. Each entity contracts on its own behalf and is not liable for the obligations of the other.

2.3 Where the Customer has entered into a Master Services Agreement with openjobs, that agreement takes precedence over this DPA in the event of any conflict, and the order of precedence at clause 1.6 of the Terms of Service for Employers applies. Nothing in this clause permits either party to act in a manner that Applicable Law governing personal data does not permit.

2.4 Defined terms. Capitalized terms used in this document and not defined in it have the meaning given to them in the Terms of Service for Employers.

3. Roles of the parties

3.1 For personal data processed on the Customer's behalf in providing the Platform, the Customer is the controller or data fiduciary and openjobs is the processor. The Customer is responsible for the lawfulness of the personal data it provides and of the instructions it gives.

3.2 For certain processing openjobs determines its own purposes and acts as a controller in its own right, for example securing and improving the Platform and its artificial intelligence features, fraud prevention, and sourcing candidates. That processing falls outside this DPA and is governed by the openjobs Privacy Policy.

3.3 Where openjobs engages a Candidate as an employee or independent contractor to perform work for the Customer under a Contract Engagement, openjobs acts as a controller in its own right in respect of that Candidate's engagement, payment, tax, statutory and record-keeping data. That processing falls outside this DPA and is governed by the openjobs Privacy Policy. The Customer is not a controller of that data and is not entitled to instruct openjobs in respect of it.

4. Obligations of openjobs as processor

4.1 openjobs will:

1. process personal data only on the Customer's documented instructions, including those given through use of the Platform, unless required by Applicable Law to do otherwise, in which case it will inform the Customer where legally permitted;
2. ensure that persons authorized to process the personal data are bound by confidentiality obligations;
3. implement and maintain the technical and organizational security measures set out in Schedule 2;
4. respect the conditions in clause 6 for engaging sub-processors;
5. assist the Customer, taking into account the nature of the processing, with data subject requests and the Customer's own compliance obligations, as set out in clause 7;
6. notify the Customer of personal data breaches as set out in clause 8;
7. delete or return personal data at the end of the Platform services as set out in clause 10; and
8. make available the information needed to demonstrate compliance and to allow for audits, as set out in clause 9.

5. Obligations of the Customer as controller

5.1 The Customer warrants that it has a lawful basis, has provided all required notices, and has obtained any required consents in respect of the personal data it processes through the Platform.

5.2 The Customer is responsible for the accuracy and legality of the personal data and instructions it provides and will not instruct openjobs to process data unlawfully.

5.3 Where the Customer processes candidate or worker data accessed through the Platform, it does so as a controller in its own right and is responsible for its own compliance.

6. Sub-processors

6.1 The Customer authorizes openjobs to engage sub-processors in order to provide the Platform. openjobs will impose data protection obligations on each sub-processor that are no less protective than those in this DPA and remains responsible for the performance of its sub-processors.

6.2 A current list of sub-processors is set out in Schedule 3.

6.3 openjobs will give the Customer not less than thirty (30) days written notice of any intended addition or replacement of a sub-processor that processes personal data, and the Customer may object on reasonable data protection grounds within that period. Where the objection cannot be resolved, the Customer may terminate the affected services on written notice.

6.4 Where the Customer's contracting entity is JMI, the Customer authorizes JMS as a sub-processor in respect of platform operation, delivery and support performed from India.

7. Assistance with rights and compliance

7.1 Taking into account the nature of the processing, openjobs will provide reasonable assistance to enable the Customer to respond to requests from data subjects to exercise their rights, and to meet its obligations relating to security, breach notification, data protection impact assessments and prior consultation, in each case to the extent that these relate to the processing by openjobs under this DPA.

7.2 openjobs will notify the Customer without undue delay if it receives a request from a data subject relating to personal data processed on the Customer's behalf, and will not respond to that request itself except on the Customer's instruction or as required by Applicable Law.

8. Personal data breach notification

8.1 openjobs will notify the Customer without undue delay and in any event within forty-eight (48) hours after becoming aware of a personal data breach affecting the Customer's personal data, and will provide the information reasonably available to help the Customer meet its own notification obligations under Applicable Law.

8.2 The Customer will notify openjobs without undue delay and in any event within forty-eight (48) hours of becoming aware of any personal data breach affecting candidate or worker data obtained through the Platform.

9. Audits

9.1 openjobs will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or its mandated auditor, subject to reasonable conditions as to confidentiality, security, frequency and notice. Audits will be conducted no more than once per year, save where required by a regulator or following a personal data breach.

9.2 Where available, openjobs may satisfy audit requests by providing relevant third-party certifications or reports.

9.3 Audit rights under this clause do not extend to the compensation payable by openjobs to any Candidate it engages, which is the confidential information of openjobs, or to personal data relating to other customers of openjobs.

10. Deletion or return of data

10.1 On termination or expiry of the Platform services, openjobs will, at the Customer's choice, delete or return the personal data it processes on the Customer's behalf and delete any existing copies, unless required by Applicable Law to retain it.

10.2 The Customer will make its choice under clause 10.1 within thirty (30) days of termination or expiry. Where no choice is made within that period, openjobs will delete the data. Copies held in routine backup remain subject to clause 4.1(b) until deleted in the ordinary course.

10.3 Clause 10.1 does not apply to personal data that openjobs holds as a controller under clause 3.2 or clause 3.3, the retention of which is governed by the Privacy Policy and by Applicable Law.

11. International transfers

11.1 Providing the Platform may involve transferring the Customer's personal data across borders, including between Jean Martin Inc. in the United States and Jean Martin Systems India Private Limited in India and to sub-processors in other countries.

11.2 Where personal data is transferred across borders, openjobs and the Customer will ensure that an appropriate transfer mechanism and safeguards are in place as required by Applicable Law, including, for transfers of personal data subject to European Economic Area or United Kingdom data protection law, the applicable Standard Contractual Clauses, and, for transfers subject to Indian data protection law, compliance with the conditions permitted under that law.

11.3 Schedule 3 identifies the country in which each sub-processor processes personal data. Where a sub-processor processes personal data in a country for which no adequacy finding or equivalent applies, openjobs will put in place the transfer mechanism required by Applicable Law before that sub-processor begins processing.

11.4 Transfers of personal data subject to European Economic Area data protection law to the sub-processor established in Israel are made in reliance on the adequacy decision adopted by the European Commission in respect of Israel. Transfers of personal data subject to Indian data protection law are made to countries in respect of which such transfer has not been restricted under that law.

12. Liability

12.1 Caps and exclusions. Each of openjobs and the Customer is subject to the limitations and exclusions of liability set out in the Agreement in respect of its obligations under this DPA. Those limitations and exclusions apply to the Agreement and this DPA in aggregate, and not separately, so that liability arising under this DPA does not increase either party's total liability beyond the cap in the Agreement.

12.2 Apportionment. Where both openjobs and the Customer are responsible for the same loss or damage arising from the processing of personal data, each will bear that liability to the extent of its own responsibility for the loss or damage.

12.3 Data subject and regulatory claims. Nothing in this DPA or the Agreement limits or excludes any liability that cannot be limited or excluded under Applicable Law relating to data protection, including the rights of data subjects or the powers of a supervisory authority. This clause allocates liability between openjobs and the Customer and does not affect either party's liability to a data subject or to a regulator.

12.4 Priority. This clause is subject to any mandatory requirement of Applicable Law.

13. General

13.1 This DPA takes effect when the Customer begins using the Platform and continues for as long as openjobs processes the Customer's personal data. If any provision is found unenforceable, the remainder remains in effect.

13.2 This DPA is governed by the law and dispute resolution provisions of the Agreement, determined by the Customer's contracting entity as identified at clause 2.1.

13.3 This DPA is made in the English language, which governs its interpretation.

Schedule 1: details of processing

Schedule 2: technical and organizational security measures

openjobs has implemented the following measures to protect personal data processed on the Platform:

• Encryption. Data in transit is encrypted using TLS, enforced at the load balancer and content delivery network layer with managed certificates. Data at rest is encrypted at the database and storage layer.
• Access control. Access to infrastructure, source code and the database follows role-based, least-privilege permissions, with production access restricted to authorized personnel and enforced within the application.
• Authentication. User authentication is managed through a third-party identity provider supporting secure sign-in, rather than openjobs storing credentials directly.
• Network security. The Platform runs within an isolated virtual private cloud, with application and database components in private subnets, a single controlled public entry point secured with TLS, and firewall rules restricting traffic between services.
• Secure development. Code changes are peer-reviewed before deployment, dependencies are continuously scanned for known vulnerabilities, and static code analysis is performed as part of the continuous integration and deployment pipeline.
• Logging and monitoring. Application and infrastructure activity is logged and monitored to support the detection of and response to anomalies.
• Personnel confidentiality. Personnel with access to personal data are bound by confidentiality obligations.
• Backup and recovery. Data is backed up automatically to support recovery in the event of loss or corruption.
• Vendor security. Core infrastructure and identity services are provided by established providers, each maintaining its own independent security certifications.
• Incident response. openjobs maintains a process to detect, respond to and notify Customers of personal data breaches, as set out in clause 8.
• Device standards for engaged Candidates. Candidates engaged by openjobs and supplied on a Contract Engagement are required, under their engagement agreement, to access Customer systems only from devices and networks meeting openjobs minimum security standards, and not to store Customer data on personal cloud services or removable media.

Schedule 3: sub-processors

Third-party vendors engaged by openjobs that process personal data on behalf of the Customer:

Contact

Questions relating to this DPA may be addressed to support@openjobs.ai.

Jean Martin Inc., 260 Madison Avenue, Floor 8, New York, NY 10016, United States. Jean Martin Systems India Private Limited, No. 37, TTK Road, CIT Colony, Alwarpet, Chennai, Tamil Nadu 600018, India, CIN U72200TN2004PTC053085.