Data processing agreement

JOIN has set itself the mission of connecting job seekers and companies worldwide. Companies can use the JOIN platform at https://join.com/ (hereinafter referred to as “Platform”) to advertise vacancies and manage applications received in one central location.

JOIN provides services to the Company in accordance with the service agreement concluded between the parties (“Services”). The Services notably include the possibility for the Company to publish job listings and manage related application procedures on the Platform using a web-based management tool. In the context of the Services, personal data controlled by the Company is processed by JOIN acting as the processor as defined by the current data protection laws.

Personal data may be processed by JOIN as the controller as defined by the current data protection laws. Please refer to JOIN’s privacy policy for more information.

This DPA serves to protect the parties against the improper use of the personal data processed for the Services, to ensure data protection by JOIN due to personal data that the Company has made known to them, and to comply with applicable legal requirements.

Unless otherwise expressly agreed, this DPA shall form part of every service agreement between the Company and JOIN. This DPA, including all appendices, also specifies the data protection obligations of the parties from the underlying service agreement as follows:

1. The following provisions only apply to the Services that qualify as data processing within the framework of the service agreement.
2. Where this DPA uses the terms defined in the GDPR or the FADP, as applicable, those terms shall have the same meaning as in that law. This DPA shall be read and interpreted in the light of the provisions of the EU General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“FADP”), as applicable. This DPA shall not be interpreted in a way that conflicts with rights and obligations provided for in the GDPR or the FADP, as applicable, or prejudices the fundamental rights or freedoms of the data subjects.

1. Under this DPA, JOIN shall process personal data exclusively on behalf of and in accordance with the Company’s instructions. This includes in particular those processing services that JOIN provides for the Company for the Services in accordance with the service agreement. In this service agreement and in Section 4, the parties have specified the details in accordance with Article 28(3) and (4) of the GDPR and Article 9 of the FADP, in particular the subject and duration of the data processing, as well as the handling, nature and purpose of the intended data processing, the type of data and those affected.
2. The data processing by JOIN on behalf of the Company is carried out in accordance with Art. 28 GDPR and Art. 9 of the FADP, with respect to each law only if and to the extent applicable to the respective processing activity. The Company always remains the entity responsible for data processing.
3. Without prejudice to any provisions of the GDPR or the FADP, as applicable, in the event that JOIN is in breach of its obligations under this DPA, the Company may instruct JOIN to temporarily suspend the processing of personal data until the latter complies with this DPA or the contract is terminated. JOIN shall promptly inform the Company in case it is unable to comply with this DPA, for whatever reason. JOIN shall immediately inform the Company if instructions given by the Company, in the opinion of JOIN, infringe applicable Union, Member State or Swiss data protection provisions.
4. This DPA shall remain in full force and effect so long as the underlying service agreement remains in effect. Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the underlying service agreement in order to protect personal data shall remain in full force and effect.

The provisions of this DPA are an integral part of the service agreement between the parties and take precedence over the other contractual agreements of the parties regarding data protection, in particular other contracts that contain provisions that deviate from those of this DPA to the detriment of the Company. Clause 1.1. remains unaffected. The provisions of this DPA do not apply to the processing of personal data that JOIN, as the controller, provides to the Company or any other individual user. Each party’s liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set out in the service agreement entered into between the parties.

The parties hereby agree that the purpose of the data processing is the provision of the Services by JOIN according to the service agreement. The scope and nature of data collection, processing and/or use of personal data are determined by the provisions of the service agreement as well as the Services actually used by the Company.

The data subjects affected by the handling of personal data within the framework of the service agreement include:

• candidates for positions published by the Company via the Platform; and
• Company employees using the Platform on behalf of the Company.

The following types of data are particularly affected by order processing:

• Personal data of the candidates (e.g. name, title, academic degree, date of birth, telephone number, email address),
• the data transmitted by the applicants (applicant data; curriculum vitae, references, certificates, etc.),
• all information related to the application process recorded in the Services and JOIN Platform, such as messages sent via the Platform, information about the application process and a candidate’s progress in the application process recorded on our Platform, or questions, which are asked as part of the application process and are recorded on our Platform,
• data generated through the use of the Services, such as metadata, including information about how long an application process takes, how many candidates have applied and how far a candidate has come in the application process,
• data generated through interactions with the Services, such as the answers provided to questions asked by candidates, data recorded by the Company itself that has not been deleted on the Platform and contact establishing messages to the candidates or JOIN,
• Personal data (e.g. name, job title, email address, telephone number, business address) and access data (e.g. username and password) of Company employees.

If this data is processed as part of other JOIN Services where JOIN acts as a controller, this does not take place within the scope of this DPA. Reference is made to JOIN’s privacy policy.

1. The Company alone is responsible for assessing the admissibility of the data processing carried out by JOIN on behalf of the Company and for safeguarding the rights of data subjects. The Company is particularly, but not exclusively, responsible for (1) fulfilling the data protection information obligations with regard to the candidates, (2) obtaining and documenting the necessary legal basis from the candidates for the processing of the data by the Company or JOIN in accordance with current data protection laws, and (3) complying with the deletion deadlines applicable to the respective application process.
2. As the data controller, the Company is entitled at any time to issue instructions on the nature, scope and procedure of the data processing carried out on behalf of the Company. Verbal instructions must be confirmed by the Company in writing (including email). JOIN shall promptly confirm receipt and execution of such instructions and inform the Company if, in its opinion, an instruction infringes applicable data protection law.
3. If the Company deems it necessary, persons authorised to issue instructions may be named. The information must be provided in writing by the Company. In the event that there is a change in the persons authorised to issue instructions at the Company, the Company shall inform JOIN of this in good time, naming the new person or persons in each case.
4. The Company shall inform JOIN if errors or irregularities are detected in connection with the processing of personal data by JOIN.
5. The Company is entitled to check the compliance of the technical and organisational data security measures taken by JOIN in accordance with Section 9 before the start of data processing and then at regular intervals, but no more than once a year, after timely prior notification of at least 30 days during normal business hours and taking into account the interests of JOIN. The Company can also have this check carried out by a third party, provided they have previously concluded a confidentiality agreement. The Company is obliged to pay the remuneration to the persons entrusted with implementing these measures.
6. The Company is obliged to inform JOIN about data protection incidents or other breaches of the current data protection laws affecting JOIN’s processing activities.
7. The Company shall inform JOIN promptly if it becomes aware of specific measures taken by the supervisory authorities affecting the Company, in particular investigative measures by the authorities, provided that this affects data processing for the Company and the Company is not obliged to maintain confidentiality.

1. Data processing. JOIN is obliged to process personal data under this DPA solely in accordance with this agreement and/or the underlying service agreement and the instructions of the Company.

2. Rights of data subjects. JOIN will support the Company as far as possible in fulfilling the rights of data subjects, in particular with regard to correction, restriction of processing and deletion, notification and provision of information.

   JOIN shall, on the Company’s instructions, rectify, delete or restrict the processing of the personal data processed on behalf of the Company. This obligation does not apply to personal data that JOIN processes as controller as part of the services it offers via the Platform.

   If a data subject contacts JOIN directly to request correction, deletion or restriction of processing of his or her personal data, JOIN shall forward this request to the Company immediately upon receipt. The Company shall remain responsible for the execution of the requests.

3. Internal control obligations. JOIN shall implement the appropriate control measures, e.g. internal audits, data protection concept, etc., to ensure that the personal data processed under this DPA is processed in accordance with this agreement and the corresponding instructions.

4. Duty to inform. JOIN, as the processor, shall inform the Company if, according to its own assessment, an instruction violates legal regulations. JOIN shall then be entitled to suspend the execution of the corresponding instruction until it is amended by the Company. This does not hereby justify JOIN’s obligation to check or notify.

   JOIN shall notify the Company of any personal data breach concerning data processed by JOIN (“Personal Data Breach”) no later than 48 hours after becoming aware of it. Such notice shall include, at a minimum:

   1. a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and data records concerned);
   2. the likely consequences of the breach; and
   3. measures taken or proposed to address the breach and mitigate possible adverse effects.

   If access to the personal data that the Company has transmitted to JOIN for data processing is endangered by measures taken by third parties (e.g. measures taken by an insolvency administrator, confiscation by tax authorities, etc.), JOIN is obliged to notify the Company of this.

   JOIN shall only pass on information to a party requesting information after prior agreement with the Company, unless JOIN is obliged to provide information by government measures or court decisions.

   Where a Personal Data Breach results from the compromise, loss, or unauthorised disclosure of the Company’s own credentials, systems, or personnel, JOIN acts strictly as data processor and its obligations are limited to notifying the Company in accordance with this DPA. JOIN shall have no obligation to make notifications on the Company’s behalf. JOIN may decide, alone or following a request from the Company, to notify data subjects of the existence of a breach in order for such data subjects to take necessary measures to mitigate risks and further unauthorised access to JOIN’s infrastructure.

5. Creation of a processing log. Upon request, JOIN shall support the Company in compiling a list of processing activities within the scope of the DPA and the data processing that is taking place and provide the necessary information in a suitable manner.

   JOIN shall also maintain its own log of all categories of processing activities carried out on behalf of the Company in accordance with the provisions of the current data protection laws.

6. Reporting and cooperation obligations. JOIN shall support the Company upon request in:

   1. fulfilling its reporting obligations;
   2. the obligation to carry out Data Protection Impact Assessments;
   3. the obligations to notify and communicate personal data breaches;
   4. any prior consultation with supervisory authorities.

7. Place of data processing. Unless otherwise agreed between the parties, the processing and use of the data by JOIN takes place in Switzerland, the European Union or in another treaty state of the Agreement on the European Economic Area. Any relocation of JOIN’s data processing activities to a third country is only permitted if the special requirements of Chapter V of the GDPR or Section 2 of the FADP are observed. The Company agrees that where JOIN engages a subprocessor in accordance with this agreement for carrying out specific processing activities (on behalf of the Company) in a third country and those processing activities involve transfer of personal data within the meaning of the GDPR or the FADP, as applicable, JOIN and the subprocessor may use standard contractual clauses adopted by the Commission on the basis of Article 46(2) GDPR in order to comply with the requirements of Chapter V of the GDPR, provided the conditions for the use of those clauses are met and provided that an internal assessment concluded that such transfer meets the level of data protection of the GDPR and the FADP.

8. Deletion of personal data after termination of the agreement. After the termination of the service agreement, JOIN is obliged to delete all personal data processed on behalf of the Company and certify to the Company that it has done so, and delete existing copies unless Union, Member State or Swiss law requires storage of the personal data. This obligation to delete does not apply to personal data that JOIN processes as controller as part of the services it offers via the Platform.

1. JOIN shall make available to the Company all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and that stem directly from the GDPR or the FADP and, at the Company’s request, allow for and contribute to reviews of data files and documentation or of audits of the processing activities covered by this DPA, in particular if there are indications of non-compliance. The Company may choose to conduct the audit by itself, to mandate, at its own cost, an independent auditor or to rely on an independent audit mandated by JOIN. Where JOIN mandates an audit, it has to bear the costs of the independent auditor. The Company’s audit, access, and inspection rights under this section 9.1 are limited to JOIN’s records only (including inter-alia the registers of personal data processing activities, the registers of recipients of personal data) and do not apply to JOIN’s physical premises. Any audit and request for information shall be limited to information necessary for the purposes of this DPA and shall give due regard to JOIN’s confidentiality obligations and legitimate interest to protect business secrets.
2. JOIN shall support the Company in carrying out checks to the best of its ability and shall provide swift and complete clarification where necessary.
3. JOIN shall accept any control measures by the data protection supervisory authority if there is a legal obligation to do so. It shall inform the Company in accordance with Section 8.4 after notification or becoming aware of the implementation of the control measure and other enquiries or investigations by the data protection supervisory authority, insofar as the measures or inquiries may affect data processing that JOIN provides for the Company and JOIN is not legally obliged to maintain confidentiality.
4. Upon request, JOIN shall confirm in writing compliance with the technical and organisational measures specified in Appendix 1 as well as JOIN’s ISO 27001:2022 certification.

1. JOIN is entitled to commission subprocessors with data processing in accordance with the following provisions:

   • JOIN carefully selects subprocessors based on their suitability and reliability and ensures that the respective subprocessor warrants an appropriate level of data protection.
   • JOIN is obliged to enter into contractual agreements with the subprocessors in accordance with current agreements in the relationship between the Company and JOIN, and to ensure that any supplementary instructions from the Company also apply to the subprocessors.
   • JOIN shall inform in text form the Company in good time, i.e. no later than 30 days before the start of the planned subprocessing, of any intended change in relation to the involvement or replacement of the subprocessors listed in Appendix 2, thereby giving the Company the opportunity to object to such changes prior to the engagement of the concerned subprocessor. Such objection shall not be unreasonably raised. If the Company does not object to such changes, the changes are deemed to have been approved.
2. JOIN shall provide the Company with a copy of the processing agreement with the subprocessor upon request, provided and insofar as this is not contrary to JOIN’s interests.
3. JOIN shall, at the time of the conclusion of the agreement, cooperate with the subprocessors named in Appendix 2 in the fulfilment of the agreement, to the commissioning of which the Company expressly agrees.

1. JOIN is obliged to maintain confidentiality and data secrecy when processing data for the Company.
2. JOIN shall only use employees or other vicarious agents to fulfil the agreement who are sufficiently committed to data secrecy or confidentiality when handling personal data provided and who have been properly briefed on the data protection requirements.

1. JOIN implements the TOMs outlined in Appendix 1.
2. For the duration of the contractual relationship, JOIN shall take all necessary measures to secure the data and the security of the processing, in particular taking into account the current technology standards, as well as to reduce possible disadvantageous consequences for the data subjects. In order to always be able to guarantee an appropriate level of security for data processing, JOIN shall ensure that the measures implemented are regularly reviewed and, if necessary, upgraded. JOIN is free to make such changes to the technical and organisational measures that increase the agreed level of security. JOIN shall inform the Company of changes made to these measures in good time.
3. JOIN is certified according to ISO 27001:2022.

1. JOIN may, from time to time, amend this DPA. JOIN shall notify the Company at least 30 days before such change applies to the Company (“Effective Date”). An amendment takes effect on the Effective Date without the Company’s further agreement where it (each an “Automatic Change”): (a) is required by applicable data protection law, a supervisory authority, a court, or a change to the standard contractual clauses or any successor transfer mechanism; (b) reflects a change to Appendix 1 or Appendix 2, which are governed by Sections 12 and 10 respectively; (c) is clarificatory or corrects a manifest error; or (d) does not materially reduce the protection afforded to personal data processed on behalf of the Company, or the Company’s rights under this DPA. Any other amendment takes effect on the Effective Date unless the Company objects in writing beforehand. The objection must identify the amendment objected to and state why the Company considers that it is not an Automatic Change. Where a compliant objection is made, the parties shall seek agreement in good faith for 30 days.
2. All declarations by the parties, in particular notifications, announcements, statements and other information to be transmitted to the other party, must be in writing to be effective. For the avoidance of doubt, “in writing” includes e-signature and other text communications such as e-mail.

1. In the event of any inconsistency between the provisions of this agreement and the provisions of the service agreement, the provisions of this agreement shall prevail.
2. This DPA is available in more than one language version. In case of discrepancy between the English version of this DPA and any translated version, and to the extent permitted under applicable law, the English version prevails.
3. This DPA shall be governed by and construed in accordance with the substantive laws of Switzerland, excluding its conflict of law provisions and the United Nations Convention on Contracts for the International Sale of Goods (CISG). The ordinary court at the seat of JOIN has exclusive jurisdiction for all disputes arising from or in connection with this DPA.

Tim Ruffner, CEO and Founder JOIN Solutions

15th September, 2026

JOIN implements and maintains technical and organisational measures designed to protect personal data processed in connection with the Services against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or unauthorised forms of processing.

These measures are implemented on a risk-based basis, taking into account the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons.

JOIN reviews and updates its technical and organisational measures as appropriate in order to maintain a level of security appropriate to the risk and to reflect changes in legal requirements, the Services, and the state of the art. Such measures are intended to support JOIN’s information security management framework and applicable data protection obligations.

1. Information security governance

JOIN maintains an information security management framework including documented policies, assigned responsibilities, risk assessment and risk treatment processes, and periodic review of relevant security and privacy risks.

JOIN maintains documented procedures and controls relating to areas such as access management, incident response, secure development, vulnerability management, business continuity, supplier oversight, and data protection.

Personnel with responsibilities relevant to customer personal data are subject to confidentiality obligations and receive security and data protection training appropriate to their role.

2. Personnel security and confidentiality

JOIN applies role-appropriate onboarding, role change, and offboarding processes for personnel with potential access to systems or personal data processed as part of the Services.

Access is granted based on business need and the principle of least privilege, and personnel are required to comply with JOIN’s internal security and confidentiality requirements.

JOIN takes reasonable steps to ensure that authorised personnel understand their responsibilities relating to confidential information, data protection, and acceptable system use.

3. Physical and environmental security

JOIN primarily relies on cloud-hosted systems and infrastructure for the processing and storage of customer personal data. Physical and environmental security for the underlying hosting infrastructure is managed by the relevant cloud infrastructure provider under its own security programme and contractual commitments.

JOIN applies proportionate physical security and device protection measures for office-based and remote-working environments relevant to its business operations.

This annex does not describe infrastructure-specific controls that are solely operated by third-party cloud providers unless such controls form part of the provider-managed environment supporting the Services.

4. Identity and access management

Access to systems and customer personal data is restricted to authorised persons with a legitimate business need. JOIN uses access management processes designed to ensure that access rights are assigned, modified and revoked in a controlled manner.

JOIN uses unique user identities where appropriate, restricts privileged access to authorised personnel, and applies strong authentication controls, including multi-factor authentication for critical systems where technically supported and appropriate.

JOIN maintains processes for credential management, access reviews, role-based permissions, and timely revocation of access following role change or termination.

5. Customer access and data separation

JOIN’s services are designed to logically separate customer data from the data of other customers and to ensure that users may access only the data and functions for which they are authorised.

JOIN maintains separation between production and non-production environments where appropriate for operational and security purposes.

Where personal data is processed in connection with testing, support, troubleshooting or maintenance activities, such processing is limited to what is necessary and subject to appropriate access restrictions and safeguards.

6. Encryption and secure communications

JOIN applies encryption in transit for personal data transmitted over public networks using industry-standard secure communication protocols.

JOIN applies encryption at rest for JOIN-controlled production systems used to persistently store customer personal data. Where customer personal data is processed or stored through third-party services, JOIN relies on the applicable security measures and contractual safeguards of the relevant provider.

Cryptographic keys, secrets, authentication credentials and related sensitive configuration data are managed through controlled processes designed to restrict unauthorised access and disclosure.

7. Secure development and change management

JOIN maintains development and change-management processes designed to reduce security risk throughout the design, development, testing, deployment and operation of the Services.

Changes to production systems are subject to appropriate review, testing and approval procedures proportionate to the nature and risk of the change. JOIN also maintains separation between development, test and production activities where appropriate.

Security considerations are incorporated into the software lifecycle, including vulnerability remediation, dependency management, defect handling, and the controlled release of changes.

8. Vulnerability, endpoint and supplier management

JOIN maintains processes to identify, assess, prioritise and remediate vulnerabilities affecting systems within its control. Security updates and patches are applied based on risk, severity and operational requirements.

JOIN applies endpoint-security and device-management measures appropriate to company-managed endpoints used in connection with the Services.

Before engaging relevant suppliers or subprocessors that may process customer personal data, JOIN performs appropriate due diligence and requires contractual safeguards appropriate to the services provided and the applicable legal requirements. JOIN manages subprocessors in accordance with the applicable data processing agreement.

9. Logging, monitoring and incident management

JOIN maintains logging and monitoring measures for relevant systems in order to support security monitoring, service operation, troubleshooting, incident investigation and response.

Access to such logs is restricted to authorised personnel, and retention periods are determined according to operational, security, legal and contractual requirements. JOIN maintains an incident management process covering the identification, assessment, escalation, containment, remediation and post-incident follow-up of security and operational incidents relevant to the Services.

In the event of a personal data breach, JOIN will notify the relevant customer in accordance with the DPA, and will provide reasonable cooperation and relevant available information to support investigation, mitigation and compliance with applicable notification obligations.

10. Availability, backup, recovery and data deletion

JOIN maintains measures designed to support the availability, resilience and recoverability of the Services, including backup, recovery, service monitoring and operational continuity measures appropriate to the Services and their underlying infrastructure.

Backup and recovery arrangements are periodically tested or otherwise validated in accordance with operational requirements, and JOIN maintains business continuity and recovery processes intended to support restoration following material operational or security incidents.

Upon termination of the relevant contractual relationship, JOIN deletes customer personal data in accordance with the applicable agreement and documented customer instructions, except where retention is required by applicable law. Deletion processes are designed to remove personal data from active systems and to manage residual data in backups in accordance with applicable retention and deletion processes.

Questions on this agreement, our subprocessors, or a data-subject request? Reach our legal team at [email protected] or via join.com/contact.