Data processing agreement

1. Parties and scope

This agreement is between the company that holds the HR Suite account (the controller, "you") and findjobs.ge (the processor, "we"). It forms part of the HR Suite terms of service and applies to all personal data you store in the suite about your employees, applicants, contractors, accountants and other people connected to your company ("the records"). It is concluded by your acceptance of the terms.

2. Subject matter, duration, nature and purpose

We process the records for the duration of the terms of service, solely to provide the suite's features to you: storing and displaying records, calculating pay, leave and settlements, preparing files, keeping logs, making backups, and sending the notices you configure. The categories of data and of data subjects are those in section 5 of the HR Suite privacy policy.

3. Your instructions

Your documented instructions are the features of the suite as you use them, your settings, and written instructions you send to info@findjobs.ge. We will tell you if an instruction appears to us to break the law. We do not process the records for any purpose of our own.

4. Confidentiality

Everyone we allow to process the records is bound to confidentiality. Our staff open a company's records only when the owner grants support access from the suite, for the time granted, and each such look is written to the access log.

5. Security

We apply the measures in the security annex below and keep them current. We take the measures expected of a processor given the risk: encryption at rest and in transit, access control, logging, backups, and testing.

6. Subprocessors

You authorise the subprocessors listed at hr.findjobs.ge/hr/legal/subprocessors. We bind each to data protection duties no weaker than these. We announce an addition or replacement by email at least thirty days before it takes effect; you may object within that time, and if we cannot resolve the objection you may end the terms of service without penalty for the remaining period.

7. Helping with rights and obligations

We help you answer requests from data subjects (access, correction, deletion, export) with the suite's own tools and, where those are not enough, by written assistance. We help you with data protection impact assessments and consultations with the supervisory authority as far as the information available to us allows.

8. Breaches

We tell the account owner of a personal data breach affecting the records without undue delay and no later than seventy-two hours after we become aware of it, with what we know, the likely consequences and the measures taken, and we keep you informed as we learn more.

9. Deletion and return

You can export your records at any time. At the end of the terms of service we keep the records archived and exportable for twelve months, then delete or anonymise them, unless the law requires us to keep them longer. You may ask for deletion earlier.

10. Audits

We give you the information needed to show compliance: this agreement, the security annex, the subprocessor list, and written answers to reasonable questions within twenty working days. An on-site audit may be agreed once a year, at your cost, with thirty days' notice, during working hours, by an auditor bound to confidentiality.

11. Transfers

The records are stored in a database located in Frankfurt and may be processed on Cloudflare's network and by the listed subprocessors in the European Union and the United States under their standard contractual clauses, as the subprocessor list states.

12. Liability and law

Liability under this agreement follows section 12 of the HR Suite terms of service. Georgian law governs; the Georgian text governs.

Annex: technical and organisational measures

Encryption: TLS for every connection; AES-256-GCM at rest for documents, personal numbers, bank accounts and addresses, with the key held on the server only.

Access: sign-in by one-time code or link plus a mandatory second lock (passkey or authenticator); roles (owner, manager, recruiter, accountant, employee) that see only what the role needs; recruiters see only their vacancies; sessions expire and can be ended by the owner.

Logging: an access log of every view of a private field, readable by the owner and editable by nobody; a log of every API call; server logs for ninety days.

Infrastructure: Cloudflare Workers with the database in Frankfurt; a watchdog that checks the service every few minutes and pages the operator on a fault; encrypted off-site backups twice a day.

Retention: nothing is deleted while the account is open; leavers are archived; demo companies are swept after fourteen days.

People: our staff open records only with the owner's time-limited support grant, and each look is logged.