Data Processing Agreement

Placeholders to fill before publishing are marked like [COMPANY LEGAL NAME]. Replace all of them. This is a strong starting draft, not legal advice — a Data Processing Agreement carries specific legal consequences and must be reviewed and finalised by a qualified Saudi lawyer before it is offered to or relied upon with business users.

This Data Processing Agreement ("DPA") governs the handling of personal data relating to Job Seekers / Candidates ("Candidate Data") when it is made available through the HireXnow platform (the "Platform") to a Hiring Company or Manpower Agency (each a "Business User" or "you"). It is entered into between [COMPANY LEGAL NAME] ("HireXnow", "we", "us") and the Business User, and forms part of the Employer & Manpower Agency Terms and Terms & Conditions. It is designed to reflect the requirements of the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its Implementing Regulations, as supervised by the Saudi Data & Artificial Intelligence Authority (SDAIA).

By registering a business account or receiving Candidate Data through the Platform, you agree to this DPA.

1. Definitions

Terms such as personal data, processing, data controller, data processor, data subject, and sensitive data have the meanings given to them in the PDPL. In this DPA:

• Candidate Data — personal data relating to a Job Seeker that you access or receive through the Platform, such as name, contact details, location, nationality/residency status where provided, CV contents, work history, education, and skills.
• Recruitment Purpose — the specific purpose of assessing, contacting, and considering the individual for a role for which their data was made available to you, and concluding any resulting recruitment.
• Applicable Data Protection Law — the PDPL, its Implementing Regulations, and any other data protection law applicable to the processing.

2. Roles of the parties

The parties acknowledge that the allocation of controller and processor roles depends on the facts of each interaction. The following framework applies, and [CONFIRM WITH COUNSEL WHICH MODEL BEST REFLECTS THE ACTUAL DATA FLOWS]:

• HireXnow acts as an independent data controller in respect of its own operation of the Platform (account management, matching, review and approval, security), as described in the Privacy Policy.
• Once Candidate Data is shared with you for the Recruitment Purpose, you act as a separate, independent data controller in respect of your own use of that data for that purpose, and you are independently responsible for complying with Applicable Data Protection Law.
• To the extent you are found to process Candidate Data on HireXnow's behalf and on our instructions rather than for your own purposes, you act as our processor, and the processor obligations in Sections 4–9 apply to that processing.

Nothing in this DPA makes the parties joint controllers unless expressly agreed in writing.

3. Scope, purpose, and duration of processing

• Subject matter: the provision and use of recruitment services through the Platform.
• Nature and purpose: accessing, reviewing, contacting, and assessing Candidates for the Recruitment Purpose.
• Types of data: the categories of Candidate Data described in Section 1.
• Categories of data subjects: Job Seekers who apply to your postings or whose profiles are made available to you.
• Duration: for as long as you retain Candidate Data for the Recruitment Purpose, subject to the deletion obligations in Section 9.

You must not collect or require sensitive data through the Platform, and must not process any sensitive data that may incidentally appear in a CV except where strictly necessary and lawful.

4. Your obligations as a Business User

You agree that you will:

• process Candidate Data only for the Recruitment Purpose, and not for marketing, profiling, resale, or any unrelated purpose;
• have a lawful basis under Applicable Data Protection Law for your processing, and provide any notice or obtain any consent required from data subjects for your own processing;
• not sell, rent, or further disclose Candidate Data, and not share it with any third party without the individual's permission or another lawful basis;
• keep Candidate Data accurate and process only what is necessary for the Recruitment Purpose (data minimisation);
• ensure that persons authorised to process Candidate Data are bound by an obligation of confidentiality; and
• comply with our Acceptable Use Policy and cooperate with us on data protection matters.

5. Security measures

You must implement appropriate technical, administrative, and organisational measures to protect Candidate Data against unauthorised or unlawful access, loss, alteration, or disclosure — including access controls, encryption where appropriate, secure authentication, and restricting access to those who need it for the Recruitment Purpose. HireXnow applies equivalent measures on the Platform, including access controls, encryption in transit, and secure authentication.

6. Sub-processors (where you act as our processor)

Where you process Candidate Data as our processor, you must not engage a sub-processor without our prior written authorisation, must impose data protection terms on any authorised sub-processor at least as protective as this DPA, and remain fully liable for the sub-processor's performance.

HireXnow uses sub-processors to operate the Platform (for example, hosting, authentication, and analytics providers). [MAINTAIN A LIST OF HIREXNOW'S SUB-PROCESSORS AND THEIR LOCATIONS — e.g. Supabase, Vercel — AND LINK OR ATTACH IT.]

7. Data subject rights

Each party must assist the other, to the extent reasonable and appropriate to its role, in responding to requests from data subjects exercising their PDPL rights (access, correction, deletion, withdrawal of consent, objection, and portability). If you receive a request that concerns Candidate Data obtained through the Platform and that relates to HireXnow's processing, you must forward it to us at [PRIVACY CONTACT EMAIL] without undue delay. Where you are the relevant controller for your own processing, you are responsible for responding to the request as it applies to that processing.

8. Personal data breach

If you become aware of a personal data breach affecting Candidate Data obtained through the Platform, you must notify us at [PRIVACY CONTACT EMAIL] without undue delay, and in any event in time to allow us to meet our own notification obligations, providing sufficient information for us to assess and respond. Where you are the controller for the affected processing, you are responsible for any required notification to SDAIA and to affected individuals. HireXnow will notify SDAIA and affected individuals of breaches within its own systems as described in the Privacy Policy, including notifying SDAIA no later than 72 hours after becoming aware where required.

9. Return and deletion of data

On the earlier of the completion of the Recruitment Purpose, closure of your account, or termination of the Employer & Manpower Agency Terms, you must stop processing Candidate Data obtained through the Platform and delete or return it, together with any copies, except to the extent you are required by law to retain it or must retain it briefly to conclude a recruitment already in progress. You must be able to confirm such deletion to us on request.

10. Cross-border transfers

If you transfer Candidate Data outside the Kingdom of Saudi Arabia, you must ensure the transfer complies with the PDPL and SDAIA's Regulation on Personal Data Transfer Outside the Kingdom, including using an approved transfer mechanism or safeguard. [CONFIRM WHETHER BUSINESS USERS ARE PERMITTED TO TRANSFER CANDIDATE DATA CROSS-BORDER, AND ON WHAT SAFEGUARDS.]

11. Audit and records

You must keep records of your processing of Candidate Data sufficient to demonstrate compliance with this DPA and, on reasonable written notice and subject to confidentiality, provide us with information reasonably necessary to demonstrate that compliance. [CONFIRM ANY AUDIT RIGHTS AND LIMITS WITH COUNSEL.]

12. Liability

Each party is responsible for its own compliance with Applicable Data Protection Law. You are liable for, and will indemnify HireXnow against, any claims, fines, or losses arising from your breach of this DPA or your unlawful processing of Candidate Data. This Section is subject to any limitation of liability agreed in the Employer & Manpower Agency Terms.

13. Governing law

This DPA is governed by the laws of the Kingdom of Saudi Arabia, and any dispute is subject to the exclusive jurisdiction of the competent courts of Saudi Arabia [CONFIRM CITY/VENUE]. In the event of conflict between this DPA and the Employer & Manpower Agency Terms on the processing of Candidate Data, this DPA prevails.

14. Contact

Data protection enquiries relating to this DPA:

[COMPANY LEGAL NAME]
Email: [PRIVACY CONTACT EMAIL]
Address: [REGISTERED ADDRESS]