1. Scope and Incorporation
1.1. This Data Processing Agreement ("DPA") forms part of the Terms of Service between Bewort sp. z o.o. ("Processor") and the Customer ("Controller").
1.2. This DPA applies only where Bewort processes personal data on behalf of the Customer. It is intended to satisfy Article 28 of the GDPR.
1.3. The DPA is accepted together with the Terms through Stepli's acceptance screen, and that acceptance is recorded as described in the Terms.
2. Roles
2.1. The Customer is controller and Bewort is processor for personal data that the Customer supplies, uploads, creates or controls through Stepli, including candidate information and CVs, mailbox content and replies, manually added contacts and CRM data.
2.2. This DPA does not govern processing for which Bewort acts as an independent controller, including Customer account and billing information and business contact information independently sourced and maintained by Bewort.
3. Processing Details
3.1. Subject matter: provision of the Stepli platform and related functionality.
3.2. Duration: for the duration of the Customer's use of the Service and the retention period after it set out in Section 13.
3.3. Nature of processing: collection, receipt, storage, organisation, retrieval, consultation, structuring, transmission, analysis, classification, summarisation, extraction, deletion and other processing necessary to provide the Service.
3.4. Purposes: providing mailbox functionality, outreach workflows, reply processing, AI-assisted drafting and classification, candidate management, CV processing, CRM functionality, security, support and other functionality initiated or configured by the Customer.
4. Categories of Personal Data
Personal data processed may include names; professional contact information; email addresses; employment and professional information; correspondence and mailbox content; CV and recruitment information, including education and employment history; candidate profiles; CRM notes and activities; identifiers and technical metadata; and other information uploaded or entered by the Customer.
Customer-uploaded CVs, correspondence or notes may contain special categories of personal data under Article 9 of the GDPR if the Customer chooses to upload such information. The Customer is responsible for ensuring that it has a lawful basis and, where required, an applicable Article 9 condition for such processing.
5. Categories of Data Subjects
Data subjects may include candidates and prospective candidates; Customer employees and users; business contacts manually added by the Customer; recipients of Customer communications; persons corresponding with Customer-connected mailboxes; and other persons whose personal data the Customer enters into the Service.
6. Controller Instructions
6.1. Bewort processes personal data only on documented instructions from the Customer, including instructions given through the Customer's configuration and use of the Service, unless processing is required by EU or Member State law.
6.2. If applicable law requires processing beyond the Customer's instructions, Bewort will inform the Customer before processing unless the law prohibits it.
6.3. Bewort will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.
7. Confidentiality
Bewort ensures that persons authorised to process Customer personal data are subject to appropriate confidentiality obligations.
8. Security
8.1. Bewort implements appropriate technical and organisational measures as required by Article 32 of the GDPR, taking into account the state of the art, implementation costs, the nature and scope of processing and the risks to individuals.
8.2. These measures include encryption of data in transit, encryption at rest of the primary database, authenticated and role-based access to the Service, restricted administrative access, logging, automated backups, and incident management procedures.
9. Sub-processors
9.1. The Customer gives general written authorisation for Bewort to engage sub-processors.
9.2. Bewort will provide the current list of sub-processors to the Customer on request sent to legal@stepli.io.
9.3. Bewort will notify the Customer's account administrators by email at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds by writing to legal@stepli.io within that period. If the parties cannot resolve the objection, the Customer may cancel its subscription.
9.4. Bewort imposes on each sub-processor data protection obligations that provide protection materially equivalent to those in this DPA, and remains responsible for the performance of its sub-processors' obligations.
10. Data Subject Requests
10.1. Taking into account the nature of processing, Bewort assists the Customer by appropriate technical and organisational measures, insofar as reasonably possible, in responding to requests from data subjects exercising their GDPR rights.
10.2. If Bewort receives a request relating solely to personal data processed on behalf of a Customer, Bewort may direct the requester to that Customer unless the law requires otherwise.
11. Assistance with Compliance
Taking into account the nature of processing and the information available to it, Bewort provides reasonable assistance with the Customer's obligations under Articles 32 to 36 of the GDPR, including security, breach assessment, data protection impact assessments and prior consultation where applicable.
12. Personal Data Breaches
12.1. Bewort will notify the affected Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of that Customer.
12.2. Bewort will provide the information reasonably available to it to help the Customer meet its obligations under Articles 33 and 34 of the GDPR.
12.3. The Customer, as controller, decides whether notification to a supervisory authority or to affected individuals is required. Notification by Bewort is not an admission of fault or liability.
13. Deletion and Return
13.1. The Customer can delete individual records in the Service where the Service offers deletion. After a subscription ends, Bewort keeps Customer personal data for up to 12 months so that the account can be reactivated, and then deletes it, unless EU or Member State law requires continued storage.
13.2. On request sent to legal@stepli.io, Bewort will delete Customer personal data within 30 days of the request.
13.3. Deleted data remains in automated backups until they expire, within 7 days. Backups are protected and are restored only for disaster recovery, security or legal purposes.
14. Audits
14.1. Bewort will make available the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR.
14.2. The Customer may request an audit no more than once in any 12-month period, unless required by a supervisory authority or following a material personal data breach. Audits must be requested with reasonable prior written notice, take place during normal business hours, avoid unreasonable disruption, protect other customers' information and Bewort's confidential information, and are conducted at the Customer's cost.
14.3. Bewort may satisfy an audit request through security documentation, questionnaires, certifications or independent reports where these are reasonably sufficient.
15. International Transfers
15.1. Bewort's primary application hosting is in the European Union. Where Customer personal data is transferred outside the EEA, Bewort ensures that the transfer complies with Chapter V of the GDPR.
15.2. Such transfers may rely on an adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified, on the European Commission's Standard Contractual Clauses, which are incorporated by reference to the extent required, together with supplementary measures where needed, or on another lawful transfer mechanism.
16. Customer Obligations
The Customer represents and warrants that its processing instructions comply with applicable law; that it has a lawful basis for the personal data it supplies to Stepli; that it provides the required privacy notices; that it has satisfied any requirements applicable to special-category data; that it will not instruct Bewort to process data unlawfully; and that its use of mailbox and outreach functionality complies with applicable communications and marketing laws.
17. Liability and Governing Law
17.1. Liability arising under this DPA is subject to the limitations and exclusions of liability in the Terms of Service to the maximum extent permitted by law.
17.2. This DPA is governed by Polish law. The courts having jurisdiction over Warsaw, Poland have exclusive jurisdiction to the extent permitted by applicable law.