Data Processing Agreement
Version 1.2
This Data Processing Agreement (this “DPA”) forms part of, and is incorporated by reference into, the EZHire Terms of Use (the “Agreement”) between Reeracoen Tech Co., Ltd. (“Reeracoen”) and the customer that accepts the Agreement and registers an account for the EZHire applicant tracking service (the “Customer”). By accepting the Agreement, the Customer agrees to this DPA. No signature is required for this DPA to take effect.
BACKGROUND.Reeracoen provides the EZHire applicant tracking software-as-a-service (the “Services”). In providing the Services, Reeracoen Processes Personal Data on behalf of the Customer. This DPA sets out the terms on which such Processing is carried out.
1. Definitions and Interpretation
1.1) In this DPA, capitalised terms have the meanings given below; terms not defined here have the meaning given in the Agreement or in Applicable Data Protection Laws.
1.2) “Applicable Data Protection Laws” means all data protection and privacy laws applicable to the Processing of Customer Personal Data under this DPA, including the Personal Data Protection Act B.E. 2562 (2019) of Thailand (“PDPA”) and the equivalent laws of any other jurisdiction in which the Services are made available, in each case as amended or replaced from time to time.
1.3) “Controller”, “Processor”, “Data Subject”, “Processing” (and “Process”) and “Personal Data Breach” have the meanings given to them (or their functional equivalents) under Applicable Data Protection Laws.
1.4) “Customer” means the legal entity that has accepted the Agreement and registered an account for the Services. The Customer is identified by the registration details provided to Reeracoen; those details are not reproduced in this DPA.
1.5) “Customer Personal Data” means any Personal Data that Reeracoen Processes on behalf of the Customer in connection with the Services, as further described in Annex 1.
1.6) “Personal Data” means any information relating to an identified or identifiable natural person; and “Sub-processor” means any third party engaged by Reeracoen to Process Customer Personal Data.
2. Roles of the Parties and Scope
2.1) As between the parties, the Customer is the Controller and Reeracoen is the Processor in respect of Customer Personal Data. The Customer determines the purposes and means of the Processing; Reeracoen Processes Customer Personal Data only as a Processor on the Customer’s behalf.
2.2) This DPA does not govern Personal Data for which Reeracoen acts as a Controller in its own right (for example, the account-registration data of the Customer’s authorised users), which is dealt with under the EZHire privacy policy.
2.3) The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.
3. Processing of Customer Personal Data
3.1) Reeracoen shall Process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers, unless required to do otherwise by a law to which Reeracoen is subject; in such a case Reeracoen shall inform the Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.
3.2) The Agreement, this DPA and the Customer’s use and configuration of the Services constitute the Customer’s complete and documented instructions. Reeracoen shall inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.
3.3) The Customer is responsible for ensuring that it has a valid legal basis for the Processing and that it has provided all required notices to, and obtained any required consents from, Data Subjects in respect of the Customer Personal Data uploaded to or generated within the Services, including any special-category data that may be contained in uploaded documents or free-text fields (see Annex 1). The Customer warrants that, where any such special-category data is or may be Processed, it has obtained the explicit consent required under Section 26 of the PDPA (or the equivalent lawful basis under other Applicable Data Protection Laws).
3.4) Where special-category data is present within Customer Personal Data, Reeracoen shall apply the technical and organisational measures set out in Annex 2 to that data in the same manner as to other Customer Personal Data.
3.5) The Customer shall not upload special-category data to the Services beyond what is necessary for the recruitment purpose, and shall take reasonable steps to avoid uploading unnecessary special-category data.
3.6) Reeracoen shall maintain a record of the categories of Processing carried out on behalf of the Customer, as required of a processor under Applicable Data Protection Laws (including Section 40 of the PDPA), and shall make it available to the Customer on reasonable request.
4. Confidentiality
4.1) Reeracoen shall ensure that persons authorised to Process Customer Personal Data are bound by an appropriate obligation of confidentiality and Process such data only on a need-to-know basis.
5. Security of Processing
5.1) Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk to Data Subjects, Reeracoen shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in Annex 2.
5.2) Reeracoen may update the security measures from time to time, provided that such updates do not result in a material degradation of the overall security of the Services.
6. Sub-processing
6.1) The Customer grants Reeracoen general written authorisation to engage Sub-processors to Process Customer Personal Data. A current list of the Sub-processors engaged, together with their roles and locations, is available to the Customer on request, subject to the Customer entering into a confidentiality (non-disclosure) undertaking with Reeracoen. For security reasons, Reeracoen does not publish this information publicly.
6.2) Reeracoen shall give the Customer prior notice of the addition or replacement of any Sub-processor (by email or via the Services), giving the Customer at least 30 days to object on reasonable data-protection grounds. If the Customer reasonably objects and the parties cannot agree a resolution, the Customer may terminate the affected Services.
6.3) Reeracoen shall impose on each Sub-processor, by written contract, data-protection obligations that are substantially the same as those imposed on Reeracoen under this DPA, and remains fully liable to the Customer for the performance of each Sub-processor’s obligations.
7. International Transfers
7.1) Customer Personal Data is hosted in the United States. Certain Sub-processors used to provide the Services may Process limited Customer Personal Data in other locations, including the European Union, as reflected in the Sub-processor information made available under Clause 6.1. Reeracoen’s personnel access the Services from Thailand.
7.2) Reeracoen may transfer and Process Customer Personal Data in these and other locations solely to provide the Services. Where such a transfer is subject to cross-border transfer requirements under Applicable Data Protection Laws, Reeracoen shall ensure that an appropriate safeguard recognised under those laws is in place, including through its data processing agreements with the relevant Sub-processors.
7.3) For transfers subject to the Thai PDPA, such safeguard shall take the form of standard contractual clauses meeting the minimum standards under the Section 29 cross-border transfer notification (in the Thai, ASEAN or GDPR model form). The Customer, as Controller, remains responsible for ensuring its own lawful basis for transferring Customer Personal Data to the Services.
7.4) To the extent the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) applies to a transfer of Customer Personal Data under this DPA to a country outside the European Economic Area that is not covered by an adequacy decision, the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”) are incorporated into this DPA by reference and apply to that transfer, with the Customer as data exporter and Reeracoen (and, for onward transfers, the relevant Sub-processor) as data importer. Module Two applies where the Customer acts as a controller and Module Three applies to onward transfers to Sub-processors; the general-authorisation option in Clause 9 of the EU SCCs applies, with the objection period being that set out in Clause 6.2; Annexes I, II and III to the EU SCCs are populated by Annex 1, Annex 2 and, respectively, Annex 3 together with the information made available under Clause 6.1; and the governing law and forum are those of the EU Member State in which the Customer (or its EU representative) is established or, where the Customer is not established in the European Economic Area, Ireland. In case of any conflict between the EU SCCs and this DPA in respect of such a transfer, the EU SCCs prevail.
8. Assistance to the Customer
8.1) Taking into account the nature of the Processing, Reeracoen shall provide reasonable assistance to the Customer, by appropriate technical and organisational measures and insofar as possible, to enable the Customer to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws.
8.2) Reeracoen shall promptly notify the Customer if it receives a request directly from a Data Subject in respect of Customer Personal Data, and shall not respond to that request itself except on the Customer’s documented instructions or as required by law.
9. Personal Data Breach
9.1) Reeracoen shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and shall use reasonable efforts to notify the Customer within 72 hours of becoming aware.
9.2) The notification shall, to the extent available, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Reeracoen shall provide reasonable assistance to the Customer in meeting the Customer’s own breach-notification obligations.
10. Data Protection Impact Assessments
10.1) Reeracoen shall provide reasonable assistance to the Customer with any data protection impact assessments and prior consultations with supervisory authorities that the Customer is required to carry out under Applicable Data Protection Laws, in each case in relation to the Processing under this DPA and taking into account the information available to Reeracoen.
11. Return or Deletion of Customer Personal Data
11.1) On termination or expiry of the Agreement, or on the Customer’s earlier written request, Reeracoen shall at the Customer’s choice, return to the Customer or delete the Customer Personal Data, save to the extent that storage is required by a law to which Reeracoen is subject.
11.2) Deletion is currently carried out manually by Reeracoen’s administrators and includes removal of associated files held in object storage. Copies of Customer Personal Data contained in backups are not deleted immediately; they are removed in the ordinary course as the backup retention period expires, within approximately 25 days.
11.3) During the term, the Customer may export Customer Personal Data from the Services in CSV format using the export functionality.
11.4) Where Reeracoen retains Customer Personal Data as required by law, it shall continue to protect the confidentiality of that data and Process it only as necessary for the purpose of the required retention.
12. Audit and Information
12.1) Reeracoen shall make available to the Customer information reasonably necessary to demonstrate compliance with this DPA.
12.2) Reeracoen shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by it, on at least 30 days’ prior written notice, during normal business hours, no more than once per year (save where required by a supervisory authority or following a Personal Data Breach), and subject to appropriate confidentiality obligations.
13. Liability
13.1) Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference in the Agreement to a party’s liability means the aggregate liability of that party under the Agreement and this DPA together.
13.2) Nothing in this DPA or the Agreement limits or excludes either party’s liability to the extent that such liability cannot be limited or excluded under applicable law, including (a) liability that cannot be limited or excluded under Applicable Data Protection Laws (such as liability to Data Subjects or to a supervisory authority); and (b) liability arising from fraud, wilful misconduct or gross negligence.
14. Term
14.1) This DPA takes effect when the Customer accepts the Agreement and remains in force for so long as Reeracoen Processes Customer Personal Data on behalf of the Customer.
15. Order of Precedence
15.1) This DPA forms part of, and is subject to, the Agreement. In the event of any conflict between this DPA and the Agreement regarding the Processing of Customer Personal Data, this DPA prevails.
15.2) Where the Customer and Reeracoen have entered into a separately negotiated and signed data processing agreement covering the Services, that agreement prevails over this DPA to the extent of any conflict.
16. Governing Law and Dispute Resolution
16.1) This DPA is governed by the laws specified in, and is subject to the dispute-resolution provisions of, the Agreement.
17. General
17.1) Reeracoen may update this DPA from time to time in accordance with the variation mechanism of the Agreement. Reeracoen shall give the Customer prior notice of any material change (by email or via the Services). The Customer may object to a material change on reasonable data-protection grounds; if the parties cannot agree a resolution, the Customer may terminate the affected Services.
17.2) If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions continue in full force and effect.
17.3) Notices under this DPA shall be given in accordance with the notice provisions of the Agreement.
Acceptance
By registering for and using the Services, or by otherwise accepting the Agreement, the Customer acknowledges that it has read, understood and agreed to this DPA.
Annex 1 — Details of the Processing
| Item | Details |
|---|---|
| Subject matter | Provision of the EZHire applicant tracking Services to the Customer. |
| Duration | For the term of the Agreement and any post-termination retention period under Clause 11. |
| Nature and purpose | Hosting, storage, organisation, retrieval, display and other Processing of recruitment data as necessary to operate the Services on the Customer’s behalf. |
| Categories of Data Subjects | Job applicants and candidates submitted to, or created within, the Services. |
| Types of Personal Data | Identity & contact: full name, nickname, email address, phone number. Biographical: gender, date of birth, nationality, current location. Professional: current job title, current company, current salary, expected salary, work experience (free text), start date. Education: degree, major, graduation year, institution, GPA, English proficiency, languages. Skills & links: key strengths, LinkedIn URL, reference URL. Documents: CV, profile photo, up to two additional uploaded documents. Recruitment records: application status / stage, recruiter notes (free text), interview notes (free text), Customer-defined custom fields (free text). |
| Special-category data | No dedicated fields are provided for special-category data. Such data may nonetheless be present incidentally in uploaded documents (e.g. copies of identity documents), profile photos and free-text fields. As Controller, the Customer is responsible for ensuring a lawful basis for any such data (see Clauses 3.3–3.5). |
Annex 2 — Technical and Organisational Measures
Reflects the current configuration of the Services as confirmed by the development team (June 2026).
| Area | Measure |
|---|---|
| Encryption | In transit: TLS 1.2 minimum (TLS 1.3 supported), terminated at the platform load balancer; email delivery over STARTTLS. At rest: the production database is encrypted with AES-256; uploaded files in object storage are encrypted using server-side encryption (SSE-S3). |
| Access control | Role-based access (administrator and member roles per Customer account); per-action authorisation; access can be scoped by division; salary-field visibility is configurable; session timeout of 24 hours. Authentication is by password and email confirmation; multi-factor authentication is not currently implemented. Reeracoen engineering / operations personnel have administrative database access under platform credentials. |
| Tenant isolation | All Customers share a single database with company-identifier scoping, supported by authorisation policies that prevent one Customer’s users from accessing another Customer’s data. There is no schema-per-tenant or database-per-tenant separation. |
| Network | Platform-managed network security; an application-level web application firewall (IP blocklist) and application-level rate limiting. |
| Backups & recovery | Daily database backups, retaining the most recent 25 snapshots (approximately 25 days), stored in AWS us-east-1; continuous write-ahead-log protection for point-in-time recovery. Restoration has been tested (most recent successful test: 10 March 2026). |
| Logging & monitoring | Real-time application monitoring with alerting on critical and fatal events; error-level application logs are shipped to a log-monitoring provider (retained for 8 days) with sensitive fields filtered before transmission. A per-record access audit log (recording view and export of candidate data) is being implemented. |
| Vulnerability management | Static security analysis is performed as part of the pre-deployment process; application-level rate limiting is in place. |
| Personnel | Personnel authorised to access Customer Personal Data are bound by confidentiality obligations. |
| Incident response | Documented monitoring and alerting are in place. There is no dedicated security information and event management (SIEM) tooling at present. |
Annex 3 — Sub-processors
Reeracoen engages Sub-processors to Process Customer Personal Data in connection with the Services. For security reasons, the current list of Sub-processors — including each Sub-processor’s name, role, location and applicable data-protection terms — is not published publicly, but is made available to the Customer on request, subject to a confidentiality (non-disclosure) undertaking. Reeracoen will notify the Customer of any addition or replacement of a Sub-processor in accordance with Clause 6.2.