Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms and Conditions for Wonderkind Next (the "Agreement") between:

• Wonderkind Global B.V., registered with the Dutch Chamber of Commerce (KvK) under number 66092302, VAT number NL825299937B01, registered office at H.J.E. Wenckebachweg 123, 1096 AM Amsterdam, the Netherlands ("Wonderkind", the "Processor"); and
• the Customer identified in the Order (the "Controller").

It governs Wonderkind's processing of Personal Data on the Customer's behalf in connection with the Services. Capitalised terms not defined here have the meaning given in the Agreement.

1. Definitions

• GDPR: Regulation (EU) 2016/679 and, where applicable, the UK GDPR as defined in the UK Data Protection Act 2018.
• Data Protection Law: the GDPR, the UK GDPR, the Dutch GDPR Implementation Act (UAVG), and any other data protection law applicable to a party's processing under this DPA.
• Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, Special Categories of Personal Data, Supervisory Authority: as defined in the GDPR.
• Platform: Wonderkind Next, including the Attract and Qualify modules.
• Candidate Data: Personal Data relating to applicants and candidates captured or processed through the Platform, as described in Annex 1.
• Lead Source: a third-party platform from which the Platform receives applications or leads, such as Meta lead forms, LinkedIn Easy Apply, Indeed Quick Apply and StepStone Quick Apply.
• Authorized User: a person the Customer allows to use the Platform, including users of a partner or agency acting for the Customer.
• Access Grant: a permission in the Platform that allows an Authorized User to view or act on Candidate Data for a job, or for all jobs in an account.
• Sub-Processor: any third party engaged by Wonderkind to process Candidate Data on the Customer's behalf.
• Trust Center: Wonderkind's trust center at trust.wonderkind.com.
• Standard Contractual Clauses or SCCs: the clauses approved in Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

2. Roles and scope

2.1 For Candidate Data processed through the Platform, the Customer acts as Controller and Wonderkind acts as Processor.

2.2 Wonderkind processes Personal Data only to provide the Services and only as described in Annex 1, on the Customer's documented instructions.

2.3 Channels. When campaigns run on advertising channels (for example Meta, Google, LinkedIn or TikTok), each channel determines its own purposes and means of processing for ad delivery, audience building and measurement, and acts as an independent controller (or, where applicable, joint controller with the party running the campaign) under its own terms. This DPA does not govern the channels' own processing.

2.4 Lead Sources. Applications submitted on a Lead Source are first collected by that Lead Source under its own terms. Lead Sources can be connected in three ways: (a) through the Customer's own Lead Source account or contract; (b) through an account or contract held by Wonderkind; or (c) through an intermediary engaged by Wonderkind, such as a job distribution partner. In each case Wonderkind retrieves applications on the Customer's instruction and processes them as Processor under this DPA from the moment they reach the Platform. Where Wonderkind runs the application form from its own account under (b), the form identifies the Customer as the employer and links to the Customer's privacy notice, and Wonderkind retrieves the applications into the Customer's account in the Platform without using them for any other purpose. Intermediaries under (c) that process Candidate Data are Sub-Processors. The Customer is responsible for the notices and lawful basis required for the application forms run for its jobs, including a link to its privacy notice.

2.5 Customer account data. Wonderkind processes Personal Data about Authorized Users (for example name, work email and login activity) as a controller, to operate accounts, bill, provide support and secure the Platform. That processing is governed by Wonderkind's privacy notice, not by this DPA. The services Wonderkind uses for it are listed on the Trust Center for transparency.

2.6 Anonymised and aggregated insights. The Customer instructs Wonderkind to process Personal Data to create anonymised, aggregated statistics and benchmarks (Article 11.2 of the Agreement). Wonderkind applies a minimum aggregation threshold so that no statistic or benchmark is derived from a group small enough to single out or re-identify any Data Subject, candidate or Customer. Irreversibly anonymised data is no longer Personal Data and falls outside this DPA.

2.7 If Wonderkind believes an instruction infringes Data Protection Law, it will inform the Customer without undue delay and may suspend the affected processing until the instruction is confirmed, withdrawn or amended.

3. Processing on documented instructions

3.1 Wonderkind processes Personal Data only on the Customer's documented instructions, including those in the Agreement, this DPA and the configuration the Customer sets in the Platform (for example connected Lead Sources, application fields, knock-out questions, qualification criteria, whether the matching score is enabled, and Access Grants).

3.2 Wonderkind will not process Personal Data for its own purposes, except for the anonymised processing in clause 2.6 and as required by law.

3.3 If law requires Wonderkind to process Personal Data beyond the Customer's instructions, Wonderkind will inform the Customer before processing, unless the law prohibits this on important grounds of public interest.

4. Confidentiality

4.1 Wonderkind ensures that persons authorised to process the Personal Data are bound by an appropriate duty of confidentiality.

4.2 Wonderkind limits its personnel's access to Personal Data to those who need it to provide, support or secure the Services, and ensures they are informed of the confidential nature of the data and trained on their obligations.

5. Security

5.1 Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to Data Subjects, Wonderkind implements appropriate technical and organisational measures, described in Annex 2.

5.2 Wonderkind may update its security measures, provided the updates do not materially reduce the overall level of security of the Personal Data.

6. Access to Candidate Data

6.1 No default access. Candidate Data is visible only to Authorized Users who hold an Access Grant. No account or organisation role grants access to Candidate Data by itself, including administrator roles.

6.2 Access Grants. The Customer decides who holds an Access Grant. Grants are given per job or as a standing grant for all jobs in an account, at the levels Reviewer (view), Hiring Manager (view and change a candidate's stage, including rejection) and Job Admin (also manages Access Grants for that job). Grants are visible in the Platform and can be revoked at any time.

6.3 Partners and agencies. Authorized Users of a partner or agency acting for the Customer see Candidate Data only if the Customer gives them an Access Grant.

6.4 Users without a grant see only aggregated totals for a job, with counts below five shown as "<5", and no Candidate Data.

6.5 Logging. The Platform logs the giving and revoking of Access Grants and each opening of a candidate profile, with the user and time. Logs are kept for 12 months and then deleted, and are available to the Customer on request.

6.6 Wonderkind personnel have no standing access to Candidate Data. They access it only with an Access Grant given by the Customer (for example for support), or where strictly necessary to secure the Services or to comply with law.

7. Sub-Processors

7.1 The Customer gives Wonderkind general authorisation to engage Sub-Processors. The current list of Sub-Processors, with their purpose and processing location, is published at trust.wonderkind.com/subprocessors. Annex 3 shows the list at the date of this version.

7.2 Wonderkind imposes on each Sub-Processor, by written contract, data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for the Sub-Processor's performance.

7.3 Wonderkind informs the Customer of any intended addition or replacement of a Sub-Processor at least 7 days before the new Sub-Processor starts processing Candidate Data, by publishing an update on the Trust Center that is sent to subscribed contacts. The Customer is responsible for keeping at least one contact subscribed.

7.4 Where an immediate replacement is needed to protect the security of the Personal Data or the continuity of the Services, Wonderkind may make it without prior notice and will inform the Customer as soon as possible, at the latest within 72 hours.

7.5 The Customer may object to a new Sub-Processor on reasonable data protection grounds within 7 days of the notice. If the parties cannot resolve the objection, the Customer may terminate the affected Services by written notice, and Article 18.4 of the Agreement applies to the wind-down.

7.6 Services that do not process Candidate Data on the Customer's behalf, including those used for Customer account data under clause 2.5, are not Sub-Processors under this DPA.

8. Automated processing and AI

8.1 Where the Customer enables the matching score, the Platform estimates how closely a candidate's application matches the job requirements the Customer has set. The matching score is disabled by default.

8.2 The Platform does not reject, advance or hire candidates on its own. Every such decision is taken by an Authorized User. Wonderkind does not make hiring or candidate-selection decisions.

8.3 The Customer remains responsible for human review of decisions, for informing candidates that a matching score is used, and for any other obligations it has as a deployer of the Services under applicable law.

8.4 Wonderkind does not use Candidate Data to train or fine-tune AI models, and its Sub-Processors do not use Candidate Data to train their models.

9. Assistance with Data Subject rights

9.1 Taking into account the nature of the processing, Wonderkind assists the Customer by appropriate technical and organisational measures, insofar as possible, to respond to Data Subjects exercising their rights (including access, rectification, erasure, restriction, portability and objection).

9.2 If Wonderkind receives a request from a Data Subject relating to Candidate Data, it will not respond directly (except to confirm that the request has been forwarded) and will pass the request to the Customer without undue delay.

10. Personal Data Breach

10.1 Wonderkind notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

10.2 The notification describes, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases without undue further delay.

10.3 Wonderkind provides reasonable assistance to the Customer in meeting its own notification and communication obligations to Supervisory Authorities and Data Subjects.

11. Data protection impact assessments

11.1 Taking into account the nature of the processing and the information available to it, Wonderkind provides reasonable assistance to the Customer with data protection impact assessments and prior consultations that the Customer must carry out in relation to the Services, including for the use of the matching score.

12. International transfers

12.1 Wonderkind will not transfer Candidate Data to a country outside the European Economic Area (EEA), or to an international organisation, unless it has taken measures providing an adequate level of protection under Data Protection Law, such as an adequacy decision or the SCCs (supplemented by the UK Addendum where the UK GDPR applies).

12.2 At the date of this version, all Sub-Processors process Candidate Data within the EEA and no transfer of Candidate Data outside the EEA takes place. If such a transfer becomes necessary, Wonderkind will put the SCCs (and the UK Addendum where applicable) in place before the transfer, with the annexes to this DPA populating the annexes to the SCCs.

13. Audits

13.1 Wonderkind makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

13.2 In the first instance, Wonderkind may meet an audit request with its most recent certifications, audit reports, policies or a completed security questionnaire, including materials published on the Trust Center. An on-site inspection is limited to once per 12 months (unless required by a Supervisory Authority or following a Personal Data Breach), on reasonable prior written notice, during business hours, subject to confidentiality and without disrupting Wonderkind's operations. Each party bears its own costs.

14. Return and deletion

14.1 During the Agreement, Wonderkind deletes Candidate Data on the Customer's instruction, including deletion actions the Customer takes in the Platform, unless Data Protection Law requires continued storage.

14.2 On termination or expiry of the Agreement, Article 18.4 of the Agreement applies: for 30 days after the effective termination date the Customer may export its data, and after 90 days from that date Wonderkind may permanently delete the account and associated Personal Data.

14.3 Wonderkind deletes existing copies unless Data Protection Law requires continued storage, in which case it keeps the data confidential and processes it only as that law requires. Wonderkind confirms deletion in writing on request.

15. Liability

15.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in Article 15 of the Agreement.

16. Duration

16.1 This DPA takes effect when the Agreement takes effect and continues for as long as Wonderkind processes Personal Data on the Customer's behalf. Provisions that by their nature should survive, including confidentiality and return and deletion, survive termination.

17. Precedence and general

17.1 This DPA forms part of the Agreement. In a conflict between this DPA and the rest of the Agreement on data protection matters, this DPA prevails.

17.2 This DPA is governed by the laws of the Netherlands. Any dispute arising out of or in connection with it is subject to the exclusive jurisdiction of the competent court in Amsterdam, the Netherlands.

17.3 Wonderkind may update this DPA, for example to reflect changes in the Services or in Data Protection Law. Changes that materially reduce the protection of Candidate Data require the Customer's agreement.

17.4 Except as amended by this DPA, the Agreement remains in full force and effect.

Annex 1: Description of the processing

• Subject matter: processing of Candidate Data to provide Wonderkind Next (Attract and Qualify).
• Duration: the term of the Agreement, plus the wind-down and deletion periods in Article 18.4 of the Agreement.
• Nature and purpose: running job advertising (Attract); retrieving applications and leads from Lead Sources; applying the knock-out questions and qualification criteria the Customer configures; producing a matching score where the Customer enables it; showing candidates in the talent pipeline to Authorized Users with an Access Grant, who review them and change their stage; reporting, and anonymised benchmarks under clause 2.6.
• Lead Sources: Meta lead forms, LinkedIn Easy Apply, Indeed Quick Apply, StepStone Quick Apply, and other Lead Sources the Customer connects.
• Types of Personal Data: identification and contact data (for example name, email address, phone number); application content (for example CV, cover letter, answers to application and knock-out questions); eligibility and profile information the candidate submits; source data (Lead Source, job and campaign); processing results (knock-out outcome, matching score where enabled, pipeline stage and decisions recorded by Authorized Users); technical data (for example IP address, device and interaction data) for delivery, attribution and fraud prevention.
• Special Categories: not processed, unless the Customer has a lawful basis and instructs Wonderkind in writing. The Customer must not configure the Platform to collect them otherwise.
• Categories of Data Subjects: the Customer's job applicants and candidates.

Annex 2: Technical and organisational security measures

A detailed description of controls is available under a confidentiality agreement as part of security due diligence, including through the Trust Center.

• Encryption: Personal Data encrypted in transit (TLS) and at rest.
• Access to Candidate Data: no default access; per-job and account-wide Access Grants at Reviewer, Hiring Manager and Job Admin level; revocable grants; aggregated counts only for users without a grant (counts below five shown as "<5"); logging of grants and candidate profile views (clause 6).
• Platform access control: role-based access with least privilege; authentication and identity management via the Platform's identity provider; individual accounts, no shared credentials; multi-factor authentication for administrative access.
• Network and application security: segregation of development, test and production environments; secure development; dependency and vulnerability management; regular patching.
• Logging and monitoring: access and event logging, with alerting on anomalous activity.
• Resilience and backup: regular backups, tested restores, documented business continuity measures.
• Data segregation: logical separation of Customer data in a multi-tenant environment.
• Personnel: confidentiality undertakings and periodic data protection and security training.
• Vendor management: security review of Sub-Processors before onboarding.

Annex 3: Sub-Processors at the date of this version

The current list is published at trust.wonderkind.com/subprocessors (clause 7.1).

Services Wonderkind uses for Customer account data, billing, support, monitoring and analytics (clause 2.5) are listed on the Trust Center. They do not process Candidate Data and are not Sub-Processors under this DPA.