DEEN
Book a call
Legal

Data processing agreement

This English version is provided for convenience. Only the German version is legally binding; in case of discrepancies the German version prevails. German original: Vertrag zur Auftragsverarbeitung.

pursuant to Art. 28 GDPR between the customer (“controller”) and WELLEMACHEN Marketing LLC, 530-B Harkle Road, Suite 100, Santa Fe, New Mexico 87505, USA (“FlyHire”, “processor”). This agreement forms part of every contract concerning FlyHire and is deemed concluded upon booking.

Section 1 Subject matter and duration

(1) FlyHire processes personal data on behalf of the controller in order to provide the services agreed under the terms and conditions: running job ads on Facebook and Instagram, receiving applications via application pages, storing them, displaying them in the customer portal, transferring them to the controller’s applicant tracking system, and measuring and managing the ads on the basis of the applications.

(2) This agreement runs for as long as the contract concerning FlyHire and thereafter for as long as FlyHire still processes data of the controller.

Section 2 Types of data and data subjects

(1) Data subjects: applicants for jobs of the controller.

(2) Types of data: name, phone number, email address, postcode, availability, answers to the questions on the application page (for example on training, experience, driving licence, German language skills), voluntarily uploaded CVs, status of and notes on the application, technical data of the page request (IP address, browser identifier, the ad’s click identifier) and the progress of the application in the applicant tracking system, insofar as FlyHire reads it.

(3) FlyHire does not ask for special categories of personal data (Art. 9 GDPR). The controller does not set up questions about such data.

Section 3 Instructions

(1) FlyHire processes the data only on documented instructions from the controller, unless FlyHire is required to process it by law; in that case FlyHire informs the controller in advance, insofar as the law permits. The instructions are set out in this agreement, the terms and conditions and the settings in the customer portal. The controller gives further instructions in text form.

(2) The controller instructs FlyHire to report incoming applications and their subsequent progress to Meta in order to measure and manage its job ads. Email address, phone number, first and last name and postcode are transmitted only as a hash value (SHA-256), together with the IP address, browser identifier and the ad’s click identifier. The controller ensures that it informs applicants of this, in particular in its privacy policy.

(3) If FlyHire considers an instruction to be unlawful, FlyHire notifies the controller without undue delay and may suspend its execution until the controller confirms or changes it.

Section 4 FlyHire’s obligations

(1) FlyHire commits all persons with access to the data to confidentiality, unless they are under a statutory obligation of confidentiality.

(2) FlyHire takes the technical and organisational measures under Art. 32 GDPR described in the annex. FlyHire may develop them further, provided the level of protection does not decrease.

(3) FlyHire assists the controller with appropriate measures in responding to requests from data subjects (Art. 12 to 22 GDPR) and in meeting its obligations under Art. 32 to 36 GDPR, insofar as the processing by FlyHire is concerned. If data subjects contact FlyHire directly, FlyHire forwards the request to the controller.

(4) FlyHire notifies the controller of a personal data breach without undue delay after becoming aware of it, with the information under Art. 33(3) GDPR, insofar as available.

(5) FlyHire does not process the data for its own purposes. This excludes anonymised and aggregated analyses without personal reference that FlyHire uses to improve its services.

Section 5 Sub-processors

(1) The controller approves the sub-processors listed in the annex. It grants general authorisation to engage further sub-processors or replace existing ones. FlyHire informs the controller in advance in text form; the controller may object within 14 days for an important reason relating to data protection. If FlyHire cannot accommodate the objection, either party may terminate the contract with respect to the services concerned.

(2) FlyHire imposes on sub-processors the same data protection obligations as set out in this agreement. For providers with their own standard terms (for example Meta), their data processing terms apply.

(3) The transfer to the controller’s applicant tracking system is not sub-processing; it takes place on the controller’s instructions to a system the controller has engaged itself.

Section 6 Transfers to third countries

(1) FlyHire is based in the USA. For FlyHire’s access to the data, the parties conclude the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module 2 (controller to processor), which are incorporated into this agreement by reference. The following applies: Clause 7 (docking clause) does not apply; in Clause 9, Option 2 (general authorisation) applies with the notice period under Section 5(1); the option in Clause 11 does not apply; the competent supervisory authority under Clause 13 is that of the member state in which the controller is established; under Clause 17 German law applies, and under Clause 18 the courts of Germany have jurisdiction. The information required in the annexes is set out in this agreement and its annex.

(2) The data is stored in Germany. Transfers to sub-processors in third countries take place only under the conditions of Art. 44 et seq. GDPR, for example on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses.

Section 7 Audits

(1) On request, FlyHire provides the controller with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

(2) The controller announces any further audits, including by an auditor bound to confidentiality, at least 30 days in advance in text form. They take place during normal business hours, no more than once per calendar year, unless a specific cause such as a data breach justifies a further audit. Audits must not unreasonably disrupt operations. The controller bears FlyHire’s costs, unless the audit reveals a material breach by FlyHire.

Section 8 Deletion and return

(1) During the term, FlyHire deletes data on the controller’s instructions. The controller is responsible for setting retention periods, for example after the conclusion of an application process.

(2) After the end of the contract, FlyHire hands over the application data to the controller in a common format on request and deletes it within 30 days, unless there is a statutory retention obligation. Data in backups is deleted in the regular backup cycle.

Section 9 Controller’s obligations and liability

(1) The controller is responsible for the lawfulness of the processing, in particular for informing applicants and for the legal bases. It provides FlyHire with a privacy policy, which is linked on the application pages.

(2) Liability is governed by Art. 82 GDPR. Otherwise, the liability provisions of the terms and conditions apply.

Section 10 Final provisions

(1) In the event of conflicts, this agreement takes precedence over the terms and conditions insofar as the protection of personal data is concerned; the Standard Contractual Clauses take precedence over this agreement.

(2) German law applies. Amendments require text form.

Annex 1: Technical and organisational measures

Annex 2: Sub-processors

Last updated: October 2026