Legal
Version [email protected] · Last updated: 4 November 2026 (Europe/Amsterdam). Processing of personal data by BoldATS as processor.
Complete English translation of the Dutch Verwerkersovereenkomst. In case of any discrepancy, the Dutch text prevails (Article 18.2).
1.1 This Data Processing Agreement (“DPA”) is entered into between the customer that has concluded a Subscription or Trial for BoldATS (the “Customer”, acting as controller) and S. Simon Communication, trading as BoldATS (“BoldATS”, acting as processor). S. Simon Communication is registered in the Trade Register of the Dutch Chamber of Commerce (KvK) under number 62685252, has VAT identification number NL002218668B93 and is established at Pier Christiaanswei 11A, 8508 SB Delfstrahuizen, the Netherlands.
1.2 This DPA belongs to the Terms of Service of BoldATS (the “Terms”) and applies to all processing of personal data that BoldATS carries out on behalf of the Customer when providing the BoldATS service (the “Service”).
1.3 This DPA does not apply to personal data that BoldATS processes as controller for its own purposes, such as the marketing website, trial, demo and contact requests, account administration, payment and invoicing, and product support (except Customer Personal Data shared in support requests; see Annex C). That processing is described in the Privacy Policy.
1.4 This DPA is intended to meet the requirements of Article 28(3) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).
2.1 Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given to them in the GDPR. Capitalised terms not defined in this DPA have the meaning given to them in the Terms.
3.1 The subject matter of the processing is the provision of the Service: the SaaS Applicant Tracking System (ATS) for recruitment and hiring workflows, including candidates, vacancies/jobs, applications, pipelines and related automation.
3.2 The nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex A.
3.3 The processing lasts for the term of the Subscription or Trial and thereafter for as long as BoldATS still holds Customer Personal Data in accordance with Article 13 of this DPA.
4.1 For Customer Personal Data, the Customer is the controller and BoldATS is the processor. The Customer determines the purposes and means of the processing.
4.2 The Customer is responsible for the lawfulness of the processing, including a valid legal basis, informing data subjects and the accuracy of the personal data it enters into the Service.
4.3 Where the Customer itself acts as processor for a third party, the Customer warrants that its instructions are authorised by that controller; BoldATS then acts as sub-processor of the Customer.
5.1 BoldATS processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless Union or Member State law to which BoldATS is subject requires otherwise. In that case BoldATS informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
5.2 The Terms, this DPA and the Customer’s use and configuration of the Service (including settings made by authorised users) constitute the Customer’s complete documented instructions. Additional instructions must be given in writing and must be consistent with the Terms and the functionality of the Service.
5.3 BoldATS immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. BoldATS may suspend execution of such an instruction until it has been confirmed or amended.
5.4 BoldATS does not process Customer Personal Data for its own purposes, does not sell it and does not use it for advertising or for profiling outside the Customer’s instructions.
6.1 BoldATS ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
6.2 Access to Customer Personal Data by BoldATS is limited to what is necessary to provide, secure and support the Service, or to comply with the law.
7.1 BoldATS implements appropriate technical and organisational measures as referred to in Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of natural persons. The measures are described in Annex B.
7.2 BoldATS may update the measures, provided that the overall level of security is not reduced.
7.3 The Customer is responsible for the security of its own accounts and devices, including managing users and permissions, using strong passwords and, where available, multi-factor authentication.
8.1 The Customer grants BoldATS general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are described in Annex C.
8.2 BoldATS informs the Customer of any intended addition or replacement of a Sub-processor at least fourteen (14) days in advance, by email and/or in the Service. If a replacement is urgently required to safeguard the security or continuity of the Service, BoldATS may engage the new Sub-processor earlier; in that case BoldATS informs the Customer without undue delay. The Customer may object on reasonable data protection grounds in writing within the fourteen (14) day period before the change or, in the case of an urgent replacement, within fourteen (14) days after the notification. BoldATS assesses the objection and, in consultation with the Customer, seeks a reasonable solution within a reasonable period, such as an alternative or additional measures. If the parties cannot reach a solution, the Customer may terminate the affected part of the Subscription with effect from the date on which the new Sub-processor is engaged or, in the case of an urgent replacement, with immediate effect; fees already paid are not refunded, unless mandatory law requires otherwise. By way of exception, solely where the Customer has made a justified objection on data protection grounds to an added or replaced Sub-processor, BoldATS does not offer an appropriate solution and the Customer terminates the affected part for that reason, BoldATS refunds pro rata the amount paid in advance for the remaining prepaid period of that part, calculated from the effective date of termination.
8.3 BoldATS imposes on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures.
8.4 BoldATS remains fully liable to the Customer for the performance of the obligations of its Sub-processors, within the limits of Article 14.
9.1 BoldATS transfers Customer Personal Data to a country outside the European Economic Area (EEA) only if the conditions of Chapter V GDPR are met, for example on the basis of an adequacy decision (including the EU–U.S. Data Privacy Framework for certified recipients) or the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), with supplementary measures where necessary.
9.2 Transfers and the safeguards relied on are described in Annex D.
10.1 Data subject rights: taking into account the nature of the processing, BoldATS assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects (access, rectification, erasure, restriction, data portability and objection). Where the Service offers functions for this, the Customer can use them itself. If BoldATS receives a request directly, it forwards the request to the Customer without undue delay and does not respond itself unless the Customer instructs it to.
10.2 Other obligations: taking into account the nature of the processing and the information available to BoldATS, BoldATS assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority).
10.3 BoldATS may charge reasonable costs for assistance that goes beyond the standard functions of the Service, after prior notice, unless the assistance is required because of a breach of this DPA by BoldATS.
11.1 BoldATS notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and where feasible within 48 hours, so that the Customer can meet its own obligations under Articles 33 and 34 GDPR.
11.2 The notification contains, insofar as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. The initial notification may be preliminary. Information that is not yet available is provided as soon as it becomes available, without undue further delay and, where necessary, in phases.
11.3 BoldATS takes reasonable measures to contain the breach and limit its consequences, and documents the breach. Notification by BoldATS is not an acknowledgement of fault or liability.
11.4 The Customer, as controller, decides whether to notify the supervisory authority and data subjects.
12.1 BoldATS makes available to the Customer all information necessary to demonstrate compliance with the obligations of Article 28 GDPR, such as a description of the security measures and relevant Sub-processor documentation.
12.2 (a) Regular audit: if that information is demonstrably insufficient, the Customer may have an audit carried out, at most once per calendar year, with at least thirty (30) days’ prior written notice, during business hours and without disproportionate disruption of BoldATS’s operations. (b) Exceptional audit: in addition, regardless of whether the information under Article 12.1 is sufficient and without an annual limit, the Customer may have an audit carried out in the case of: (i) a personal data breach that has affected Customer Personal Data; (ii) a serious security incident that affects or may affect Customer Personal Data; (iii) a concrete indication of a breach of this DPA; or (iv) a request or order from a competent supervisory authority. For an exceptional audit, a shorter, reasonable notice period applies or, where required by law, immediate cooperation; such an audit is proportionate and, where possible, limited to the data and systems concerned. Every audit is carried out by the Customer or an independent auditor bound by confidentiality, under reasonable confidentiality and security conditions; the auditor is not given access to data of BoldATS’s other customers. This Article 12 does not limit any statutory audit or inspection rights of the Customer or of supervisory authorities.
12.3 The costs of a regular audit are in principle borne by the Customer. If an audit reveals a demonstrable material failure by BoldATS to comply with this DPA, BoldATS bears the reasonable costs of that audit. Cost arrangements never suspend or block the cooperation required by law towards the Customer or a supervisory authority. Audits of Sub-processors take place through the audit reports and certifications that they make available.
13.1 At the end of the Subscription, the Customer has a reasonable opportunity to export its data, insofar as the Service allows this (Terms, Article 24). Where export via the Service is not (fully) possible, BoldATS will, at the Customer's request, make the Customer Personal Data available in a common machine-readable format within 30 days.
13.2 After the export period and any retention period after the Trial (Terms, Article 7), BoldATS deletes Customer Personal Data in a controlled manner, unless Union or Member State law requires storage of the personal data or a legal hold applies.
13.3 Copies in backups are not restored for other purposes and are overwritten in the normal backup cycle (see Annex B). Until then they remain protected under this DPA.
13.4 At the Customer’s request, BoldATS confirms in writing that deletion has taken place.
14.1 The liability of the parties under this DPA is subject to the limitations of liability in the Terms (Article 22), insofar as permitted by law.
14.2 Nothing in this DPA limits the rights of data subjects under Article 82 GDPR or liability that cannot be limited under mandatory law.
15.1 This DPA forms part of the Terms, is accepted together with the Terms and applies from the start of the Trial or, where there is no Trial, of the Subscription, and remains in force for as long as BoldATS processes Customer Personal Data on behalf of the Customer.
15.2 Obligations that by their nature are intended to continue after the end of this DPA, such as confidentiality, deletion and liability, remain in force.
16.1 In the event of conflict between this DPA and the Terms with regard to the processing of Customer Personal Data, this DPA prevails. Standard Contractual Clauses, where applicable, prevail over this DPA.
17.1 Each version of this DPA has a version identifier. This version: [email protected].
17.2 BoldATS may amend this DPA where this is necessary because of changes in the law, guidance from supervisory authorities or changes in the Service or Sub-processors. Material changes are announced in advance with reasonable notice. Changes cannot reduce the level of protection of Customer Personal Data required by the GDPR.
18.1 This DPA is governed by Dutch law. Disputes are submitted to the competent court in accordance with Article 26 of the Terms.
18.2 This DPA is available in English, Dutch and German. In case of differences between language versions, the Dutch text prevails.
BoldATS applies appropriate technical and organisational measures that include, in any event, measures in the following areas: access control and authorisation on a need-to-know basis; separation of Customer environments (tenants); logging of relevant actions (audit logs); protection of data in transit; backup and recovery, with backup copies automatically deleted after no more than 30 days; and confidentiality obligations for persons with access to Customer Personal Data.
A detailed, current description of the technical and organisational measures is available on request via the contact page.
BoldATS engages the following Sub-processors for Customer Personal Data. The current list of Sub-processors is set out below and forms part of this Annex. Changes are announced in accordance with Article 8.2.
Not Sub-processors for Customer Personal Data (BoldATS is controller for this data; see the Privacy Policy): Cloudflare (marketing website), Typeform (demo, contact and trial forms on the website), WeFact (invoicing and invoice email), Stripe (payments) and website analytics (where enabled).
Where a Sub-processor processes Customer Personal Data outside the EEA — which may include the United States — or where such data is accessible from outside the EEA, this takes place only in accordance with Article 9 (Chapter V GDPR), for example under the EU–U.S. Data Privacy Framework for certified recipients or the Standard Contractual Clauses (Decision (EU) 2021/914), with supplementary measures where necessary.
The recipients, locations and safeguards concerned are listed per Sub-processor in Annex C.
Contact for privacy matters and requests under this DPA: via the contact page.