Data Processing Addendum

1. Introduction and scope

This DPA applies whenever JobSwitch processes personal data on behalf of a customer or partner (the "controller") in connection with the JobSwitch service. For personal data we collect directly from end users (job-seekers using the WhatsApp agent), JobSwitch acts as the controller; that processing is governed by our Privacy Policy.

2. Definitions

• Applicable data protection laws means India's Digital Personal Data Protection Act, 2023 ("DPDP Act"); the EU and UK General Data Protection Regulation ("GDPR") where applicable; and any other privacy law that applies to a particular processing.
• Controller, processor, data subject, personal data, processing, and sub-processor have the meanings given in the applicable data protection laws.
• Service means the JobSwitch AI agent and related products described in our Terms of Service.

3. Subject matter and duration

The subject matter of processing is the operation of the service. The duration mirrors the term of the underlying service agreement plus any retention period required to return or delete personal data after termination.

4. Nature and purpose of processing

JobSwitch processes personal data to operate the AI agent — to read profiles, search and rank roles, draft applications, submit applications to employers on the data subject's instruction, and communicate with the data subject through WhatsApp.

5. Categories of data subjects

• End users of JobSwitch (job-seekers).

6. Types of personal data

• Identity and contact data: name, email, phone (WhatsApp number).
• Employment and education history, certifications, skills, salary expectations.
• Resume or CV file and its parsed contents.
• Job preferences and constraints.
• WhatsApp messages with the agent.
• Application records: roles applied to, timestamps, and submission content.

7. Processor obligations

JobSwitch will:

• Process personal data only on documented instructions from the controller, including with regard to international transfers, unless required by law to do otherwise.
• Ensure that personnel authorized to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures to secure personal data, including encryption in transit and at rest, role-based access controls, and access logging.
• Assist the controller in responding to data-subject requests using appropriate technical and organizational measures.
• Notify the controller without undue delay, and in any case within 72 hours, of becoming aware of a personal-data breach affecting the controller's data.
• Make available all information reasonably necessary to demonstrate compliance with this DPA.

8. Sub-processors

The controller authorizes JobSwitch to use sub-processors for the purposes set out in this DPA. JobSwitch will impose contractual obligations on each sub-processor that are no less protective than those in this DPA. JobSwitch remains liable for the acts and omissions of its sub-processors.

Our current sub-processors are listed below. We will provide at least 30 days' notice of any new or replacement sub-processor (by email or in-product). The controller may object on reasonable data-protection grounds; if we cannot resolve the objection, the controller may terminate the affected service.

We may add or replace sub-processors as the service evolves. The current list is maintained on this page; for the most up-to-date version or any sub-processor question, email hi@jobswitch.app.

9. International transfers

Where personal data is transferred from India, the EEA, the UK, or any other jurisdiction with cross-border restrictions to a sub-processor in another country, JobSwitch relies on standard contractual clauses or another lawful transfer mechanism recognized under applicable data protection laws.

10. Data subject rights

JobSwitch will assist the controller, by appropriate technical and organizational measures, in fulfilling its obligation to respond to data-subject requests for access, correction, deletion, restriction, portability, and objection within the time periods required by applicable data protection laws.

11. Audits

The controller may audit JobSwitch's compliance with this DPA up to once per year on at least 30 days' written notice and at the controller's cost, conducted during business hours and without disrupting service operations. Where available, JobSwitch may satisfy this obligation by providing the most recent third-party audit report or certification.

12. Return or deletion of data

On termination of the service, JobSwitch will, at the controller's choice, return or delete all personal data within 30 days, unless retention is required by law. Backups containing personal data will be deleted in line with our standard backup retention schedule.

13. Liability

The liability of each party under this DPA is subject to the limitations of liability set out in the underlying service agreement (see our Terms of Service, section 12).

14. Governing law

This DPA is governed by the laws of India. Disputes arising out of or related to this DPA are subject to the same governing law and jurisdiction provisions as our Terms of Service.

15. Contact

For privacy and data-protection matters, including DPA execution requests and sub-processor inquiries, contact hi@jobswitch.app.