Data Processing Agreement

01 Purpose and Scope

This Data Processing Agreement ("DPA") governs how YAZAR.DEV processes personal data on behalf of employers ("Data Controllers") who use InstantJob. This DPA forms part of the Terms of Service.

02 Roles

• Data Controller: The employer — determines purpose of processing candidate applications and communications
• Data Processor: YAZAR.DEV — processes candidate data on employer's behalf to deliver platform services
• Independent Controller: YAZAR.DEV — for platform analytics, Government API aggregates, and platform-wide operations

03 Categories of Data Processed

• Candidate name, profile photo, location (when map-visible)
• Professional skills, certifications, work history, hourly rate
• Application messages and in-platform communications
• Ratings submitted by the employer

04 Approved Sub-Processors

• Amazon Web Services (AWS) — Ireland: Cloud hosting and storage
• Stripe — Ireland: Payment processing
• Sentry — US (SCCs): Error monitoring
• Google Analytics — US (SCCs): Anonymized usage analytics (consent-gated)

30 days notice given before engaging new sub-processors. You may object in writing.

05 Security Measures

• TLS 1.3 encryption in transit
• AES-256 encryption at rest
• Role-based access control (RBAC) with audit logging
• Annual third-party penetration testing
• Documented incident response with 72-hour authority notification
• Regular GDPR and security training for all staff with data access

06 International Transfers

Primary processing within EEA (AWS Ireland). External transfers use Standard Contractual Clauses (SCCs) approved by the European Commission. Copies available on request.

For Australian employers: transfers comply with APP 8 cross-border disclosure requirements. For Canadian employers: transfers comply with PIPEDA accountability principles.

07 Audit Rights

Enterprise and government customers may request an annual data processing audit with 30 days written notice to dpo@instantjob.app. We may satisfy audit requests via SOC 2 / ISO 27001 reports or a detailed security questionnaire.

US United States

YAZAR.DEV acts as a "service provider" under CCPA when processing personal information on behalf of employers. We do not use employer-provided candidate data for any purpose other than providing the InstantJob service. We do not sell personal information.

AU Australia

Where employers are Australian entities subject to the Privacy Act 1988, YAZAR.DEV acts as a contracted service provider. We handle personal information only as directed by the employer and in accordance with the APPs.

CA Canada

Under PIPEDA, YAZAR.DEV is a "third party" processing personal information on behalf of Canadian employers. We implement safeguards comparable to those required under PIPEDA Schedule 1 principles.

TR Türkiye

KVKK kapsamında Türk işverenler adına kişisel veri işleyen YAZAR.DEV, "veri işleyen" sıfatıyla hareket etmektedir. İşverenin talebi ve bu DPA çerçevesinde aday verilerini işlemekteyiz. VERBİS kaydı gerektiren Türk işverenler, kendi kayıtlarından sorumludur.