ConsultCV Data Processing Agreement Version of 8 November 2026 This data processing agreement is between the customer that uses a ConsultCV workspace (the controller) and Woberry AB (the processor). It is part of the ConsultCV Terms of Service and is accepted with them, in electronic form, without a signature (Article 28(9) GDPR). It consists of the standard contractual clauses between controllers and processors that the European Commission adopted under Article 28(7) GDPR (Implementing Decision (EU) 2021/915), word for word, with Annexes I to IV filled in for ConsultCV, followed by additional terms that do not contradict the Clauses (Clause 2(b)). The guidance at the end is not part of the agreement. PART 1. STANDARD CONTRACTUAL CLAUSES SECTION I Clause 1. Purpose and scope (a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). (b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29(3) and (4) of Regulation (EU) 2018/1725. (c) These Clauses apply to the processing of personal data as specified in Annex II. (d) Annexes I to IV are an integral part of the Clauses. (e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. (f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. Clause 2. Invariability of the Clauses (a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them. (b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects. Clause 3. Interpretation (a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation. (b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively. (c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects. Clause 4. Hierarchy In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail. Clause 5 - Optional. Docking clause (a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I. (b) Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I. (c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party. SECTION II. OBLIGATIONS OF THE PARTIES Clause 6. Description of processing(s) The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II. Clause 7. Obligations of the Parties 7.1. Instructions (a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented. (b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or the applicable Union or Member State data protection provisions. 7.2. Purpose limitation The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller. 7.3. Duration of the processing of personal data Processing by the processor shall only take place for the duration specified in Annex II. 7.4. Security of processing (a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects. (b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 7.5. Sensitive data If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards. 7.6. Documentation and compliance (a) The Parties shall be able to demonstrate compliance with these Clauses. (b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses. (c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor. (d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice. (e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request. 7.7. Use of sub-processors (a) The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object. (b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. (c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy. (d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations. (e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data. 7.8. International transfers (a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725. (b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met. Clause 8. Assistance to the controller (a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller. (b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions (c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor: (1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons; (2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk; (3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated; (4) the obligations in Article 32 of Regulation (EU) 2016/679. (d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required. Clause 9. Notification of personal data breach In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679 or under Articles 34 and 35 of Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor. 9.1 Data breach concerning data processed by the controller In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller: (a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons); (b) in obtaining the following information which, pursuant to Article 33(3) of Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include: (1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (2) the likely consequences of the personal data breach; (3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. (c) in complying, pursuant to Article 34 of Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons. 9.2 Data breach concerning data processed by the processor In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least: (a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned); (b) the details of a contact point where more information concerning the personal data breach can be obtained; (c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679. SECTION III. FINAL PROVISIONS Clause 10. Non-compliance with the Clauses and termination (a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason. (b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if: (1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension; (2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725; (3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. (c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions. (d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses. ANNEX I. List of parties Controller(s): - Name: The business that accepts the Terms of Service for a ConsultCV workspace, and with them this agreement: the customer. Its name is the one on the workspace's billing details, or the workspace's name when it has none. - Address: The address on the workspace's billing details. A controller on the Free plan, or one that wants another address here, sends it to us and we add it. - Contact person's name, position and contact details: The workspace's owners, at the email addresses of their accounts. The controller may name another contact, or its data protection officer, by writing to us. - Signature and accession date: Accepted electronically, for the controller, by the person who creates the workspace, when they create it; and again by the controller whenever it accepts a newer version of the Terms. We record who accepted which version, and when. Processor(s): - Name: Woberry AB, an aktiebolag (Swedish limited company), organisation number 559474-0267, VAT number SE559474026701, registered with Bolagsverket (Swedish Companies Registration Office) - Address: Göteborg, Sweden. Registered address: available from Bolagsverket under the organisation number above, or by email on request. - Contact person's name, position and contact details: The ConsultCV team, support@consultcv.com, for every question about this agreement, data protection and security. Woberry AB has not appointed a data protection officer. - Signature and accession date: Accepted by Woberry AB by publishing this agreement and providing ConsultCV under it. Version of 8 November 2026. ANNEX II. Description of the processing Categories of data subjects whose personal data is processed - Consultants whose profiles the controller keeps: its employees, subcontractors and freelancers, and candidates it considers. - The controller's members of the workspace (owners, admins, managers and consultants) and the people it invites. - People named in the content the controller adds: contact persons at clients and brokers in a request, and references or colleagues named in a CV. Categories of personal data processed - Consultant profiles: first and last name, professional title, email address, phone number, location, photo (optional), summary, availability, languages and their levels, skills with level and years, education, certifications, the profile's language, when it was last updated and by whom, and whether and when a freshness reminder was sent. A profile can be linked to the consultant's own member account. - Assignments in a profile: the client's name or an anonymised label, role, start and end month, description, technologies, industry, public or private sector, whether it is a highlight, and its order. - Client requests: title, client name, where the request came from (direct or a broker, and the broker's name), reference, deadline, the request text as pasted, the requirements found in it, output language, status, when it was submitted, and who created it. - Candidates on a request: the requirement match (a Yes, Partly or No verdict and evidence for each requirement), the score counted from the verdicts, the tailored CV (summary, assignment order and rewritten descriptions, highlighted skills, when and by which model it was made), the CV's language, template, whether it is anonymised, and its status (draft or final). - Workspace members and invitations, as they appear in the workspace: name, email address and role; for an invitation, the invitee's email address, role, who invited them and when it expires. - Workspace settings and branding: the workspace's name, logo, colours, font, template, default language, whether CVs are anonymised by default, and a PDF footer. - Usage counters per workspace and month (how many tailored CVs and AI credits were used): numbers, not content. - CV files (PDF or Word, up to 4 MB) that a member imports: read in memory to extract their text and then discarded, never stored. - Personal data of other people that the content itself contains, such as a client contact named in a request, or a reference named in a CV. Sensitive data processed (if applicable) and applied restrictions or safeguards ConsultCV has no field for sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation, or criminal convictions and offences), nor for a personal identity number (personnummer), date of birth or nationality. Free text such as a summary, an assignment description or an imported CV can still contain such data if the controller puts it there. A consultant photo is stored as an image and shown on CVs. It is not biometric data in the sense of Article 4(14) GDPR, because nothing processes it by specific technical means to identify a person: photos never go to the AI and are never analysed. Safeguards: the import sends a CV's text to the AI once, to structure it, and the file itself is not kept; matching and tailoring send the profile without the name, contact details or photo; an anonymised CV leaves out the name, contact details and photo and names each client by its sector; within a workspace only its members see its content, and a consultant sees only their own profile. The guidance below asks the controller to keep sensitive data and personal identity numbers out of profiles and requests unless it has a legal basis and a need for them. Nature of the processing - Storing and showing the workspace's content to its members, according to their roles. - Importing CVs: extracting the text of a PDF or Word file in memory and having the AI structure it into a draft profile, which a member reviews and saves. - Reading a pasted request: having the AI list its requirements as must or should, with its title, client and deadline, which a member reviews. - Finding consultants for a request: ranking the workspace's profiles by the words they share with the request, without AI; then, for up to 5 profiles a member picks, having the AI give each requirement a Yes, Partly or No verdict with evidence from the profile, and counting a score from those verdicts in code (musts weigh 70, shoulds 30, a partly counts half). - Tailoring a CV: having the AI rewrite the summary and the most relevant assignment descriptions for the request, using only facts in the profile, and order the assignments. - Rendering CVs and requirement matrices as PDF and Word files, branded or anonymised, when a member exports them. - Sending emails the workspace's use causes: invitations, and a reminder to a consultant linked to a profile that has not been updated for 90 days (at most every 30 days; they can turn it off). - Exporting the whole workspace, and deleting content, profiles or the workspace when a member asks. - Backups, logs and alerts needed to run the service securely, as Annex III describes. Purpose(s) for which the personal data is processed on behalf of the controller To provide ConsultCV to the controller: keeping its consultant profiles, matching them to client requests and tenders, and producing tailored CVs and requirement matches for the controller to check and send. Every verdict, score and tailored CV is a draft for a person in the controller's business to check. ConsultCV takes no decision about anyone: the controller's people decide whom to propose, engage or hire (Terms, section 6). Duration of the processing For as long as the controller's workspace exists. A profile, request or candidate the controller deletes is deleted at once; when the controller deletes the workspace, or this agreement ends, the processing ends as Clause 10(d) says. Deleted data is removed from the live database at once. It can no longer be restored after 7 days, and it is gone from our database provider's encrypted backups after at most 30 days. Photos and logos are deleted from file storage at the same time; a file whose deletion fails is reported to our team, and we remove it by hand within 30 days. Server logs are kept for at most 30 days. For processing by (sub-) processors, also specify subject matter, nature and duration of the processing Each sub-processor in Annex IV processes only what its row says, for the purposes above, for as long as this agreement runs, and deletes it as its own data processing terms say when we delete it or the agreement ends. AI requests are processed for the request only. ANNEX III. Technical and organisational measures including technical and organisational measures to ensure the security of the data What /security says, which is part of this Annex - Every consultant profile, assignment, request and match belongs to one workspace, and every read and write is filtered by that workspace. The database itself refuses a row that points into another workspace, and automated tests check that one workspace can never see another's data. - Inside a workspace, roles decide who sees what. Owners and admins manage members and billing, managers work on profiles and requests, and a consultant sees and edits only their own profile. - CV files you import are read in memory and not stored. What is stored is the structured profile you save from them, and the request text you paste. - Consultant photos and workspace logos are stored as files, in a folder of their own for each workspace. They are served from public addresses with a random, unguessable part: whoever has a file's address can open it, and nobody can list or guess the others. - Analytics is cookieless: nothing is stored on your device for analytics. Error reports leave out request bodies and cookies, and AI errors are scrubbed of CV text before they are sent. - CV import, requirement extraction, matching and tailoring run through the Vercel AI Gateway on OpenAI models. The gateway may send a request only to OpenAI, and only under terms that rule out training models on it. We send what each step needs: the CV text for an import, and for matching and tailoring the request and the profile without the consultant's name, contact details or photo. We do not use your content to train models. - The AI is told to use only facts in the profile. A requirement without evidence is marked No, and a rewrite that adds a number the profile doesn't have falls back to the original text. - Every match and tailored CV is a draft, and the app says so where it shows them. A person checks each verdict and can change it, and a person decides whom to propose: nothing leaves ConsultCV until someone exports it. Finding consultants for a request first ranks profiles by the words they share with it, without AI. The score only counts the verdicts (musts weigh 70, shoulds 30, a partly counts half), is never sent in an export, and is not a rating of the person. Photos never go to the AI. - People sign in with a password, a magic link sent to their email address, or Google. Everyone who signs up with a password gets a link to confirm their email address, and a workspace invitation can be accepted only from a confirmed address. Passwords are stored only as salted scrypt hashes. Sessions expire after a week without use. Workspace changes such as roles and invitations run on the server only, after the permission check for that role. - Owners and admins can export the whole workspace at any time: every profile, assignment, request, candidate and setting as JSON, plus a Word CV per consultant. - An owner can delete the workspace. Its data is removed from the database at once and its subscription ends. Its photos and logos are deleted from file storage too; that step is best effort. - Anyone can delete their own account from their settings. A workspace they are the only member of goes with it; if they are the only owner of a workspace with other members, they must hand over ownership first. - Deleted data is removed from the live database at once. It can no longer be restored after 7 days, and it is gone from our database provider's encrypted backups after at most 30 days. A file whose deletion fails is reported to our team in an alert and the error logs, and we remove it by hand within 30 days. Measures of pseudonymisation and encryption of personal data - Every connection to the app is encrypted (HTTPS only, with Strict-Transport-Security for two years, including subdomains). The database accepts only encrypted connections. - Stored data is encrypted at rest by the providers: the database with AES-256 (Neon), and photos and logos with AES-256 (Vercel Blob), as each provider states. - Passwords are stored only as salted scrypt hashes. - Anonymised CVs leave out the consultant's name, contact details and photo and name each client by its sector. The AI gets profiles for matching and tailoring without the name, contact details or photo. Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services - Every action that reads or changes a workspace runs on the server, takes the workspace from the signed-in member's session, never from the request, and checks what the member's role allows. The sign-in library's own workspace endpoints refuse every call from a browser. - All input is validated on the server. Imported files are capped and checked against zip bombs before they are read. Request and CV text goes to the AI between delimiters it cannot close, with an instruction to treat it as data. - Rate limits: 5 password sign-ins a minute per network, and limits on sign-ups, password resets and sign-in links; the trial without an account is limited per network and day. - Security headers forbid framing the app in another site and guessing content types. - The app runs on Vercel's managed platform in Frankfurt and the database on Neon's managed Postgres in Frankfurt; both are run and patched by the provider. Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident - The database can be restored to any point in the last 7 days, and the provider keeps encrypted backups for 30 days. - The controller can export the whole workspace at any time (JSON plus a Word CV per consultant) and keep its own copy. Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing - Automated tests run on every change, among them tests against a real database that one workspace can never read or change another's rows, tests of every role's permissions, and tests that hold the legal pages, this agreement and the security page to the code they describe. - Woberry AB reviews these measures when the service changes and at least once a year. No external penetration test has been made yet. Measures for user identification and authorisation - Each person signs in to their own account, with a password, a magic link sent to their email address (valid for 15 minutes), or Google. Sessions end after 7 days without use, and a password reset ends every other session. - Two-factor sign-in is not offered yet. - Within a workspace, the role decides access: owners and admins manage members and billing, managers work on profiles and requests, a consultant sees only their own profile. The Free plan is for one person. Measures for the protection of data during transmission - HTTPS between the browser and the app; encrypted connections between the app and the database, file storage and the AI gateway. - Exports are made on request and downloaded by the member over HTTPS; ConsultCV sends nothing to clients or brokers itself. Measures for the protection of data during storage - The database and file storage are in Frankfurt, Germany, and encrypted at rest by the providers. - Each workspace's rows carry its id, and the database refuses a row that points into another workspace. Each workspace's files are in a folder of their own. - Photos and logos are served from public addresses with a random, unguessable part, so whoever has an address can open that file. Moving them to private storage is planned. Measures for ensuring physical security of locations at which personal data are processed - Woberry AB runs no servers of its own. The data is processed in the data centres of Vercel and Neon (Amazon Web Services, Frankfurt), whose physical security the providers run and audit. Measures for ensuring events logging - The app's server logs (Vercel) record requests and errors for at most 30 days. Errors are logged without request bodies or cookies; email addresses, keys and tokens are removed, and AI errors are scrubbed of CV text. - A profile records when it was last changed and by whom, and a request who created it. A support session in which our staff sign in as a member is marked in the session record with the staff member's account. - There is no log of who viewed which profile. Measures for ensuring system configuration, including default configuration - A new workspace is private to its members. A consultant who is invited sees only their own profile. Anonymised CVs, Word export and branding follow the workspace's plan and settings. - Production settings and keys live in the hosting provider's environment settings, not in the code. Test-only switches are ignored in production. Measures for internal IT and IT security governance and management - Only Woberry AB's own staff with an administrator account can reach the admin pages. They see accounts and usage counts, not workspace content. They can open a workspace's content only by signing in as one of its members, for at most one hour per session, and do so only when the controller asks for support or to investigate a security incident. - Everyone at Woberry AB who can reach personal data is bound to confidentiality. Measures for certification/assurance of processes and products - Woberry AB holds no certification. Its sub-processors publish their own security reports and certifications, which we pass on when the controller asks. Measures for ensuring data minimisation - CV files are not stored. The AI gets only what each step needs, without names, contact details or photos for matching and tailoring. - Usage statistics and alerts carry ids and counts, never workspace content. Measures for ensuring data quality - Every imported or AI-written field is a draft a member reviews and can change. The AI is told to use only facts in the profile; a rewrite that adds a number the profile does not have falls back to the original text. - A consultant linked to a profile is reminded to update it after 90 days without changes. Measures for ensuring limited data retention - The controller decides how long content stays: anything it deletes is deleted at once. Deleted data is removed from the live database at once. It can no longer be restored after 7 days, and it is gone from our database provider's encrypted backups after at most 30 days. Measures for ensuring accountability - This agreement, its version history on this page, and the record of who accepted it for each workspace and when. - Our record of processing as a processor (Article 30(2) GDPR): these Annexes, with the workspaces and their owners as our database lists them, which we produce in writing on request. Measures for allowing data portability and ensuring erasure - Owners and admins can export the whole workspace at any time as JSON plus a Word CV per consultant, on every plan. A single CV can be exported as PDF, and as Word on Team and Growth. - Members with the right role can correct or delete any profile, request or candidate; an owner can delete the workspace, which deletes everything in it. Description of the specific technical and organisational measures to be taken by the processor to be able to provide assistance to the controller - Requests from data subjects (Clause 8(a) and (b)): we forward any request we receive about a workspace's content to its owners without undue delay and do not answer it ourselves unless the controller asks us to. The controller can answer most requests itself with the tools above: show, correct, export or delete a profile. - Data protection impact assessments and prior consultation (Clause 8(c)): this agreement's Annexes describe the processing and the measures; we answer the controller's further questions in writing. - Personal data breaches (Clause 9.2): we notify the workspace's owners by email, without undue delay after we become aware of a breach of their workspace's data, with what we know then and the rest as we learn it. The contact point is the email address in Annex I. ANNEX IV. List of sub-processors The controller has authorised the use of the following sub-processors: 1. Vercel Name: Vercel Inc., United States Where: The app's server functions run in Frankfurt, Germany (fra1). Pages and files are delivered through Vercel's global network, from the location nearest you. Description of the processing: Runs the app: every request, and so all workspace content, passes through its server functions in Frankfurt, Germany (fra1). Keeps server logs for at most 30 days. Pages and files go out through its global network. 2. Neon (Postgres database host) Name: Neon, United States (the database host) Where: Frankfurt, Germany (AWS eu-central-1) Description of the processing: Stores the workspace's database rows: profiles, assignments, requests, matches, tailored CVs, members, invitations and settings, in Frankfurt (AWS eu-central-1), with a 7-day restore window and its own encrypted backups for up to 30 days. 3. Vercel Blob Name: Vercel Inc., United States (Vercel Blob) Where: Frankfurt, Germany Description of the processing: Stores consultant photos and workspace logos in Frankfurt, under a folder per workspace, until they are replaced or deleted. 4. Vercel AI Gateway, routing to OpenAI Name: Vercel Inc., United States (AI Gateway), passing each request to OpenAI, United States, for model inference Where: United States, under the EU-US Data Privacy Framework or standard contractual clauses Description of the processing: For each AI step, the text the step needs: a CV's text when it is imported; a request's text when its requirements are found; for matching and tailoring, the requirements and the profile without the name, contact details or photo. Processed in the United States for the request only; not used to train models. Photos never go to the AI. 5. Resend Name: Resend, United States (email sending, EU region) Where: EU region, Ireland (eu-west-1) Description of the processing: Sends the emails the workspace's use causes: invitations (the invitee's address, the workspace's and the inviter's names) and profile reminders to consultants linked to a profile (their name and address, the workspace's name). From Ireland (eu-west-1). 6. Discord Name: Discord Inc., United States Where: United States, under the EU-US Data Privacy Framework or standard contractual clauses Description of the processing: Internal alerts to our team. No workspace content is sent on purpose: alerts carry ids and counts, and error messages with email addresses, keys and tokens removed. 7. Slack Name: Slack Technologies, LLC, United States, only if our team adds a Slack channel Where: United States, under the EU-US Data Privacy Framework or standard contractual clauses Description of the processing: The same internal alerts as Discord, if a Slack channel is added. Contact for each sub-processor: through Woberry AB, at the address in Annex I. A copy of each sub-processor's data processing terms is available on request (Clause 7.7(c)). Where a sub-processor's processing involves a transfer to the United States, it relies on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the Commission's standard contractual clauses (Clause 7.8(b)). Not sub-processors under this agreement: - Stripe: Stripe handles billing: our own data about the customer as its supplier, as controller under the privacy policy. It receives no workspace content. - Google: Google handles Sign in with Google for the people who choose it, under its own privacy policy: sign-in data, not workspace content. PART 2. ADDITIONAL TERMS 1. How this agreement is concluded This agreement is part of the ConsultCV Terms of Service. A business concludes it with us when it accepts the Terms for a workspace: the person who creates the workspace accepts them on its behalf. It is concluded in electronic form, which Article 28(9) GDPR allows, so no signature is needed. We record who accepted which version, and when. A countersigned copy is available on request. This agreement applies to the personal data in the workspace's content (Annex II). It does not cover the data we process as controller under our privacy policy: the accounts people sign in with, billing, support messages, security logs, and usage counts that carry ids and numbers but no workspace content. We use the workspace's content for nothing else, never sell it, and never use it to train AI models. 2. The controller's instructions The controller's documented instructions (Clause 7.1) are this agreement, the Terms, and what its members do with the service's features and settings: importing, matching, tailoring, exporting, deleting. The controller can give further instructions by email to the address in Annex I. 3. Notices We send notices under this agreement, including breach notifications, to the workspace's owners at the email addresses of their accounts. The controller sends notices to the address in Annex I. 4. Changes to the sub-processors We tell the workspace's owners by email at least 30 days before we add or replace a sub-processor (Clause 7.7(a)), and update Annex IV here. The controller can object by email within that time, with its reasons. We will try to resolve the objection; if we cannot, the controller may end its use of ConsultCV and delete the workspace before the new sub-processor processes its data. 5. Audits To check our compliance (Clause 7.6), the controller first asks us in writing for the information it needs, and we answer within a reasonable time. An inspection is agreed in advance with reasonable notice, takes place during business hours, does not give access to other customers' data, and is subject to confidentiality. Each party bears its own costs. 6. When the agreement ends Before deleting the workspace, the controller can export everything in it (the return of the data under Clause 10(d)). Deleting the workspace is the instruction to delete; we confirm the deletion by email when asked. Billing records about the controller as our customer are our own records, which Swedish bookkeeping law requires us to keep, and are not covered by this agreement. 7. Liability, law and order of precedence The liability terms (section 10) and the governing law and disputes terms (section 12) of the Terms of Service apply to this agreement. Nothing in this agreement limits a data subject's rights, including under Article 82 GDPR. If this agreement and the Terms conflict on the processing of personal data, this agreement prevails, and within it the Clauses prevail (Clause 4). 8. Changes to this agreement The Clauses do not change (Clause 2(a)). When we update the information in the Annexes or these additional terms, we publish the new version on this page with its date, and we tell the workspace's owners by email at least 30 days before a change that affects them takes effect. GUIDANCE FOR THE CONTROLLER (not part of the agreement) Telling your consultants (Articles 13 and 14 GDPR) You, not we, inform the consultants whose profiles you keep: as their employer or contracting party you are the controller, and we are your processor. Tell them when you collect their CV, or, if you get it from someone else such as a broker or a previous employer's document, within a reasonable time and at the latest within a month (Article 14(3)). Include ConsultCV in the notice you already give employees and subcontractors, or use the text below. Tell them that AI reads their CV and drafts matches and CVs, that the AI runs in the United States, and that a person in your business checks the result and decides. Your legal basis Choose your own legal basis under Article 6 GDPR: for employees and subcontractors usually the contract with them or your legitimate interest in offering them to clients; for candidates, your legitimate interest or their request. Consent is rarely a good basis for employees, who are not free to refuse. What to keep out of profiles Leave out sensitive data (health, trade union membership, religion and the other categories in Article 9 GDPR) and personal identity numbers. In Sweden a personnummer may be processed without consent only when it is clearly justified (lagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 3 kap. 10 §). Add a photo only where clients expect one, and send anonymised CVs to brokers. AI, decisions and your consultants' representatives Do not let a match, a verdict or a score decide on its own whom you propose, engage or hire. Article 22 GDPR restricts decisions based solely on automated processing that significantly affect a person; with a person deciding, as ConsultCV is built for, it should not apply, but you must keep that true in practice. If you use ConsultCV to choose among subcontractors or candidates, the EU AI Act may treat that use as high-risk (Annex III, point 4), with duties for you as deployer from 2 December 2027, among them informing workers' representatives and the workers concerned before use (Article 26(7)). Check also whether your collective agreements or local co-determination rules require you to inform or consult first. Consider a data protection impact assessment (Article 35 GDPR): matching evaluates people, and they are often your employees. Annexes II and III describe the processing and the measures for it; ask us for anything else. A notice you can adapt for your consultants: > We keep your CV as a profile in ConsultCV, a service that Woberry AB (Sweden) runs for us as our processor. We use it to match you to our clients' requests and tenders and to send tailored CVs to clients and brokers. > ConsultCV's AI reads your CV to make the profile, and drafts requirement matches and tailored CVs. It runs on OpenAI models in the United States, under the EU-US Data Privacy Framework or the EU's standard contractual clauses. A person in our team checks every draft and decides whom we propose. > We do this because [our contract with you / our legitimate interest in offering you for assignments]. We keep your profile [while you work with us, and delete it within [ ] after]. You can ask us for a copy of your data, to correct it, to delete it or to restrict it, and you can object. Contact: [ ]. You can also complain to the Swedish Authority for Privacy Protection (IMY), or the supervisory authority where you live.