StartupJobs Labs
UpWolf

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms an integral part of the Terms of Service of UpWolf and is concluded between the Customer as controller and StartupJobs.com s.r.o., company ID 29153786, registered office at Šostakovičovo náměstí 1515/5, 155 00 Praha 5 – Stodůlky, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 204709, as processor (“Provider”). It fulfils the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR). Capitalised terms have the meaning given in the Terms of Service.

1. Subject matter and duration

  1. The Customer entrusts the Provider with processing the personal data contained in the data that the Customer uploads to the Service or that the Service obtains on the Customer's instructions (“Customer Data”).
  2. Processing lasts for the duration of the contract between the Customer and the Provider and ends with the deletion or return of the data under Article 7.

2. Nature and purpose of processing

  1. The Provider processes Customer Data solely to provide the Service: reading Listings from feeds, URLs, the API or manual entry; preparing Creatives and targeting with the help of AI models; publishing ads on the Customer's Ad Account; monitoring campaigns and their results; generating output feeds for recipients chosen by the Customer; storage and backup.
  2. Processing operations: collection, storage, organisation, adaptation, retrieval, use, disclosure by transmission to the Ad Platform and to feed recipients designated by the Customer, erasure.

3. Categories of data subjects and personal data

The Service is not intended for special categories of personal data (Article 9 GDPR). The Customer will not include them in Listings or Creatives.

4. Obligations of the Provider

The Provider shall:

  1. process Customer Data only on the documented instructions of the Customer, which are given by these Terms, the DPA and the Customer's settings and actions in the Service; beyond these instructions only where required by law. The Provider will inform the Customer if it believes an instruction infringes the law;
  2. keep Customer Data and all related facts confidential, including after the contract ends, and bind all persons authorised to process Customer Data to confidentiality;
  3. take appropriate technical and organisational measures to ensure security, taking into account the state of the art and the nature, scope and purposes of processing (see Annex 2);
  4. assist the Customer in fulfilling its information obligations and in responding to requests from data subjects; if a data subject contacts the Provider directly, the Provider will forward the request to the Customer without undue delay;
  5. notify the Customer of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, and provide the information the Customer needs to notify the supervisory authority and the data subjects;
  6. assist the Customer with data protection impact assessments and prior consultations, to the extent corresponding to the nature of processing;
  7. provide the Customer with all information necessary to demonstrate compliance with this DPA and allow audits by the Customer or an auditor it appoints who is bound by confidentiality, after prior notice of at least 30 days, as a rule once a year and at the Customer's expense. Where possible, the audit will first take the form of a written questionnaire.

5. Sub-processors

  1. The Customer gives the Provider general consent to engage sub-processors. The current list is in Annex 1.
  2. The Provider will inform the Customer by email at least 15 days in advance of any intended addition or replacement of a sub-processor. The Customer may object on reasonable grounds; if the parties do not agree, the Customer may terminate the contract before the change takes effect.
  3. The Provider will bind each sub-processor to data protection obligations at least as strict as those in this DPA and is liable to the Customer for the performance of the sub-processor's obligations.
  4. The Ad Platform (Meta) is not a sub-processor of the Provider. The Customer has its own contractual relationship with the Ad Platform and sends data there on its own instructions through the connected Ad Account. The same applies to recipients of output feeds and to AI assistants that the Customer connects through the MCP connector.

6. Transfers outside the EEA

Customer Data is transferred outside the European Economic Area only with appropriate safeguards under Chapter V of the GDPR, in particular on the basis of an adequacy decision (EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. AI model providers process data only through commercial API interfaces and do not use it to train their models.

7. Deletion and return

  1. The Customer may delete Listings, Creatives and campaigns in the Service at any time.
  2. After the contract ends, the Provider will, at the Customer's instruction, return Customer Data in a common machine-readable format or delete it, including all copies, no later than 30 days after the end of the contract, with backup copies disappearing within a further 30 days. This does not apply where the law requires the Provider to keep the data.

8. Obligations of the Customer

The Customer is responsible for having a lawful basis for processing the personal data it provides to the Service, for informing the data subjects, and for the accuracy of the data. The Customer only provides data that is necessary for its advertising.

9. Final provisions

If a separate data processing agreement has been concluded between the Customer and the Provider, it takes precedence over this DPA. In other respects, the Terms of Service apply, including the limitation of liability and the governing law. This DPA takes effect on 6 October 2026.

Annex 1: Sub-processors

Sub-processorActivityLocation
Webglobe, s.r.o., company ID 26159708Hosting, database, backups, sending emailsCzech Republic (EU)
Anthropic, PBCAI models: reading Listings, preparing ad copy and targeting suggestionsUSA (DPF / SCC)
Slack Technologies, LLCInternal operational notifications for the Provider's team (e.g. campaign name, error)USA (DPF / SCC)

Annex 2: Technical and organisational measures