Data Processing Addendum

1. Application, parties and electronic execution

This Data Processing Addendum (DPA) forms part of the agreement (Agreement) between the customer identified in an order form, account or other signed agreement (Customer) and VRS LLC, Amman, Hashemite Kingdom of Jordan (VRS), when VRS processes personal data on Customer’s behalf to provide VRS Recruit or another contracted service.

This DPA becomes binding when Customer signs or accepts an Agreement that references VRS’s online terms or DPA, clicks to accept it through an authorized account, or both parties sign it. Customer’s account and Agreement supply Customer’s legal name, address, contact and signature details. A person accepting for Customer represents that they have authority to do so.

2. Definitions

Applicable Data Protection Law means privacy and data-protection law that applies to the processing, including Jordan’s Personal Data Protection Law No. 24 of 2023 and its regulations and instructions, and, where applicable, the EU General Data Protection Regulation 2016/679 (GDPR).

Customer Personal Data means personal data contained in Customer Data that VRS processes as processor for Customer. Data Subject, Controller, Processor, Processing, Personal Data Breach, and Subprocessor have the meanings in Applicable Data Protection Law. Restricted Transfer means a transfer requiring an adequacy or contractual safeguard under Applicable Data Protection Law.

3. Roles, subject matter and compliance

1. Customer is the Controller, or a Processor lawfully appointing VRS as its Subprocessor. VRS is the Processor or Subprocessor for Customer Personal Data.
2. Each party will comply with the obligations that apply to its role. Customer is responsible for the lawfulness of its instructions, data collection, notices, consent, recruitment criteria, automated-decision safeguards, retention choices and Data Subject communications.
3. VRS will process Customer Personal Data only for the subject matter, nature, purposes, duration, Data Subjects and categories in Annex A and the Agreement.
4. If VRS is required by law to process data outside Customer’s instructions, VRS will notify Customer before processing unless law prohibits notice.
5. VRS will promptly inform Customer if, in VRS’s reasonable opinion, an instruction violates Applicable Data Protection Law. VRS may suspend the affected processing until the parties resolve the issue.

4. Documented instructions and purpose limitation

The Agreement, Customer’s authorized use and configuration of the Services, support requests, and other written directions accepted by VRS are Customer’s documented instructions. VRS will not exceed the specified purpose or duration. VRS will not sell Customer Personal Data, use it for third-party advertising, or disclose it except under the Agreement, Customer’s instruction, or applicable law.

Customer authorizes VRS to make the transfers and disclosures reasonably necessary to provide enabled features through the Subprocessors in Annex C. Additional instructions that require a material product change or unusual assistance may be subject to feasibility, a written change order and reasonable fees.

5. Confidentiality and authorized personnel

VRS will limit access to personnel and contractors who need Customer Personal Data for their assigned duties. VRS will ensure they are bound by confidentiality, receive appropriate data-protection and security direction, and process data only within their authorization. These duties survive the end of their access and the Agreement.

6. Security, technical and organizational measures

1. VRS will maintain the measures in Annex B, taking into account the state of the art, implementation cost, processing scope and risk.
2. VRS may update measures as technology and risk change, provided the overall protection is not materially reduced.
3. Customer is responsible for using available account safeguards, managing authorized users, configuring roles and retention, securing its own endpoints, and avoiding unnecessary sensitive data.
4. VRS will maintain appropriate continuity, backup, access-control, incident-response and restoration procedures and will periodically assess the effectiveness of relevant controls.
5. VRS does not represent that it holds ISO 27001, SOC 2 or another certification unless VRS separately provides current written evidence.

7. Subprocessors

1. Customer gives general written authorization for the Subprocessors in Annex C, subject to this section.
2. VRS will impose written data-protection obligations on each Subprocessor that are no less protective for the delegated processing than the relevant obligations in this DPA. VRS remains responsible for its Subprocessors to the extent required by Applicable Data Protection Law.
3. VRS will post an updated schedule and give subscribed Customers at least 30 days’ notice before a new Subprocessor begins materially processing Customer Personal Data, unless an urgent security or continuity need makes shorter notice necessary.
4. Customer may object within 15 days of notice on reasonable, documented data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If none is available, Customer may stop the affected feature or terminate only the affected Service and receive a pro-rata refund of prepaid fees for its unused period.
5. Customer may subscribe to change notices by emailing hamzah@vrsjo.com from its contract-contact address.

8. Data Subject, regulatory and impact-assessment assistance

Taking into account the nature of processing and information available to VRS, VRS will reasonably assist Customer with:

• secure access, correction, completion, restriction, objection, portability, deletion or concealment requests;
• consent withdrawal and objections to unnecessary, excessive, discriminatory, unfair or unlawful profiling;
• providing meaningful information and human-review routes for qualifying automated decisions;
• security inquiries, regulator consultations and legally required records;
• data-protection impact assessments, including the annual or transfer-related assessments required under Jordanian law; and
• Customer’s breach assessment and required notifications.

VRS will not respond substantively to a request about Customer Personal Data except on Customer’s instruction or as required by law. VRS will forward the request where it can identify the relevant Customer. Customer is responsible for verifying the requester and deciding the response.

9. Personal Data Breaches and government demands

1. VRS will notify Customer immediately and without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.
2. As information becomes available, notice will describe the nature of the incident, affected data and people, likely consequences, mitigation, and a VRS contact. VRS may provide information in phases and will take reasonable steps to contain, investigate, remediate and prevent recurrence.
3. Notification is not an admission of fault. Customer controls notices to Data Subjects and authorities unless law assigns the duty directly to VRS.
4. VRS will notify Customer of a legally binding government demand for Customer Personal Data where permitted, review its validity, disclose only the required minimum, and reasonably support Customer’s protective efforts.

The parties acknowledge that Jordanian law may require a Controller to notify affected people within 24 hours and the Personal Data Protection Unit within 72 hours after discovering a serious breach. Customer must preserve enough response time when directing VRS and its own processors.

10. Compliance evidence and audits

1. VRS will make available information reasonably necessary to demonstrate compliance, such as security summaries, architecture evidence, policy extracts, penetration or vulnerability-review summaries when available, and Subprocessor information.
2. Customer may conduct one reasonable audit per 12-month period through document review or a qualified independent auditor, on at least 30 days’ notice, during business hours, subject to confidentiality and without accessing another customer’s data.
3. Additional or on-site audits are permitted when required by a regulator, following a material incident, or where supplied evidence is reasonably insufficient. Customer will bear its audit cost unless the audit identifies VRS’s material breach.
4. Audits must not compromise security, service availability, privilege or another party’s rights. VRS may satisfy overlapping requests with a recent independent report or pooled response.

11. Return, deletion and retention

During the Agreement, VRS will provide supported export, correction, anonymization and deletion controls and reasonable assistance. On Customer’s written instruction or at termination, VRS will return, delete, conceal or anonymize Customer Personal Data as required by Applicable Data Protection Law and the Agreement, unless law requires continued retention.

Deletion proceeds across supported active records, processor systems and rolling backup cycles. Some records may be anonymized to preserve referential, financial or audit integrity. Security, audit, legal-hold and commercial records may be retained for their applicable period. Residual backups remain protected from ordinary use and will be overwritten or deleted under the applicable cycle. VRS will provide a deletion confirmation on reasonable written request when the process is complete.

12. International and Restricted Transfers

1. VRS will not transfer Customer Personal Data outside Jordan unless the Controller has a lawful transfer basis and the recipient provides the protection required by Articles 14 and 15 of Jordan’s Personal Data Protection Law or an applicable exception is documented.
2. Customer authorizes processing in the locations in Annex C and will document any required Jordan transfer assessment or consent. VRS will provide information reasonably needed for that assessment.
3. For an EEA Restricted Transfer to VRS in a country without an adequacy decision, the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 (SCCs) are incorporated by reference. Module 2 applies when Customer is Controller; Module 3 applies when Customer is Processor. Annex D completes the selections and appendices.
4. The parties will complete a transfer impact assessment and implement supplementary measures reasonably required by law. VRS will promptly inform Customer if it can no longer comply with the transfer safeguard.
5. For UK or Swiss transfers, the parties will execute or incorporate the regulator-approved addendum or adaptation applicable at the time. Contact hamzah@vrsjo.com before the Restricted Transfer.

The official SCC text is available on EUR-Lex. Nothing in the Agreement modifies the SCCs or limits Data Subject rights under them.

13. Term, liability and order of precedence

This DPA lasts while VRS processes Customer Personal Data. The Agreement’s liability terms apply between the parties to the extent permitted by law, but do not limit rights or liability that cannot lawfully be limited and do not override the SCCs. If this DPA conflicts with the Agreement on processing, this DPA controls. If it conflicts with the SCCs for a Restricted Transfer, the SCCs control.

Changes required by law may take effect on notice. Other material changes apply under the Agreement. Invalid terms are limited to the minimum extent needed while preserving the remaining DPA.

Annex A — Processing details

Annex B — Current technical and organizational measures

These measures describe the current control framework, not a certification or guarantee. VRS will provide additional non-public implementation detail under confidentiality where reasonably required for a Customer assessment.

Annex C — Current Subprocessor and provider schedule

“Optional” means the provider receives Customer Personal Data only when Customer or an authorized user enables or uses the associated feature. Locations are high-level because provider networks and customer-selected regions may change; the current provider contract and transfer assessment control.

Annex D — EU SCC selections and appendices

For an applicable EEA Restricted Transfer, the parties complete the SCCs as follows:

• Module: Module 2 (Controller to Processor) or Module 3 (Processor to Processor), according to Customer’s role.
• Clause 7: the docking clause applies.
• Clause 9: Option 2, general written authorization, with the 30-day notice period in Section 7.
• Clause 11: the optional independent dispute-resolution language does not apply.
• Clause 17: Option 1; the SCCs are governed by the law of Ireland.
• Clause 18: the courts of Ireland have jurisdiction for SCC disputes.
• Annex I.A: the Data Exporter is Customer, with the name, address, contact and activities in the Agreement; the Data Importer is VRS LLC, Amman, Jordan, hamzah@vrsjo.com, providing the activities in Annex A.
• Annex I.B: Annex A of this DPA describes the transfer, including categories, frequency, purpose and duration.
• Annex I.C: the competent supervisory authority is determined under SCC Clause 13; where a fallback is required and lawful, the Irish Data Protection Commission applies.
• Annex II: Annex B of this DPA.
• Annex III: Annex C of this DPA for Module 3 and any other case requiring the list.

The Agreement’s electronic acceptance records are the parties’ signatures for the incorporated SCCs to the extent electronic execution is legally valid. Either party will provide a countersigned copy or complete additional exporter details on reasonable request.