1. Scope And Application
1.1. This Privacy Policy ("Policy") describes how Insight Agency UG ("DonutJobs," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data in connection with the DonutJobs platform, website, applications, APIs, and related services (collectively, the "Platform"). 1.2. This Policy applies to all Users globally, including Users located in the United States, the Republic of the Philippines, the European Economic Area ("EEA"), the United Kingdom, and all other jurisdictions from which the Platform is accessed. 1.3. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where consent is the legal basis for processing (see Section 4), your continued use of the Platform constitutes your consent to the practices described herein. 1.4. This Policy should be read together with our Terms of Service, which contain additional provisions regarding public data, automatic profile creation, the Talent Pool, and data subject rights. In the event of a conflict between this Policy and the Terms of Service regarding data processing practices, this Policy shall prevail. 1.5. This Policy contains limitations of liability, consent provisions, and waivers that affect your legal rights. By using the Platform, you acknowledge that you have read and understood these provisions.
2. Data Controller
2.1. The data controller for personal data processed through the Platform is: Insight Agency UG Mildred-Scheel-Straße 5, 74372 Sersheim Germany Email: hello@donutjobs.work 2.2. For inquiries related to data protection in the Philippines, contact our designated privacy contact at hello@donutjobs.work with the subject line "DPA Rights Request."
3. Personal Data We Collect
3.1. Data Provided by You (a) Account registration data: name, email address, password (hashed); (b) Profile data: professional title, work history, skills, education, location, language proficiency, profile photo; (c) Job listing data (Employers): company name, job descriptions, requirements, compensation information; (d) Application data (Jobseekers): resumes, cover letters, assessment results (including typing speed and English proficiency scores); (e) Communications: messages sent through the Platform, support inquiries; (f) Payment data: billing name, billing address, and payment method details (processed and stored by Stripe, Inc.; DonutJobs does not store full payment card numbers). 3.2. Data Collected Automatically (a) Technical data: IP address, browser type and version, operating system, device identifiers; (b) Usage data: pages viewed, features used, search queries, click patterns, session duration; (c) Log data: access times, referring URLs, error logs; (d) Cookie and tracking data: see Section 11 (Cookie Policy). 3.3. Data from Third Parties (a) Payment verification data from Stripe; (b) Authentication data from third-party login providers (e.g., Google OAuth), if applicable. 3.4. We do not intentionally collect personal data from individuals under the age of 18. If we become aware that we have collected such data, we will delete it promptly. 3.5. Sensitive Personal Information. We do not intentionally collect sensitive personal information as defined under applicable data protection laws (including, for Philippine Users, "sensitive personal information" as defined in Section 3(l) of the Data Privacy Act of 2012). Users are advised not to submit sensitive personal information (such as government-issued identification numbers, religious beliefs, health information, or ethnic origin) in free-text profile fields. If sensitive personal information is submitted voluntarily, processing will be limited to the purposes described in this Policy and will be handled with appropriate safeguards.
4. Legal Bases For Processing
4.1. We process personal data on the following legal bases, as applicable under the laws of your jurisdiction: (a) Contractual necessity: Processing necessary to perform our contract with you (i.e., providing the Platform and Services, including the creation and public display of Jobseeker Profiles and their inclusion in the Talent Pool as described in Sections 2.6 and 2.7 of the Terms of Service); (b) Legitimate interests: Processing necessary for our legitimate business interests, including platform security, fraud prevention, analytics, product improvement, and direct marketing to existing customers, provided such interests are not overridden by your data protection rights; (c) Consent: Where required by applicable law, we process data based on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time by contacting hello@donutjobs.work, without affecting the lawfulness of processing based on consent before its withdrawal; (d) Legal obligation: Processing necessary to comply with applicable legal requirements. 4.2. For Users in the Philippines, processing is conducted in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. The specific legal bases, data subject rights, and compliance commitments applicable to Philippine Users are set forth in Section 9 of the Terms of Service and Section 9 of this Policy. 4.3. For Users in the EEA or United Kingdom, processing is conducted in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR, as applicable.
5. Purposes Of Processing
5.1. We use personal data for the following purposes: (a) Account creation, authentication, and management; (b) Providing, operating, and maintaining the Platform and Services; (c) Automatic creation and public display of Jobseeker Profiles upon registration (as described in Section 2.6 of the Terms of Service); (d) Operating the Talent Pool: making Jobseeker Profiles and associated public data available to Employers who subscribe to paid plans on the Platform, including through search, filtering, matching, and recommendation features (as described in Section 2.7 of the Terms of Service); (e) Facilitating connections between Employers and Jobseekers, including through curated candidate shortlists, automated matching, and recommended candidate lists; (f) Processing payments and managing subscriptions; (g) Communicating with you regarding your account, support requests, and Platform updates; (h) Sending marketing communications (with your consent where required by law; you may opt out at any time); (i) Conducting analytics to improve the Platform and user experience; (j) Generating anonymized or aggregated data for analytics, benchmarking, marketing materials, and reporting (e.g., aggregate statistics about the Platform's user base); (k) Administering assessments and skills tests; (l) Detecting, preventing, and addressing fraud, abuse, and security threats; (m) Complying with legal obligations and responding to lawful requests; and (n) Enforcing our Terms of Service and other agreements. 5.2. The Talent Pool described in Section 5.1(d) is not a separable or optional feature of the Platform. It is an integral component of the Platform's core functionality, without which the Platform cannot operate its intended purpose of connecting Employers and Jobseekers. DonutJobs charges Employers subscription fees for access to Jobseeker Profiles through the Talent Pool. Jobseekers do not receive compensation for inclusion in the Talent Pool. This commercial arrangement is a fundamental condition of the free Jobseeker account. Because the Talent Pool is core functionality, objection to inclusion in the Talent Pool is functionally equivalent to objection to the Platform's primary purpose and may only be exercised by deleting your account as described in Section 2.7.7 of the Terms of Service.
6. Disclosure Of Personal Data
6.1. Disclosure to Employers Through the Talent Pool (a) Jobseeker Profile data (including name, professional title, skills, work experience, education, location, language proficiency, and assessment scores) is disclosed to Employers who subscribe to paid plans on the Platform through the Talent Pool feature. (b) This disclosure is made through the Platform interface. Employers access Jobseeker Profiles via the Platform's search, filtering, and recommendation tools. DonutJobs does not provide bulk data exports or unrestricted data downloads to Employers. (c) Employers who access Jobseeker data through the Talent Pool are bound by the Terms of Service and are prohibited from: reselling or redistributing Jobseeker data; using Jobseeker data for purposes unrelated to evaluating candidates for employment or engagement opportunities; scraping or systematically extracting Jobseeker data; and compiling Jobseeker data into competing databases or platforms. (d) Once an Employer has viewed or saved a Jobseeker Profile through the Platform, DonutJobs cannot control the Employer's subsequent use or retention of that information outside the Platform, though such use remains subject to the Terms of Service and applicable data protection law. 6.2. Disclosure to Third-Party Service Providers We share personal data with the following categories of third-party service providers, who process data on our behalf under contractual agreements: (a) Cloud infrastructure and database hosting: Supabase, Inc.; (b) Payment processing: Stripe, Inc.; (c) Email and communication services: Resend, Inc.; (d) Product analytics: PostHog, Inc.; (e) Advertising measurement and attribution partners, which receive identifiers and conversion events via on-site pixels and server-side APIs: Meta Platforms, Inc. (Facebook Pixel and Conversions API), Google LLC (Google Ads and Google Analytics 4), TikTok Inc., Reddit, Inc., and X Corp.; (f) Customer support tools: Intercom, Inc. (loaded only for signed-in users); and (g) Security and fraud detection services. 6.3. Legal Disclosures We may disclose personal data if required by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. 6.4. Business Transfers In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to the applicable privacy practices. 6.5. Limitation of Liability for Employer Data Processing. DonutJobs is not liable for any Employer's processing, retention, storage, misuse, disclosure, or onward transfer of Jobseeker data obtained through the Talent Pool or through any other interaction on the Platform. You acknowledge that once an Employer has accessed your Jobseeker Profile, DonutJobs has no control over the Employer's subsequent handling of that data. Your sole remedy for any misuse of your personal data by an Employer is directly against that Employer, not against DonutJobs. Nothing in this Section limits DonutJobs' right to enforce its Terms of Service against Employers, but DonutJobs assumes no obligation to do so on your behalf.
7. California Residents (ccpa/Cpra)
7.1. Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA: identifiers (name, email, IP address); professional or employment-related information (work history, skills, education); internet or electronic network activity (usage data, log data); and commercial information (payment and subscription data). 7.2. Disclosure for Business Purposes. We disclose personal information to the categories of service providers described in Section 6.2 for the business purposes described in Section 5. 7.3. Sale or Sharing of Personal Information. The Talent Pool feature involves making Jobseeker Profile data available to subscribing Employers for monetary consideration (subscription fees). Under the broad definition of "sale" in CCPA Section 1798.140(ad), this disclosure may constitute a "sale" of personal information. California residents have the right to opt out of the sale of their personal information. To exercise this right, California Jobseekers may delete their account (which removes their profile from the Talent Pool) or contact hello@donutjobs.work with the subject line "CCPA Opt-Out Request." In addition, sharing of identifiers and activity data with the advertising partners listed in Section 6.3(e) may constitute "sharing" for cross-context behavioral advertising under the CPRA. You may opt out of such sharing on your browser at any time via the "Do Not Sell or Share My Personal Information" link in the Platform footer. We also honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale and sharing. 7.4. California residents also have the right to: know what personal information is collected and how it is used; request deletion of personal information; request correction of inaccurate personal information; and not be discriminated against for exercising these rights. To exercise these rights, contact hello@donutjobs.work. 7.5. We do not knowingly sell or share the personal information of consumers under the age of 16. 7.6. Acknowledgment of Authorized Processing. You acknowledge and agree that all processing of your personal data as described in this Policy and the Terms of Service, including the creation of your Jobseeker Profile, the inclusion of your data in the Talent Pool, the disclosure of your Public Data to Employers, and the use of your data for analytics and benchmarking, constitutes authorized processing to which you have given informed consent. You waive any claim for damages under any applicable data protection law (including, without limitation, Section 16(f) of the Philippine Data Privacy Act and Article 82 of the GDPR) arising from authorized processing as described in this Policy. This waiver does not apply to processing that exceeds the scope described in this Policy or to unauthorized access to Private Data resulting from a security breach. 7.7. You acknowledge that Public Data is, by definition, publicly accessible and that unauthorized third-party access to data that is already publicly available on the Platform does not constitute additional exposure or harm. You waive any claim against DonutJobs arising from third-party access to, copying of, or use of data that was publicly available on the Platform at the time of such access.
8. Cross-Border Data Transfers
8.1. DonutJobs is based in the United States. Personal data collected through the Platform is processed and stored in the United States using infrastructure provided by Supabase, Inc. and other US-based service providers. 8.2. If you are located outside the United States (including in the Philippines, the EEA, or the United Kingdom), your personal data will be transferred to and processed in the United States. The United States may not provide the same level of data protection as your jurisdiction of residence. 8.3. For transfers of personal data from the EEA or United Kingdom to the United States, we rely on the transfer mechanisms provided by our service providers, which may include: (a) Standard Contractual Clauses ("SCCs") approved by the European Commission (Commission Implementing Decision (EU) 2021/914), or the UK International Data Transfer Addendum, as incorporated into the data processing agreements of our service providers (including Stripe and Supabase); (b) Any applicable adequacy decision, including the EU-U.S. Data Privacy Framework where the receiving party is a certified participant; or (c) Your explicit consent, where no other transfer mechanism is available. 8.4. For transfers of personal data from the Philippines, processing is conducted in compliance with the requirements of the Data Privacy Act of 2012 and the guidelines of the National Privacy Commission regarding cross-border data transfers. 8.5. You may request information about the applicable transfer safeguards by contacting hello@donutjobs.work.
9. Philippine Data Subjects
9.1. This Section provides additional information for Users who are data subjects under the Data Privacy Act of 2012 (Republic Act No. 10173) ("DPA"). 9.2. DonutJobs acts as a personal information controller with respect to personal data of Philippine data subjects collected and processed through the Platform. The legal bases for processing are: (a) the consent of the data subject, obtained at registration and through acceptance of the Terms of Service; (b) the necessity of processing for the performance of a contract to which the data subject is a party; and (c) the legitimate interests of DonutJobs in operating the Platform and the Talent Pool, provided such interests are not overridden by the fundamental rights and freedoms of the data subject. 9.3. Philippine data subjects have the following rights under the DPA: (a) Right to be Informed: You have the right to be informed of the collection and processing of your personal data, including the purposes, scope, and method of processing, which are described in this Policy and the Terms of Service; (b) Right to Access: You have the right to request access to your personal data held by DonutJobs, including the manner in which it was processed and the recipients to whom it has been disclosed (including Employers who have accessed your profile through the Talent Pool); (c) Right to Object: You have the right to object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling. If you object to inclusion in the Talent Pool, you may exercise this right by deleting your account as described in Section 2.7.7 of the Terms of Service; (d) Right to Erasure or Blocking: You have the right to request the erasure, blocking, or destruction of your personal data if it is incomplete, outdated, false, or unlawfully obtained, or if it is no longer necessary for the purposes for which it was collected; (e) Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data. You may update your Jobseeker Profile at any time through your account settings; (f) Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible; (g) Right to Damages: You have the right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data, as provided under the DPA; and (h) Right to File a Complaint: You have the right to file a complaint with the National Privacy Commission ("NPC") if you believe your rights under the DPA have been violated. 9.4. To exercise any of the above rights, contact hello@donutjobs.work with the subject line "DPA Rights Request." DonutJobs will respond to valid requests within thirty (30) days, or such shorter period as required by the DPA or NPC issuances. 9.5. DonutJobs acknowledges the authority of the NPC with respect to the processing of personal data of Philippine data subjects, regardless of DonutJobs' place of incorporation. 9.6. In the event of a personal data breach affecting Philippine data subjects, DonutJobs will notify the NPC and affected data subjects within the timeframes and in the manner prescribed by the DPA and NPC Circular 16-03 (or any successor issuance).
10. Data Retention
10.1. We retain personal data for as long as necessary to fulfill the purposes described in this Policy, subject to the following specific retention periods: (a) Active accounts: Personal data is retained for the duration of your active account. (b) Account deletion by Jobseekers: Upon account deletion: (i) the Jobseeker Profile will be removed from public visibility and the active Talent Pool within thirty (30) days; (ii) personal data will be deleted or irreversibly anonymized within ninety (90) days, except as otherwise required by law or as described in this Section; (iii) communications between the Jobseeker and Employers will be retained for a period of twelve (12) months following account deletion for the purpose of supporting ongoing hiring processes and resolving potential disputes, after which they will be deleted or anonymized; and (iv) anonymized or aggregated data that can no longer be attributed to the individual may be retained indefinitely. You expressly consent to irreversible anonymization as a valid and complete fulfillment of any erasure, deletion, or "right to be forgotten" request under any applicable data protection law, including the Philippine Data Privacy Act and the GDPR. Once data has been irreversibly anonymized such that it can no longer be attributed to you, DonutJobs has fully discharged its obligation to erase your personal data. (c) Account deletion by Employers: Upon account deletion: (i) active job listings will be deactivated immediately; (ii) personal data will be deleted or anonymized within ninety (90) days, except as otherwise required by law; and (iii) communications with Jobseekers will be retained as described in Section 10.1(b)(iii). (d) Inactive accounts: If your account has had no activity for twenty-four (24) months, we will notify you at the email address associated with your account. If the account is not reactivated within thirty (30) days of notification, we will securely delete or anonymize your personal data, subject to any legal retention obligations. 10.2. DonutJobs may retain personal data beyond the periods specified in this Section where required by applicable law, court order, or regulatory directive, or where retention is necessary for the establishment, exercise, or defense of legal claims. 10.3. After the applicable retention period, personal data will be securely deleted or anonymized using industry-standard methods. Anonymized data that can no longer be associated with an individual may be retained indefinitely for analytical and benchmarking purposes. 10.4. You may request information about the specific retention periods applicable to your data by contacting hello@donutjobs.work.
11. Cookies And Tracking Technologies
11.1. We use cookies and similar tracking technologies to operate the Platform, analyze usage, and improve the user experience. 11.2. Categories of cookies we use: (a) Strictly Necessary Cookies: Required for the Platform to function (e.g., session management, authentication). These cannot be disabled. (b) Analytics and Advertising Cookies: Used to understand how Users interact with the Platform and to measure advertising. We use PostHog for product analytics, and advertising pixels from Meta, Google, TikTok, Reddit, and X (see Section 6.3(e)). Representative cookies include ph_* (PostHog), dj_attr (first-party campaign attribution), _ga, _ga_*, _gcl_* (Google), _fbp (Meta), _ttp (TikTok), _rdt_uuid (Reddit), and X advertising identifiers. (c) Functional Cookies: Used to remember your preferences and settings. 11.3. You may manage cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality. 11.4. Where required by applicable law (e.g., the ePrivacy Directive in the EEA and equivalent rules in the United Kingdom and Switzerland), a cookie consent banner is presented on your first visit, and non-essential cookies and tracking technologies are not set unless you accept. You may accept or reject non-essential cookies with equal ease; your choice is stored in a strictly necessary cookie (dj_consent) for twelve (12) months. 11.5. The Platform does not respond to "Do Not Track" browser signals, but it does honor the Global Privacy Control (GPC) signal as an opt-out of the sale or sharing of personal information and of non-essential tracking. You may also manage tracking via the "Do Not Sell or Share My Personal Information" link in the Platform footer and through your browser settings.
12. Your Rights (general)
12.1. Depending on your jurisdiction, you may have the following rights regarding your personal data: (a) Right of Access: Request a copy of the personal data we hold about you; (b) Right to Rectification: Request correction of inaccurate or incomplete data; (c) Right to Erasure: Request deletion of your personal data, subject to legal retention obligations; (d) Right to Restrict Processing: Request that we limit how we use your data; (e) Right to Data Portability: Request a machine-readable copy of your data; (f) Right to Object: Object to processing based on legitimate interests or for direct marketing; (g) Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time; (h) Right to Lodge a Complaint: File a complaint with a supervisory authority in your jurisdiction. 12.2. To exercise any of these rights, contact us at hello@donutjobs.work. For Users located in the Philippines, DonutJobs will respond within thirty (30) days as required by the DPA. For Users located in the EEA or United Kingdom, DonutJobs will respond within one (1) month as required by the GDPR, extendable by an additional two (2) months for complex requests with notice to you. For all other Users, DonutJobs will respond within forty-five (45) days, extendable by an additional thirty (30) days for complex requests with notice to you. 12.3. We may verify your identity before processing a request. We will not discriminate against you for exercising your data protection rights. 12.4. Please note that personal data you have shared with other Users through the Platform (such as applications submitted to Employers, messages exchanged, or assessment results delivered) may be retained by those Users independently of your DonutJobs account. Deletion of your account removes your profile and data from DonutJobs' systems, but DonutJobs cannot compel other Users to delete data they have independently received. For data held by Employers, please contact the relevant Employer directly. 12.5. Limitations on Rights Regarding Public Data. You acknowledge that the exercise of certain data protection rights (including the right to erasure, the right to restrict processing, and the right to object) with respect to Public Data is inherently limited by the public nature of the Platform. Specifically: (a) DonutJobs will delete or anonymize your Public Data from its own systems upon a valid deletion request, but cannot guarantee deletion from third-party systems, search engine caches, web archives, or any other systems outside DonutJobs' control; (b) Restricting processing of Public Data is functionally equivalent to removing your public profile, as the Platform cannot display a profile while restricting its processing; (c) Objecting to the processing of Public Data may require deactivation or deletion of your account, as public visibility is integral to the Platform's functionality; and (d) DonutJobs shall have no liability for the continued availability of Public Data on systems outside its control after processing a deletion or restriction request. 12.6. Exhaustion of Internal Remedies. Before filing any complaint with a data protection supervisory authority, regulatory body, or governmental agency regarding DonutJobs' processing of your personal data, you agree to first submit your complaint to DonutJobs at hello@donutjobs.work with the subject line "Data Protection Complaint" and allow DonutJobs thirty (30) days to investigate and respond. This requirement does not limit your statutory right to file complaints with regulatory authorities where such right cannot be waived under Mandatory Local Law, but you acknowledge that failure to exhaust this internal remedy may be relevant to the evaluation of your complaint by any regulatory authority. 12.7. Frivolous or Excessive Requests. Where permitted by applicable law (including GDPR Article 12(5) and equivalent provisions under the Philippine DPA), DonutJobs reserves the right to charge a reasonable administrative fee or refuse to act on data subject access requests that are manifestly unfounded, repetitive, or excessive. In determining whether a request is manifestly unfounded or excessive, DonutJobs will consider the frequency of requests, whether the request appears designed to cause disruption, and whether the requested information has already been provided. DonutJobs will notify you of any determination that a request is manifestly unfounded or excessive and will provide an explanation of the basis for that determination.
13. Data Security
13.1. We implement reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to: (a) Encryption of data in transit (TLS/SSL) and at rest; (b) Access controls and authentication requirements; (c) Regular security assessments; (d) Incident response procedures. 13.2. No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
14. Data Breach Notification
14.1. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, DonutJobs will: (a) Notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach, where required by applicable law (including the GDPR, the Philippine Data Privacy Act, and NPC Circular 16-03); (b) Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and (c) Document the breach, its effects, and the remedial actions taken. 14.2. For the avoidance of doubt, the following events do not constitute a notifiable data breach: (a) unauthorized access to, copying of, or scraping of data that was publicly available on the Platform at the time of access (Public Data), as such data was already accessible to any person with internet access and no additional exposure has occurred; (b) access to Jobseeker Profile data by Employers through the Talent Pool in accordance with their subscription, even if such Employers subsequently process the data in violation of the Terms of Service (in which case your remedy is against the Employer under applicable law); and (c) access to anonymized or aggregated data that cannot be attributed to any individual.
15. Automated Decision-Making And Profiling
15.1. The Platform may use automated processing, including assessment scoring, candidate filtering, and matching algorithms, to facilitate the hiring process. Such automated processing assists Employers in organizing and reviewing candidates but does not, on its own, produce legally binding decisions. 15.2. Hiring decisions are made solely by Employers, not by DonutJobs or its automated systems. 15.3. Where required by applicable law (e.g., GDPR Article 22), you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. To exercise this right, contact hello@donutjobs.work.
16. Data Processing Agreements
16.1. DonutJobs maintains data processing agreements with its third-party service providers (Section 6.2) that include obligations regarding data security, confidentiality, and compliance with applicable data protection law. 16.2. Where an Employer accesses Jobseeker personal data through the Talent Pool, the Employer acts as an independent data controller with respect to any Jobseeker data it subsequently processes outside the Platform. DonutJobs is not responsible for the Employer's processing of Jobseeker data after it has been accessed through the Platform, though Employers remain bound by the Terms of Service and applicable data protection law. 16.3. DonutJobs may require Employers to enter into a Data Processing Agreement ("DPA") that specifies the Employer's obligations regarding Jobseeker data obtained through the Platform, including restrictions on use, retention, and onward transfer. Where such a DPA is required, it will comply with applicable data protection law, including GDPR Article 28 and the Philippine DPA.
17. Eea And United Kingdom Residents
17.1. Residents of the EEA and United Kingdom may exercise all rights set forth in Section 12, and may lodge a complaint with their local data protection supervisory authority. 17.2. For EEA Users, the lead supervisory authority shall be determined based on the User's country of residence. For UK Users, the relevant authority is the Information Commissioner's Office (ICO). 17.3. For information about cross-border data transfers and applicable safeguards, see Section 8.
18. Changes To This Policy
18.1. We may update this Privacy Policy from time to time. Material changes will be communicated by posting an updated Policy on the Platform with a revised "Effective Date" and, where practicable, by email notification at least fourteen (14) days before the changes take effect. 18.2. Material changes to the Talent Pool data processing practices (Section 5.1(d) and Section 6.1), the Philippine data subject provisions (Section 9), or the data retention periods (Section 10) will require affirmative consent from affected Users where required by applicable law. 18.3. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy. Where applicable law requires affirmative consent for material changes, we will seek such consent before the changes take effect. 18.4. Limitation of Liability for Data Processing. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, DONUTJOBS' TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING FROM OR RELATED TO THE PROCESSING OF YOUR PERSONAL DATA, WHETHER UNDER CONTRACT, TORT, DATA PROTECTION LAW, OR ANY OTHER LEGAL THEORY, SHALL NOT EXCEED THE LIABILITY CAPS SET FORTH IN SECTION 13.2 OF THE TERMS OF SERVICE. FOR USERS WHO HAVE NOT PAID ANY FEES TO DONUTJOBS, THIS MEANS TOTAL LIABILITY SHALL NOT EXCEED TEN UNITED STATES DOLLARS (USD $10.00). THIS LIMITATION DOES NOT APPLY WHERE PROHIBITED BY MANDATORY LOCAL LAW.
19. Severability And Independent Enforceability
19.1. If any provision of this Policy, including any limitation of liability, consent provision, waiver, or disclaimer, is found by a court, arbitrator, or regulatory authority to be invalid, illegal, or unenforceable, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, shall be severed. 19.2. Each limitation of liability, consent provision, waiver, disclaimer, and protective clause in this Policy is intended to be independently enforceable. The invalidity or unenforceability of any single provision shall not affect the validity or enforceability of any other provision.
20. Contact Information
For questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, contact us at: Insight Agency UG Email: hello@donutjobs.work Address: Mildred-Scheel-Straße 5, 74372 Sersheim, Germany For Philippine data privacy inquiries: hello@donutjobs.work (subject line: "DPA Rights Request") For CCPA/CPRA requests: hello@donutjobs.work (subject line: "CCPA Request")