Terms of Service

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement, order form, or master services agreement between Mosh JD, Inc. (“Processor”) and Customer (“Controller”) (collectively, the “Parties”).

Definitions

1.1 Capitalized terms not defined in this DPA shall have the meanings set forth in the MSA.

1.2 The following definitions apply to this DPA:

1.3 “Applicable Data Protection Law” means all laws and regulations applicable to the processing of Personal Data under this DPA, including (where applicable): (i) the General Data Protection Regulation (EU) 2016/679 (” GDPR “); (ii) the UK GDPR and Data Protection Act 2018; (iii) the California Consumer Privacy Act as amended by the California Privacy Rights Act (” CCPA “); and (iv) any other applicable state, federal, or international data protection or privacy laws.

1.4 “Controller” means the entity that determines the purposes and means of the processing of Personal Data.

1.5 “Data Subject” means an identified or identifiable natural person about whom Personal Data relates.

1.6 “Personal Data” means any information relating to an identified or identifiable natural person that is included within Customer Data and is protected under Applicable Data Protection Law. For purposes of this DPA, Personal Data includes job description content which may include user names or email addresses contained in job description collaboration history or user-generated content, but the platform is not intended to process individual-level employee or candidate personal data

1.7 “Processing” (and its derivatives such as “process” and “processed”) means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

1.8 “Processor” means the entity that processes Personal Data on behalf of the Controller.

1.9 “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

1.10 “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission pursuant to Decision 2021/914, as may be updated or replaced.

1.11 “Sub-processor” means any Processor engaged by Mosh JD to process Personal Data on behalf of Customer.

Scopes and Roles

2.1 Applicability: This DPA governs the processing of Personal Data by Processor on behalf of Customer in connection with Processor’s delivery of the Services.

2.2 Roles of the Parties: Customer acts as the Controller. Mosh JD acts as the Processor and will process Personal Data solely on behalf of Customer and in accordance with documented instructions.

2.3 Customer Instructions: Customer instructs Mosh JD to process Personal Data: (i) to provide the Services in accordance with the MSA and applicable Order Forms; (ii) as further specified through Customer’s use of the Services and functionality thereof; and (iii) as otherwise documented in written instructions provided by Customer that are acknowledged and agreed to by Mosh JD. Mosh JD will immediately inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

2.4 Nature and Purpose of Processing: Storage, retrieval, organization, structuring, display, analysis, collaboration management, version control, and deletion of job description content and user account information.

(a) Purpose of Processing: To provide the job description management platform and related Services as described in the MSA and Order Forms, enabling Customer’s HR administrators and collaborators to create, manage, collaborate on, and maintain accurate job descriptions for organizational workforce planning.

(b) Duration of Processing: For the Term of the MSA and any applicable Transition Services period, plus the retention period specified in Section 9 below.

(c) Key Limitation: Processor does not use Personal Data for independent purposes. The Services are designed exclusively to manage job-level information (position titles, requirements, responsibilities, qualifications). The Services do not process, store, or manage individual employee data, candidate information, applicant tracking data, or any other individual-level personal data beyond the user account information necessary to operate the platform.

2.5 Types of Personal Data: Personal Data processed under this DPA is limited to user account and system access information, including:

(a) Names of authorized users (HR administrators, managers, and business leaders with platform access)

(b) Business email addresses of authorized users

(c) User authentication credentials (user names and encrypted passwords)

(d) User activity logs (login times, IP addresses, browser types, actions taken within the platform)

Collaborators who interact with the Services on a limited basis (e.g., via single job-edit screens without full platform accounts) may have their name and business email address processed for collaboration and notification purposes only.

The Services do not process, collect, or store:

(a) Individual employee personal information beyond platform user accounts

(b) Job candidate or applicant data

(c) Resumes, CVs, or application materials

(d) Performance reviews or employee evaluations

(e) Compensation or salary information for specific individuals

(f) Social Security numbers, dates of birth, home addresses, or other personal identifiers (PII)

(g) Background check results or screening information

(h) Any personal data beyond what is necessary for user account management and job description collaboration

2.6 Categories of Data Subjects.

Data Subjects are limited to:

(a) Customer’s HR administrators with full platform access

(b) Authorized users (including managers, business unit leaders, individual contributors, and other employees) designated by Customer to manage, update, and write job description content

(c) Collaborators invited to provide input, feedback, or updates to specific jobs or sets of jobs, who have limited platform access

(d) Typically, Customer organizations have 2-15 authorized users with platform accounts. Collaboration on job descriptions may occur outside the core system, though Customer may choose to grant platform access to employees at any level as needed for job description management.

Data Subjects do NOT include:

(a) Job candidates or applicants

(b) General employee populations (except to the extent employees are granted platform access or invited as collaborators)

(c) Contractors, consultants, or third parties whose information might be referenced in job descriptions

(d) Any individuals whose data relates to employment, recruitment, or staffing activities beyond platform user access and job description collaboration

Mosh JD’s Obligations As Processor

3.1 Compliance with Instructions.  Mosh JD shall process Personal Data only in accordance with Customer’s documented instructions as set forth in this DPA and the MSA, unless required to process Personal Data by applicable law, in which case Mosh JD shall inform Customer of that legal requirement before processing (unless prohibited by law from doing so).

3.2 Confidentiality.  Mosh JD shall ensure that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security Measures.  Mosh JD shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against Security Incidents and to preserve the security and confidentiality of Personal Data, as further described in Annex A (Security Measures) attached hereto.

3.4 Sub-processors.

(a) General Authorization. Customer provides general authorization for Mosh JD to engage Sub-processors to process Personal Data, provided that Mosh JD complies with this Section 3.4.

(b) Current Sub-processors.  Processor will maintain an up-to-date list of its current subprocessors. The list will be made available to Customer upon request or through a publicly accessible location designated by Processor.

(c ) Updates. Processor will use commercially reasonable efforts to keep the subprocessor list current. Customer is responsible for reviewing the list for updates.

(d) Flow-Down Obligations. Processor will ensure that any subprocessor it engages is bound by written obligations that are no less protective of Personal Data than those set out in this DPA.

3.5 Data Subject Rights Assistance. Taking into account the nature of the processing, Mosh JD shall provide reasonable assistance to Customer (at Customer’s expense) to enable Customer to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, data portability, restriction of processing, and objection. If Mosh JD receives a request directly from a Data Subject, Mosh JD will promptly redirect the Data Subject to Customer and will not respond to such request without Customer’s prior written authorization.

3.6 Assistance with Compliance.  Mosh JD shall provide reasonable assistance to Customer (at Customer’s expense) in ensuring compliance with Customer’s obligations under Applicable Data Protection Law, including with respect to security of processing, data protection impact assessments, and prior consultations with supervisory authorities.

3.7 Security Incident Notification.   Mosh JD shall notify Customer without undue delay after becoming aware of any Security Incident affecting Customer’s Personal Data. Such notification shall, to the extent possible, include:

(a) Description of the nature of the Security Incident;

(b) Categories and approximate number of Data Subjects affected;

(c) Categories and approximate number of Personal Data records affected;

(d) Likely consequences of the Security Incident;

(e) Measures taken or proposed to address the Security Incident; and

(f) Contact point for further information.

Notification shall be provided to Customer’s designated security contact via email at the address provided in the Order Form or, if none, to the primary contact listed in Customer’s account. Mosh JD’s notification of or response to a Security Incident under this Section shall not be construed as an acknowledgment of fault or liability.

3.8 Deletion.  Upon termination of the Services, Processor will delete all Personal Data from its systems within a commercially reasonable period, unless applicable law requires retention. Processor does not provide data return or extraction services beyond the self-service export features available within the Services.

3.9 Audit Rights.

(a) Upon Customer’s written request, and no more than once per calendar year per Customer (unless required more frequently by Applicable Data Protection Law or following a Security Incident), Mosh JD shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA.

(b) Mosh JD may satisfy its obligations under Section 3.9(a) by providing any of the following:

(i) Written responses to Customer’s reasonable information security questionnaire;

(ii) Documentation of Mosh JD’s security policies, procedures, and controls;

(iii) Summaries of internal security assessments or third-party penetration test results (subject to redaction of sensitive security details); or

(iv) Other documentation reasonably demonstrating compliance with the security measures described in Annex A.

(c) The parties agree that all audits will be conducted remotely. Customer shall not have the right to perform (and Mosh JD shall not be required to permit) any on-site inspections of Mosh JD’s facilities, systems, or infrastructure.

(d) Customer shall treat all information obtained under this Section as Mosh JD’s Confidential Information under the MSA.

Customer’s Obligations As Controller

4.1 Compliance with Applicable Data Protection Law.  Customer represents and warrants that:

(a) It has complied and will continue to comply with all Applicable Data Protection Law in its use of the Services and provision of instructions to Mosh JD;

(b) It has provided and will continue to provide all required notices and obtained all necessary consents and rights necessary for Mosh JD to process Personal Data as contemplated by this DPA and the MSA;

(c) Its instructions to Mosh JD regarding the processing of Personal Data comply with Applicable Data Protection Law; and

(d) It has the lawful right to transfer, or provide access to, the Personal Data to Mosh JD for processing in accordance with this DPA.

4.2 Prohibited Data.   Customer shall not submit to the Services (and shall ensure its users do not submit) any of the following categories of Personal Data:

(a) Individual employee or candidate information, including but not limited to: resumes, CVs, application materials, individual performance data, individual compensation information, or any personal data relating to specific employees, candidates, or applicants

(b) Special categories of data as defined in GDPR Article 9(1) (e.g., racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation)

(c) Personal Data relating to criminal convictions and offenses

(d) Social Security numbers, passport numbers, driver’s license numbers, tax identification numbers, or similar government-issued identifiers

(e) Financial account information, credit or debit card numbers, or other payment card data

(f) Protected health information subject to HIPAA

(g) Personal Data of children under the age of 16

(h) Any other Personal Data beyond user account information necessary to operate the Services

The Services are designed exclusively for managing job-level information (position descriptions, requirements, and responsibilities).  Customer acknowledges and agrees that the Services are not intended for, and must not be used for, applicant tracking, employee record management, or any other purpose that would involve processing individual-level personal data beyond platform user accounts.

If Customer submits Prohibited Data to the Services in violation of this Section, Customer shall be solely responsible for any resulting violations of Applicable Data Protection Law, and shall indemnify, defend, and hold harmless Mosh JD from any claims, damages, penalties, or liabilities arising therefrom.

International Data Transfers

5.1 Data Storage Location.  Personal Data is stored on servers located in the United States and hosted by Amazon Web Services (AWS) in AWS data centers within the United States.

5.2 Transfers from the EEA, UK, or Switzerland.

(a) If Customer is established in the European Economic Area (EEA), United Kingdom, or Switzerland, or if Customer otherwise transfers Personal Data from these jurisdictions to Mosh JD, the parties acknowledge that such transfer constitutes a transfer of Personal Data to a third country.

(b) To the extent such transfers are subject to GDPR Chapter V or equivalent provisions under UK or Swiss data protection law, the parties agree that the transfer mechanism shall be the Standard Contractual Clauses, incorporated herein as Annex C, which shall apply as follows:

(i) Module Two (Controller to Processor) applies;

(ii) The optional docking clause in Clause 7 applies;

(iii) Under Clause 9, Option 2 (general written authorization) applies, and the time period for prior notice of Sub-processor changes is thirty (30) days;

(iv) Under Clause 11, the optional language does not apply;

(v) Under Clause 17, the parties select Option 1 (governing law of an EU Member State), and choose the law of Ireland;

(vi) Under Clause 18, the parties choose the courts of Ireland;

(vii) Annex I to the SCCs is set forth in Annex C-1 to this DPA;

(viii) Annex II to the SCCs is set forth in Annex A to this DPA (Security Measures).

(c) For transfers subject to UK data protection law, the UK Addendum to the SCCs (as issued by the UK Information Commissioner’s Office) applies and is incorporated by reference. The parties agree to execute any additional documentation reasonably required to give effect to the UK Addendum.

(d) For transfers subject to Swiss data protection law, the SCCs apply with the modifications required under Swiss law, including that references to “GDPR” shall be interpreted as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner.

5.3 Alternative Transfer Mechanisms.   If the Standard Contractual Clauses are invalidated, revoked, or otherwise rendered ineffective, the parties agree to cooperate in good faith to establish an alternative lawful data transfer mechanism (such as an adequacy decision, Binding Corporate Rules, or other mechanism recognized under Applicable Data Protection Law).

Liability and Indemnification

6.1 Allocation of Liability.  Each party’s liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set forth in the MSA.

6.2 Customer Indemnification.  Customer shall indemnify, defend, and hold harmless Mosh JD from and against any and all claims, actions, losses, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising from or relating to:

(a) Customer’s failure to comply with its obligations under this DPA;

(b) Customer’s submission of Prohibited Data to the Services;

(c) Customer’s violation of Applicable Data Protection Law; or

(d) Customer’s instructions to Mosh JD that violate Applicable Data Protection Law.

Term and Termination

7.1 Term. This DPA shall commence on the Effective Date of the MSA and shall remain in effect until the expiration or termination of the MSA and completion of all data deletion obligations under Section 3.8.

7.2 Survival.  The provisions of this DPA that by their nature should survive termination or expiration shall survive, including Sections 3.8 (Deletion), 6 (Liability and Indemnification), and 8 (General Provisions).

General Provisions

8.1 Order of Precedence.  In the event of any conflict or inconsistency between this DPA and the MSA with respect to the processing of Personal Data, the terms of this DPA shall prevail.

8.2 Amendments.  Mosh JD may update this DPA from time to time to reflect changes in Applicable Data Protection Law, regulatory guidance, or Mosh JD’s data processing practices. Mosh JD will provide Customer with at least thirty (30) days’ notice of any material changes. Customer’s continued use of the Services after such notice period constitutes acceptance of the updated DPA. If Customer does not agree to the updated DPA, Customer may terminate the MSA in accordance with its terms.

8.3 Severability.  If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid or unenforceable provision shall be replaced with a valid and enforceable provision that achieves the original intent to the greatest extent possible.

8.4 Entire Agreement.  This DPA, together with the MSA and all exhibits and annexes hereto, constitutes the entire agreement between the parties regarding the processing of Personal Data.

8.5 Governing Law.  This DPA shall be governed by the same governing law provisions as set forth in the MSA, except where the Standard Contractual Clauses or other applicable data transfer mechanisms specify otherwise.

8.6 Questions and Contact Information. If you have questions about this DPA or Mosh JD’s data processing practices, please contact us at:

Mosh JD, Inc.

Attn: Legal & Privacy Services  

41 Romano Vineyard Way, Unit 6182  

North Kingston, Rhode Island 02852  

Email: info@moshjd.com

Annex

The Following Annex’s should be read in conjunction:

1. Annex A: Security Measures
2. Annex B: Sub-Processors 
3. Annex C: Standard Contractual Clauses (SCCs)

DPA Annex A: Security Measures

Mosh JD has implemented and maintains the following technical and organizational security measures to protect Personal Data:

1. Access Control

1.1 Physical Access Control

(a) Data centers are operated by AWS in secure facilities with 24/7 surveillance, biometric access controls, and security personnel

(b) Physical access to data centers is restricted to authorized AWS personnel only

(c) Visitor access requires prior authorization, identification verification, and escort

1.2 Logical Access Control

(a) Unique user credentials (username and password) required for access to the Services

(b) Role-based access controls limit user permissions

1.3 Internal Access Control

(a) Mosh JD employee access to production systems is restricted on a need-to-know basis

(b) All administrative access is logged and monitored

(c) Confidentiality obligations imposed on all employees and contractors

2. Transmission Control

2.1 Encryption in Transit

(a) All data transmitted between Customer’s browser and Mosh JD systems is encrypted using TLS 1.2 or higher

2.2 Encryption at Rest

(a) Personal Data stored in databases is encrypted at rest using AES-256 encryption

(b) Encryption keys are managed using AWS Key Management Service (KMS)

(c) Backups are encrypted using the same or stronger encryption standards

3. Storage and Availability Control

3.1 Data Storage

(a) Personal Data is stored in AWS data centers located in the United States

(b) Automated backup procedures ensure data redundancy

(c) Backup data is encrypted and stored in geographically separate locations

3.2 Availability and Disaster Recovery

(a) Infrastructure is designed for high availability 

(b) Disaster recovery plan in place  

4. Separation Control

4.1 Data Segregation

(a) Customer data is logically separated using unique identifiers

(b) Multi-tenant architecture ensures Customer data cannot be accessed by other customers

(c) Database-level controls prevent unauthorized cross-customer data access

(d) Test and development environments are isolated from production environments

5. Integrity Control

5.1 Data Integrity

(a) Transaction logging enables tracking of data modifications

(b) Version control for job description documents

(c) Audit logs record all significant system events and data access

6. Incident Response

6.1 Security Monitoring

(a) Continuous monitoring of systems for security threats and anomalies

(b) Intrusion detection and prevention systems deployed

(c) Automated alerts for suspicious activities

6.2 Incident Management

(a) Documented incident response procedures

(b) Security incident response team designated

(c) Procedures for notification to affected parties as required by law

(d) Post-incident analysis and remediation procedures

7. Vendor Management

7.1 Sub-processor Security

(a) All Sub-processors are required to implement security measures at least as protective as those described in this Annex

(b) Contractual requirements for Sub-processors to comply with data protection obligations

8. Personnel Security

8.1 Training and Awareness

(a) Regular security awareness training for all employees

(b) Annual refresher training on data protection and security best practices

9. Compliance and Testing

9.1 Security Assessments

(a) Regular vulnerability scanning and security assessments

(b) Testing of security controls and incident response procedures

(c) Compliance reviews against applicable security frameworks and industry best practices

9.2 Continuous Improvement

(a) Security measures reviewed and updated regularly to address evolving threats

(b) Emerging threats and vulnerabilities actively monitored

(c) Security improvements implemented based on risk assessments and incident learnings

(d) Commitment to pursuing third-party security certifications as the company matures

DPA Annex B: Sub Processors

Mosh JD currently engages the following Sub-processors to process Personal Data on behalf of Customer:

DPA ANNEX C: STANDARD CONTRACTUAL CLAUSES

[The Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, as approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, are incorporated herein by reference. The full text of the Standard Contractual Clauses is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj 

Module Two (Controller to Processor) applies with the specifications set forth in Section 5.2(b) of this DPA.

A. LIST OF PARTIES

Data exporter(s):

Name: Customer (as identified in the Order Form)

Address: As specified in the Order Form

Contact person: As specified in the Order Form

Role: Controller

Data importer(s):

Name: Mosh JD, Inc.

Address: 41 Romano Vineyard Way, Unit 6182, North Kingston, Rhode Island 02852, United States

Contact person: Privacy Officer, support@moshjd.com

Role: Processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects: As described in Section 2.6 of the DPA

Categories of personal data: As described in Section 2.5 of the DPA

Sensitive data:  None (Customer is prohibited from submitting special categories of data per Section 4.2 of the DPA)

Frequency of transfer:  Continuous and real-time as end users access and interact with the platform

Storage location: Personal Data will be stored exclusively in the United States in AWS data centers (see Section 5.1 of the DPA).

Nature of processing: As described in Section 2.4 of the DPA

Purpose of processing: To provide the job description management platform and related Services

Period for which personal data will be retained:  For the duration of the MSA plus any applicable Transition Services period and retention period as specified in Section 3.8 of the DPA.  Retention of system logs: User authentication logs (e.g., IP address, login time) may be retained for up to 12 months for security and fraud-prevention purposes.

Sub-processors: As listed in Annex B to the DPA

C. COMPETENT SUPERVISORY AUTHORITY

For data exporters established in the EU: The supervisory authority of the EU Member State in which the data exporter is established.

For data exporters established in the UK: The UK Information Commissioner’s Office (ICO).

For data exporters established in Switzerland: The Swiss Federal Data Protection and Information Commissioner (FDPIC).