Data Processing Addendum
Version 1.1 · Effective 20 October 2026
The “In short” lines are plain-language summaries for convenience only; the numbered clauses are the binding text.
1. General
In short: This is the binding contract for how we process applicant data on your company’s behalf. It is part of the Terms, so accepting them accepts this too.
1.1 This Data Processing Addendum (“DPA”) forms part of the Terms and Conditions (the “Terms”) between COFOUNDERIE TECHNOLOGY FZCO, Trade License 41226, Office 301, A2 Building, Dubai Silicon Oasis, Dubai, United Arab Emirates (“Rolio,” “Cofounderie,” “we,” or “us”) and each Customer, and applies whenever Rolio processes personal data on the Customer's behalf in connection with the Services — in particular applicant and candidate data in the Customer's workspace, as described in section 2 of the Privacy Policy.
1.2 For such data, the Customer is the controller and Rolio is the processor within the meaning of the UAE Federal Personal Data Protection Law (“PDPL”), Indonesia’s Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) where it applies, and, where applicable, the General Data Protection Regulation (“GDPR”). This DPA implements the requirements of Art. 8 PDPL, the PDP Law’s obligations for processors, and Art. 28 GDPR.
1.3 In case of conflict between this DPA and the Terms, this DPA prevails with respect to the processing of personal data on the Customer's behalf.
2. Details of the processing
In short: What we process, about whom, for which purposes, and for how long.
2.1 Subject matter and duration: the provision of applicant-tracking and job-board services for the duration of the Customer's account, plus the deletion and backup-cycling period described in section 10.
2.2 Nature and purposes: collection, storage, organization, structuring, retrieval, display, and transmission of recruitment data; AI-assisted extraction of structured information from CV content as described in section 5.3 of the Privacy Policy; export and return of data; support; security; and deletion — in each case to provide the Services and as further documented by the Customer through its use of the product's controls.
2.3 Data subjects: Applicants and candidates, the Customer's authorized users, and referees or other persons identified in submitted recruitment material.
2.4 Categories of personal data: identity and contact information; application-form answers; CVs and other uploaded documents; employment and education history; notes and communications recorded by the Customer's team; and technical data. Sensitive or special-category data is processed only where it is contained in material submitted by or for a data subject; the Customer is responsible for any legal basis such data requires.
2.5 This DPA does not authorize Rolio to use workspace data for its own recruiting business. The one exception is the separately consented talent pool, for which Rolio acts as controller, described in the Talent Pool Privacy Notice. The opt-in checkbox is part of every public application form and is unticked by default. The talent pool is not active yet: an opt-in only records the Applicant’s consent and the wording they saw, and Rolio copies no application data into the pool. Before the pool opens, this section will describe what is copied and when, and the Customer will be notified of that change.
3. Instructions
In short: We only process your data as you instruct us — through these documents and the product’s controls.
3.1 Rolio processes personal data on the Customer's behalf only on the Customer's documented instructions — constituted by the Terms, this DPA, and the Customer's use of the Services' settings and controls — unless processing is required by law, in which case Rolio will inform the Customer of that legal requirement before processing where the law permits.
3.2 Rolio will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.
4. Confidentiality
In short: Only confidentiality-bound personnel touch your data, and only when needed.
4.1 Rolio ensures that persons authorized to process personal data on the Customer's behalf have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access such data only as needed to provide the Services.
5. How we protect your data
In short: We use security measures to protect your data and maintain the overall level of protection.
5.1 Rolio implements and maintains the technical and organizational measures described in this section, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing. Rolio may update these measures provided the overall level of protection is not reduced.
5.2 Our security measures include:
- Encryption: HTTPS protects data in transit, and our infrastructure providers encrypt databases and file storage at rest.
- Account and file protection: passwords are hashed, sessions use authentication cookies, and access to uploaded files is restricted to authorized users.
- Workspace access: database access rules separate company data and restrict access according to team membership and permissions.
- Staff access: authorized personnel access production data only as needed to provide and support Rolio.
- Monitoring: error monitoring and hosting logs help us detect and investigate service problems.
- Service providers: we assess providers’ security measures and require data protection agreements, as described in section 6.
6. Subprocessors
In short: Our vendor list lives in the Privacy Policy. We tell you before changes, and you can object.
6.1 The Customer grants Rolio general written authorization to engage subprocessors for the processing described in this DPA. The current list of subprocessors is set out in section 5.2 of the Privacy Policy.
6.2 Rolio will give the Customer reasonable advance notice of the addition or replacement of a subprocessor, by updating the Privacy Policy and providing notice by email or in-product message. The Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate its account as described in the Terms.
6.3 Rolio imposes data protection obligations on each subprocessor by way of a contract that provides at least the level of protection required by this DPA, and remains responsible to the Customer for the subprocessor's performance.
7. Assistance
In short: We help you answer candidates’ data requests and meet your own data-protection obligations.
7.1 Taking into account the nature of the processing, Rolio assists the Customer through appropriate technical and organizational measures — including available access, export, correction and deletion functions and support assistance — in fulfilling the Customer's obligation to respond to data subjects' requests to exercise their rights. Rolio will forward to the Customer without undue delay any such request it receives that concerns the Customer's data.
7.2 Rolio assists the Customer, to a reasonable extent and taking into account the information available to it, with the Customer's obligations concerning security of processing, personal data breach notifications, data protection impact assessments, and prior consultations with supervisory authorities.
8. Personal data breach
In short: If a breach affects your data, we notify you without undue delay.
8.1 Rolio will notify the Customer without undue delay, and in time for the Customer to meet any statutory deadline such as the PDP Law’s 3 × 24 hours, after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf, and will provide the information reasonably available to it about the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
9. Audits
In short: You can request evidence of how we protect your data and arrange an audit where needed.
9.1 Rolio makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.
9.2 Routine audits normally take place no more than once per twelve-month period with thirty days' notice, subject to confidentiality and reasonable measures to avoid disruption or exposure of other customers' data. These arrangements do not prevent additional or earlier audits where required by law or a supervisory authority, following a personal data breach, or where there are reasonable grounds to suspect material non-compliance. Relevant independent reports may help satisfy a request, but infrastructure-provider reports do not by themselves establish Rolio's compliance. The parties will agree reasonable costs in advance without making statutory audit rights ineffective.
10. Deletion and return
In short: When you leave, your data is deleted or returned to you.
10.1 At the end of the processing services, Rolio will, at the Customer's choice, return or delete personal data processed on its behalf and delete remaining copies, unless applicable law requires retention. Closing a workspace hides it and stops processing; the Customer can request an export through support@getrolio.com, and deletion from the live service is completed within 30 days of the Customer's request. Restricted backup copies are overwritten on Rolio's regular backup cycle. Backups are not used for other purposes; if one is restored for recovery, the deletion is reapplied. Rolio will confirm completion on request.
11. International transfers
In short: Data is stored in the EU (Frankfurt and the Netherlands). Our team accesses it from the UAE under the EU standard contractual clauses; a few US providers are covered by their own clauses.
11.1 Rolio stores personal data in the European Union: database, authentication and uploaded files with Supabase in Frankfurt, Germany, and the application on Firebase App Hosting in the Netherlands. The locations of all processing, including sub-processors in the United States, are described in section 5.5 of the Privacy Policy.
11.2 Rolio’s personnel access personal data from the United Arab Emirates. For personal data of persons in the European Economic Area, the parties agree that the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (transfer controller to processor), are incorporated into this DPA by reference, with the Customer as data exporter and Cofounderie Technology FZCO as data importer. The optional docking clause (Clause 7) does not apply; for Clause 9, Option 2 (general written authorization) applies with the notice period in section 6.2; the optional language in Clause 11 does not apply; for Clause 17, Option 1 applies and the clauses are governed by the law of Ireland; for Clause 18, the courts of Ireland. Annex I is completed by section 2 of this DPA and the Customer’s account details, Annex II by section 5, and the list of sub-processors by section 5.2 of the Privacy Policy. Where this DPA and the clauses conflict, the clauses prevail for the transfer they govern.
11.3 Onward transfers to sub-processors outside the European Economic Area are covered by the transfer mechanisms in those sub-processors’ data processing agreements, as described in section 5.5 of the Privacy Policy. Rolio will provide the Customer with a copy of the applicable safeguards on request.
12. Customer obligations
In short: You promise the data you bring to Rolio was collected lawfully.
12.1 The Customer warrants that: (a) it has collected, and instructs Rolio to process, personal data lawfully; (b) it has provided data subjects with any legally required notices; (c) it has established any legal basis required for the processing it directs, including for sensitive data contained in submitted material; (d) its instructions comply with applicable law; and (e) it will respond to data subjects exercising their rights with respect to data for which it is controller.
13. Liability
In short: The Terms’ liability rules apply here too.
13.1 The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms, to the extent permitted by applicable data protection law.