Terms of Service

Effective Date: 20.01.2026
Version: 1.2

These SaaS Subscription and Terms of Service (“Agreement”) form a legally binding agreement between Jobilla Oy, Business ID 2655898-5, Vuorikatu 16 A 8, 00100 Helsinki, Finland (“Provider”, “Jobilla”, “we”, or “us”) and the customer entity (“Client”, “Customer”, “you”).

This Agreement governs your use of the Jobilla AI Recruiter platform (“Service”) for recruitment marketing and talent acquisition.

This Agreement applies both when:

• a Client subscribes to the Service through a direct B2B contract or sales quote, or
• a Client signs up online through Jobilla’s website.

Both methods create a binding subscription under these unified terms.

The master and authoritative version of the Terms of Service is maintained in the English language and is available on Jobilla’s website. Any translations are provided for convenience only.

1. Purpose and Scope

The Service enables Clients to create, manage, and analyze digital recruitment campaigns using Jobilla’s AI-based platform. The Service is provided as a software-as-a-service (SaaS) solution hosted and maintained by Jobilla. The Client acknowledges that the Service is in an active development phase and that features and functionalities may evolve during the Agreement term.

Jobilla continuously develops the Service and may modify or enhance its features to improve performance, user experience, or compliance.

This Agreement consists of (i) Terms of Service, (ii) DPA. In case of conflict, the signed Order Form / Subscription Agreement prevails over the general Terms; DPA prevails for data protection matters. Commencement Date means the date on which the Initial Term begins.

2. Term and Renewal

If the Parties have entered into a signed Order Form or Subscription Agreement, the term, renewal, and notice provisions in that document will govern and prevail over this Section.

The Agreement becomes effective upon the earlier of:

1. the Client’s signature of a Jobilla quote or order form, or
2. the Client’s online acceptance of these Terms during sign-up.

Unless otherwise agreed in writing, the subscription continues on an ongoing basis under the same terms and pricing. Any fixed-term commitment or alternative duration will apply only if explicitly stated in a mutually agreed quote or order form.

A Pilot Period applies only if explicitly agreed in a signed Order Form or quote. If no Pilot Period is agreed, the subscription begins immediately on the agreed Initial Term.

If the Parties agree to a defined term (e.g., a 12-month commitment), the subscription will renew automatically for successive terms of the same length unless terminated with at least thirty (30) days’ written notice before the end of the then-current term.

Either Party may terminate this Agreement with immediate effect if the other Party commits a material breach and fails to cure such breach within thirty (30) days of receiving written notice.

3. Fees and Payment Terms

3.1 Pricing and Plans

The Client subscribes to one of the pricing tiers (Lite, Standard, Pro, or Enterprise) according to the then-current pricing:

• For B2B Clients, pricing and features are defined in the applicable Jobilla quote or order form.
  
  
• For self-service Clients, pricing and features are defined on Jobilla’s website at the time of sign-up.

The Client acknowledges that Jobilla may update available pricing tiers, limits, or features from time to time. The latest information is always available on the Jobilla website.

Client-specific engagements not covered by the standard service description, including custom development, tailored training, or individually configured campaigns, shall be invoiced at €180/hour.

If the Customer’s actual usage exceeds the limits of the subscribed pricing tier, Jobilla shall be entitled to invoice the applicable higher-tier pricing for the months during which the higher tier was exceeded. The pricing shall be adjusted accordingly, and the Subscription shall automatically upgrade to the corresponding tier for the following fiscal year (or Renewal Term).

3.2 Campaign Budgets and Fees

Each recruitment campaign includes:

• a Campaign Budget, determined by the Client; and
• a Campaign Fee, calculated as a percentage of the campaign budget according to the selected plan.
  
  

The Campaign Fee covers the use of the Service, automation, optimization, and management of campaign delivery. The remaining portion of the budget is allocated to third-party advertising networks for paid media spend.

3.3 Subscription Fees

Clients pay a monthly subscription fee for platform access according to their selected tier. Unless otherwise agreed in writing, subscription fees are billed in advance.

All subscription fees are exclusive of VAT, which will be added at the applicable rate. In the event of any inconsistency between this Agreement and the “Products & Services” section regarding subscription fees or the Pilot Period, the “Products & Services” section shall prevail.

3.4 Invoicing and Payment

• B2B Clients: Invoiced as stated in the accepted quote or order form.
• Self-service Clients: Payment is made online by card or other accepted payment method.

For avoidance of doubt, where campaign charges are deducted from the Wallet in accordance with Section 3.5, payment in advance is not required at the time of campaign launch, unless an invoice becomes overdue.

Jobilla does not guarantee campaign performance or hiring outcomes. The Service relies on third-party advertising platforms (e.g., Meta, Google, etc.), and Jobilla is not responsible for their availability, policies, approvals/rejections, algorithm changes, pricing, delivery, or performance. Advertising spend paid to third-party platforms is non-refundable and is used at the Client’s own risk.

3.4.1 Subscription Fees

Subscription fees shall be invoiced as specified in the applicable Order Form. Any Pilot Period pricing or invoicing applies only if explicitly agreed in the Order Form.

The subscription fee shall be invoiced in full on the Commencement Date.

Initial Term Portion is twelve (12) months. If the Agreement is not terminated effective at the end of the Pilot Period, the subscription fee for the Initial Term shall be invoiced on the first day immediately following the Pilot Period.

Renewal Terms. For each Renewal Term, the subscription fee shall be invoiced in full on the first day of that Renewal Term.

3.4.2 Campaign Fees

Campaign fees may be paid at the start of the campaign by credit card or from a preloaded “Wallet.”

Pay-as-you-go. The Customer may pay for campaigns on a pay-as-you-go basis by credit card.

Preloaded Wallet. Alternatively, the Customer may preload funds for campaign fees into a balance (“Wallet”). The Wallet is invoiced at the time of loading, and campaign costs are deducted from the Wallet until the balance has been used. Funds loaded into the Wallet are credited and available for campaign fees once payment has been received. The Wallet balance does not accrue interest. The Supplier does not refund funds loaded into the Wallet for campaign fees.

This prepayment requirement applies to Pay-As-You-Go campaigns. If the Client uses the Wallet, campaign charges are deducted from the Wallet in accordance with ToS Section 3.5.

If the Client chooses to use a Wallet for Campaign Fees and advertising spend, the Wallet terms (including invoicing, validity periods, and expiry) are governed by Section 3.5 (Wallet and Commitments) of the Terms of Service.

3.5 Wallet and Commitments

3.5.1 Definitions

For the purposes of these Terms:

• “Commitment” means a Client’s purchase decision to acquire a specified amount of campaign budget or campaign-related spend, recorded as a committed item with an agreed value and a latest invoicing date.
• “Latest Invoicing Date” means the date falling twelve (12) months after the Commitment purchase date, by which the Commitment must be converted into Wallet and invoiced at the latest, unless converted earlier.
• “Wallet” means the campaign wallet balance maintained in the Service and available for use towards Campaign Fees and advertising spend.
• “Conversion” means the process by which a Commitment is converted into Wallet value and a corresponding invoice is issued to the Client.

3.5.2 Commitments

(a) The Client’s purchases may initially be recorded as Commitments.

(b) Commitments cannot be used to launch campaigns or pay Campaign Fees until they are converted to Wallet.

(c) Each Commitment may be converted into Wallet in full (as a whole).

3.5.3 Conversion and Invoicing

(a) When a Commitment is converted into Wallet (either at the Client’s request, or due to expiry as described in Section 3.5.4), Jobilla will (i) credit the corresponding value to the Wallet immediately, and (ii) create and send an invoice to the Client for that amount.

(b) The Wallet value credited upon Conversion is available for use immediately upon Conversion, and is not conditional upon payment of the Conversion Invoice at the time of Conversion.

(c) Wallet balances may therefore include amounts that have been invoiced but not yet paid.

3.5.4 Commitment Validity, Expiry and Automatic Conversion

(a) Each Commitment is valid for a maximum of twelve (12) months from the Commitment purchase date, unless it is converted into Wallet earlier.

(b) If a Commitment has not been converted into Wallet during its validity period, it will expire at the end of the 12-month period and will be automatically converted into Wallet. Upon such expiry conversion, Jobilla will issue a Conversion Invoice for the full Commitment value.

3.5.5 Wallet Usage and Flexibility

(a) Wallet funds may be used to pay for Campaign Fees and advertising spend in accordance with the Client’s subscription plan and the Service’s functionality available at the time of use.

(b) Wallet funds may be spent flexibly across campaign use cases, subject to the Service’s features and any applicable usage limits.

(c) The Wallet is non-interest-bearing.

3.5.6 Payment Status and Non-Payment Protections

(a) The Client shall pay all Invoices in accordance with the payment terms set out in the applicable Order Form/Subscription Agreement and/or Section 4 (Fees and Payment).

(b) If any invoice related to Wallet or Campaign Fees becomes overdue, Jobilla may, upon notice, suspend or restrict campaign launches and/or further Wallet usage until overdue amounts are paid, without affecting the Client’s obligation to pay the invoiced amounts.

(c) Jobilla may also set reasonable credit controls, including limits on unpaid Wallet balances, to manage non-payment risk.

(d) If the Client disputes any invoice, the Client shall notify Jobilla without undue delay and provide reasonable details of the dispute. The Client shall pay all undisputed amounts in accordance with the applicable payment terms. Jobilla may suspend use of any Wallet value corresponding to the disputed amount until the dispute is resolved, without limiting the Client’s obligation to pay any undisputed amounts.

(e) Jobilla may require prepayment, reduce Wallet availability, or suspend Wallet usage where Jobilla reasonably determines that the Client presents an increased payment risk or where invoice amounts exceed Jobilla’s credit limits.

3.5.7 Wallet Validity, Expiry and Subscription Status

(a) The Wallet remains valid and usable while the Client maintains an active paid subscription.

(b) If the Client terminates all paid subscriptions and downgrades to a freemium tier (or otherwise ceases to have an active paid subscription), the Wallet will remain valid and usable for twelve (12) months from the downgrade/termination date, after which any remaining Wallet balance will expire.

(c) If the Client re-subscribes to a paid subscription (at minimum lowest paid subscription tier (currently Starter)) within the 12-month period referred to in Section 3.5.7(b), the Wallet will remain active and usable under Section 3.5.7(a).

(d) For clarity, Wallet expiry shall not occur while the Client maintains an active paid subscription, but any remaining Wallet balance may expire if the Client has no active paid subscription for a continuous period of twelve (12) months.

3.5.8 Downgrades

(a) The Client may downgrade its subscription tier (including from Pro to Lite) and retain access to its Wallet, provided the Client maintains an active paid subscription (minimum the lowest paid subscription tier (currently Starter)).

(b) If the Client downgrades from a paid subscription to freemium, the Wallet remains usable for 12 months from the downgrade date in accordance with Section 3.5.7(b).

3.5.9 No Refunds

Wallet balances and Commitments are non-refundable and will not be returned to the Client under any circumstances, including upon termination or expiry, except where required by mandatory applicable law.

3.6 Taxes and VAT

All prices are exclusive of VAT and other applicable taxes. VAT will be added at the applicable rate.

4. Rights and Intellectual Property

4.1 License to Use

Jobilla grants the Client a non-exclusive, non-transferable, time-limited right to use the Service for its internal business purposes during the subscription term.

The Client may not:

• resell, sublicense, lease, or otherwise distribute the Service;
• reverse engineer, decompile, or modify the Service; or
• use the Service in a way that disrupts its functionality or harms Jobilla or other users.
  
  

4.2 Ownership

All rights, title, and intellectual property rights in the Service—including its source code, interface, structure, databases, documentation, analytics, algorithms, and other technical or content components—are and remain the exclusive property of the Provider or its licensors. This Agreement does not transfer any ownership or intellectual property rights to the Client.

The Provider has the right to further develop the Service and use anonymous, aggregated usage data to improve it.

4.3 Client Content

The Client retains ownership of all content it submits to or creates within the Service, including campaign texts, brand materials, images and logos, job postings, candidate data, and questionnaire responses.

The Client grants the Provider a limited right to process such content solely for the purpose of delivering the agreed services and for statistical purposes.

The Client is responsible for ensuring that the content it provides does not violate any third-party rights and complies with applicable laws and good practices.

4.4 Reference Use

Jobilla shall treat all information provided by the Customer to Jobilla for the purpose of providing the Service as confidential and a trade secret of the Customer. However, Jobilla shall be entitled to use the Customer's name, logo and recruitment service results as a reference, unless the Customer objects in writing.

5. Client Responsibilities

The Client agrees to:

• protect user credentials and restrict access to authorized personnel;
• ensure that all campaign materials are accurate, lawful, and non-infringing;
• comply with applicable data protection laws as the data controller; and
• ensure each user account is used by one individual only.

The Client is responsible for the content of the campaigns, setting campaign budgets, and ensuring that the Service is used only within the agreed number of users.

The Client is responsible for ensuring that the content of campaigns published through the Service complies with the META Advertising Standards.

6. Data Protection

Each Party agrees to comply with the EU General Data Protection Regulation (GDPR) and applicable privacy laws.

• The Client acts as a data controller for candidate and campaign data.
• Jobilla acts as a data processor, processing data only on documented instructions from the Client.

The Parties shall enter into a separate Data Processing Agreement (DPA), which forms an integral part of this Agreement.

7. Service Availability and Usage Limits

Jobilla aims to provide reliable Service availability but does not guarantee uninterrupted or error-free operation. Planned maintenance or updates may temporarily affect access.

The Provider may set, adjust, and enforce usage limits and technical safeguards, including limits on request rates, concurrency, storage, tokens or inference usage, and per-seat or per-account caps. To enforce limits or protect the Service, the Provider may throttle, restrict, or temporarily suspend use. 

Plan entitlements may differ, and if the Client exceeds included usage, the Provider may charge overage fees at the then-current rates for the applicable plan. The Provider may also introduce new paid features or modules that are not included in existing fees; purchase of such add-ons is optional. Exceeding usage limits does not entitle the Client to refunds or service credits unless expressly agreed in writing.

8. Confidentiality

Both Parties shall keep all non-public information received from the other Party confidential and use it solely for fulfilling this Agreement.

Confidential information may not be disclosed to third parties without written consent, except where legally required.

9. Limitation of Liability

Jobilla is not liable for indirect, incidental, or consequential losses, including lost profits or data. 

Jobilla’s total liability for any claim arising from this Agreement is limited to the total fees paid to Jobilla in the last 12 months, excluding third-party advertising spend, except in cases of willful misconduct or gross negligence.

For avoidance of doubt, Jobilla shall have no liability arising from or relating to advertising spend, campaign performance, or the acts or omissions of Advertising Platforms, except to the extent caused by Jobilla’s gross negligence or wilful misconduct.

10. Changes to Terms and Service

Jobilla may update these Terms and adjust pricing at any time by providing at least fourteen (14) days’ written notice to the Client (including by email or in-app notification), and such changes will become effective on the date specified in the notice; the Client’s continued use of the Service after the effective date constitutes acceptance of the updated Terms and pricing.

Changes to these Terms will not modify the commercial terms (including term length, renewal, pricing, or notice periods) agreed in any signed Order Form or Subscription Agreement, unless expressly agreed in writing by both Parties.

11. Termination Effects

Upon termination:

• Access to the Service will be disabled after the effective termination date;
• Client data will be retained only for the defined period in the DPA;
• No refunds are provided for prepaid subscription or campaign fees.

Termination does not entitle the Client to any refund of Wallet or Commitment balances, and any expiry, conversion, and invoicing obligations under Section 3.5 will continue to apply.

12. Assignment

The Provider shall have the right to assign or transfer this Agreement, in whole or in part, to another company within the same group of companies, without the prior consent of the Client. The Client will be notified in writing of such transfer. Such assignment does not affect the validity or continuity of this Agreement, and the transferee shall assume all rights and obligations of the Provider under this Agreement.

The Client may not assign this Agreement without Jobilla’s prior written consent.

13. Governing Law and Dispute Resolution

This Agreement is governed by Finnish law (excluding its conflict-of-law provisions). 

Any disputes shall be resolved through good-faith negotiations. If unresolved, disputes shall be finally settled by a single arbitrator in Helsinki, Finland, under the Rules for Expedited Arbitration of the Finland Chamber of Commerce.

14. Contact

Jobilla Oy
Business ID: 2655898-5
Vuorikatu 16 A 8, 00100 Helsinki, Finland
Email: company@jobilla.com
Website: www.jobilla.com

Appendix: Plan Reference

The latest available plan descriptions and features are published and maintained at: www.jobilla.com/pricing

These describe the applicable campaign fees, subscription fees, and plan-specific limitations and features in effect at the time of subscription or renewal.

Data Processing Agreement (DPA)

Jobilla Oy
Data Protection Annex
Version: 29.01.2026

Definitions

In order to achieve the objectives of the agreement (the "Main Agreement") signed between Jobilla (hereinafter "Jobilla") and the organization that acquires services from Jobilla (hereinafter the "Customer"), it is necessary for Jobilla to process the Customer's personal data. This agreement on the processing of personal data (the "Processing Agreement") is an essential and integral part of the Main Agreement between Jobilla and the Customer. Each of Jobilla and the Customer is referred to herein individually as a “Party” and collectively as the “Parties”.

The terms used in this Processing Agreement shall have the same meaning as given in Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”). Such terms include in particular controller, processor, personal data, data subject, processing and personal data breach.

Rights and obligations of the Parties

In this Processing Agreement, the parties agree that Jobilla, as a processor, will process personal data on behalf of the Customer during the term of the Main Agreement.

The Customer is the data controller in relation to the personal data of its job seekers, i.e. the Customer alone determines what data is collected from the job seekers and the purposes for which and the means by which personal data is processed. The Customer is responsible for complying with the obligations the GDPR and other applicable laws set for data controllers.

Jobilla shall process personal data only on documented instructions from the Customer, unless required to do so by Union or Member State law to which Jobilla is subject. In this case, Jobilla shall inform the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

During and after the processing, Jobilla may retain and use anonymised data for the development of its activities and products. Anonymisation means the modification of the data in such a way that they can no longer be used to identify individuals by any means.

Jobilla shall immediately inform the Customer if, in Jobilla’s opinion, instructions given by the Customer infringe the GDPR or the applicable Union or Member State data protection provisions.

In addition to this Processing Agreement, each Party undertakes to comply with applicable national data protection laws and the provisions of the GDPR as applicable to its activities.

Nature and purpose of processing

Jobilla processes personal data for the purpose of providing and delivering the products and services to the Customer as specified in the Main Agreement. Jobilla is not entitled to process the Customer's personal data for any other purpose or for the benefit of anyone else.

Categories of data subjects and categories of personal data processed

The personal data processed concerns the Customer's job seekers.

As the Customer has full control over what data is processed about job seekers, the Customer is solely responsible for having the right to process such personal data. Most commonly personal data processed concerns the name, email address, telephone number, job application and CV of job seekers.

Duration and retention period of processing

Jobilla processes personal data for the duration of the Main Agreement.

Jobilla will retain the personal data of the Customer's job seekers for the retention period specified by the Customer. Unless the Customer decides otherwise, the default retention period of personal data is 2 years for each of the Customer’s job seeker, after which the personal data of the job seeker in question will be automatically anonymised.

Sub-processors

Jobilla has the Customer’s general authorisation for the engagement of sub-processors. An up-to-date list of sub-processors is available at https://www.jobilla.com/en/sub-processors

If Jobilla plans to make changes to its sub-processors, it will notify the Customer by giving at least 30-days written notice. Jobilla’s obligation to notify concerns intended adding, removal or change of a sub-processor. After receiving notification, the Customer has the right to object to the intended change in the use of a sub-processor.

If the Customer objects to the intended change and Jobilla cannot reasonably use another sub-processor or another method in processing the personal data, Jobilla shall not be liable to the Customer for any breach of contract or omission resulting from this. In this situation, Jobilla shall be entitled to terminate the Main Agreement in writing to expire when the sub-processor change takes effect.

When using sub-processors for processing personal data, Jobilla agrees that it will impose data protection terms on any sub-processor it appoints that protect the personal data to the same standard as provided for by this Processing Agreement. Jobilla is responsible that its sub-processors comply with the requirements of this Processing Agreement.

International data transfers

Jobilla and the sub-processors used by Jobilla will not transfer Personal Data to countries outside the EU or EEA except on the basis of documented instructions provided by the Customer or unless required by law or binding governmental authority. The transfer of personal data must be carried out using adequate safeguards as defined in the GDPR.

Confidentiality

All personal data processed by Jobilla on behalf of the Customer is considered the Customer's confidential information and Jobilla undertakes to keep the data confidential and not to disclose or divulge it to any third party. Jobilla ensures that only such people within its own organization shall have access to the personal data that is necessary for furthering Jobilla’s obligations relating to the purpose and that such people shall be subject to a strict duty of confidentiality, contractual or statutory, and shall not permit any person to process the personal data who is not under such a duty of confidentiality. The duties of confidentiality shall survive the termination or expiration of the Processing Agreement.

Data security

Jobilla shall implement appropriate technical and organizational measures to protect the personal data in its possession from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the personal data. Such measures shall take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for natural persons’ rights and freedoms. For the avoidance of doubt, this data security obligation does not concern data systems or software that is owned by the Customer or of which intellectual property rights belong to the Customer or a third party.

Such measures can include, as appropriate:

the pseudonymisation and encryption of personal data;

the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

More information on the technical and organizational measures used by Jobilla can be found at  https://www.jobilla.com/en/technical-and-organizational-measures .

Personal data breaches

Jobilla must notify the Customer without undue delay about personal data breaches it becomes aware of, so that the Customer can comply with the provisions of the Regulation regarding personal data breach notifications within the set time limits. When notifying the Customer, Jobilla must include necessary details about the personal data breach and also otherwise provide reasonable assistance for the Customer. Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

Jobilla must also take all such other necessary measures to mitigate or remedy the effects of the personal data breach and to prevent further breaches.

Data protection impact assessment

If Jobilla becomes aware that the planned processing would cause a high risk for the rights and freedoms of natural persons, it must notify the Customer about this and assist the Customer, if necessary, in conducting a data protection impact assessment.

Data subject’s rights

Taking into consideration the nature of the data processing, Jobilla must reasonably and without undue delay assist the Customer, including by applicable technical and organisational measures, to fulfill any request from a data subject to exercise its rights under the Regulation. Such rights may include, as they are described in the GDPR, rights of access, correction, objection, erasure (“right to be forgotten”) and data portability.

If such requests are made directly to Jobilla, it must notify the Customer about the request without undue delay. Jobilla may not respond to the request, unless authorised by the Customer.

Audits

Jobilla shall make available to the Customer all information necessary to demonstrate compliance with the obligations that are set out in this Processing Agreement and in the GDPR. Jobilla shall permit, reasonably assist and participate in audits, including inspections of Jobilla's premises, systems, processes and documentation, by the Customer or another auditor authorized by the Customer, if the Customer deems it necessary to conduct such audit. Audits will be performed during normal business hours with the aim of causing as little disruption to Jobilla’s business operation as reasonably possible. Each party shall bear its own costs in connection with the performance of the audit. The Customer shall notify Jobilla at least 30 days in advance of the audit. To avoid unnecessary audits, audits should primarily only be conducted in situations where there is reason to suspect that Jobilla is not complying with the terms of this Processing Agreement or the requirements of the Data Protection Regulation. Jobilla shall also ensure the right of the Customer to audit the subcontractors of Jobilla as required by the GDPR, to the extent that such auditing is reasonably possible.

Other terms

If Jobilla is required to assist the Customer in relation to any breach of the GDPR caused by the Customer, the implementation of data subjects' rights in a manner different from normal processing or the compliance with the provisions of the Data Protection Impact Assessment, Jobilla is entitled to invoice the reasonable actual time used for the assistance tasks in accordance with the hourly rates agreed between the parties. Invoicing the time used for the assistance tasks requires that the Customer has accepted that Jobilla can use time to perform assistance tasks.

Jobilla shall be liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Customer. Where a Party has, in accordance with Art. 82 GDPR, paid full compensation to the data subject for the damage suffered, the Party that has paid the compensation shall be entitled to claim back from the other Party that part of the compensation corresponding to the other Party’s part of responsibility for the damage caused by infringing the GDPR. Jobilla is not liable to the Customer for any other indirect, consequential, or special damages or for claims made by third parties arising from any breach of this Agreement. Jobilla's liability for damages for breaches of contract shall be limited to the aggregate maximum amount specified in the Main Agreement between the Parties as the upper limit of Jobilla's liability for breach of the Main Agreement.

Term and effects of termination

This Processing Agreement comes into force on the same date as the Main Agreement between the Parties and shall thereafter remain in force until the Main Agreement is terminated or expires under its terms.

Within a reasonable time after the termination or expiration of the Main Agreement, Jobilla shall, at the choice of the Customer, delete or return all personal data to the Customer and also delete all copies of the personal data, unless Union or Member State law requires Jobilla to retain some or all of that data. In such an event Jobilla retains the data as required by law without further processing the personal data and continuing to comply with the obligations of this Processing Agreement.

If the Customer has not notified Jobilla about deletion or return of data, Jobilla shall delete all personal data in its possession, including any copies according to the retention period defined in this Processing Agreement, unless Union or Member State law requires Jobilla to retain some or all of that data.

The Customer is obligated to make sure that it has backup copies of the data prior to the end of the retention period if the Customer considers the data still necessary.

Privacy Notice and Terms for Job Seekers

Effective Date: 16.10.2026

This document explains how Jobilla handles personal data on its websites and recruitment platform and in its marketing. Sections 1–9 form our Privacy Notice; Section 10 contains the Terms for Job Seekers. Separate business terms and a Data Processing Agreement (DPA) apply to customers.

1. Controller and Contact Details

Jobilla Oy
Business ID: 2655898-5
Vuorikatu 16 A 8, 00100 Helsinki, Finland
Data Protection Officer: Joel Rössi
Email: privacy@jobilla.com

Jobilla Oy is the controller for its own website, marketing, customer relationship and platform user data. Jobilla DACH GmbH (HRB223154B, Berlin, Germany) and Jobilla Benelux B.V. (KVK 88288528, Apeldoorn, Netherlands) process this data on its behalf under data processing agreements. This notice does not cover Jobilla’s personnel records.

For job applications, the employer or recruiting organization is the controller and Jobilla acts as its processor. The employer determines the purposes, legal basis and retention of application data. Consult its privacy notice or contact the employer; Jobilla can help identify the responsible controller and assist with requests. Jobilla does not operate its own talent pool for sharing candidates with customers.

2. Data, Purposes and Legal Bases

We collect data you provide, technical information generated when you use our websites or Service, and business contact information supplied by third parties. Where data comes from another source, we provide the required information about that source and processing.

• Accounts and customer relationships: Email address, display name, organization details, contact information and communications are used to administer access, provide the Service, respond to enquiries and support customers. The basis is our legitimate interest in providing and managing the customer relationship, or contractual necessity where you personally are a party to the contract.
• Security and improvement: Usage information, IP addresses, timestamps and logs help us operate, secure and improve the Service. The basis is our legitimate interest in a secure, reliable and useful Service, subject to your rights and any consent required for tracking technologies.
• Marketing and events: Contact details, business affiliation, registrations, preferences and website interactions support relevant business communications, events and market research. We rely on consent where required and otherwise on legitimate interests where permitted. Event administration may rely on a contract with you.
• Legal matters: Necessary data is processed to meet legal obligations or, on the basis of legitimate interests, to establish, exercise or defend legal claims.

We balance legitimate interests against your rights and freedoms. At collection, we explain whether information is required by law or contract, or needed for a feature, and the consequences of not providing it. Accepting terms or reading this notice does not constitute blanket consent. Jobilla does not use AI to process job applications.

Applications, answers, attachments and recruitment communications are processed for the relevant employer under its instructions and the DPA. They are not used for Jobilla’s own marketing. Withdrawing marketing consent does not withdraw an application or automatically delete the employer’s records.

3. Google Workspace and Google Calendar Data

Connecting a Google account for calendar and interview scheduling is optional and is not required to use the rest of the Service. This section covers data received through Google APIs; candidate information processed for customers remains subject to the DPA and the employer’s privacy notice.

With your consent through Google’s OAuth consent screen, Jobilla uses the narrowest scopes necessary to create, view, update, and delete the interview events Jobilla schedules on calendars you own, and to generate meeting links for those interviews — currently calendar.events.owned and meetings.space.created. Jobilla does not request access to Gmail, Drive, or calendars you have not connected.

Jobilla uses this data solely to provide the calendar and scheduling features you enable. We do not use it for advertising or sell or rent it. We share it only with the infrastructure sub-processors operating the Service, where required by law, or with your consent, subject in every case to Google’s Limited Use requirements.

Jobilla’s AI/ML features (currently powered by OpenAI and Anthropic) do not receive or use Google Workspace data in any form. Jobilla does not use Google Workspace data, or data derived from it, to develop, train, or improve any generalised, non-personalised, or foundational AI/ML model, whether its own or a third party’s.

Jobilla’s use and transfer of information received from Google APIs, including Google Workspace scopes, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. General provisions in this notice do not expand those permissions.

We retain this data only as needed for the enabled features or legal obligations. After disconnection or account closure, we delete or de-link it without undue delay once it is no longer needed for those purposes. Legally required retention is limited to the data and period required.

You can revoke access through Jobilla’s integration settings or your Google Account permissions. If we change the use of Google data or add a scope, we update this section and obtain consent where required before the new access or use begins.

4. Marketing and Cookies

You may withdraw marketing consent or object to direct marketing at any time through an unsubscribe link or by contacting privacy@jobilla.com. We then stop direct marketing and related profiling, retaining only minimal suppression information where needed to respect your choice. Essential service communications are separate. Legitimate interest does not override applicable requirements for prior consent to electronic marketing.

We use necessary cookies for functions such as login, security and privacy choices. Optional analytics, advertising and functionality cookies, including partner cookies, are used with consent where required. Their providers, purposes and durations are described in the website’s cookie information and settings, where you can reject optional cookies or change or withdraw consent. Browser controls provide additional options; disabling necessary cookies may prevent requested functions from working.

5. Recipients and Security

Access is limited to authorized personnel, contractors and service providers who need data for the relevant purpose. Providers support hosting, infrastructure, customer relationship management, communications, support, analytics and marketing as applicable. Processors are bound by appropriate data processing, confidentiality and security obligations. The Service’s sub-processors are listed here.

We do not sell personal data. Necessary disclosures may be made to meet legal requirements, address security or abuse, protect legal rights, or complete a merger, acquisition or business transfer, subject to applicable law and confidentiality. We inform affected individuals where required. Google data remains subject to Section 3.

We use appropriate technical and organizational safeguards, including personal credentials, access controls, secure infrastructure and encrypted communications (TLS/HTTPS and SSH), and assess security measures and vulnerabilities. Breaches are reported to authorities and affected individuals where and within the deadlines required by law.

6. Data Locations and Transfers

Recruitment platform: Personal data is stored within the EU. Routine storage or processing outside the EU does not occur without the affected individuals’ prior consent. Exceptional access by a Jobilla employee or direct contractor outside the EU may occur, subject to applicable data protection requirements, customer agreements and transfer safeguards. This notice does not itself authorize a transfer.

Marketing and website data: We store this data within the EU/EEA where possible. Processing outside the EEA uses an applicable European Commission adequacy decision or appropriate safeguards, such as Standard Contractual Clauses and supplementary measures where required. Contact us for details or a copy of the applicable safeguards. This does not relax the recruitment platform restrictions.

7. Retention and Deletion

We retain personal data only while necessary for its purpose or a legal obligation, then delete or irreversibly anonymize it. Retention is determined as follows:

• Account and customer data: For the service or relationship and any necessary resolution of outstanding contractual or legal matters, taking account of statutory retention and limitation periods.
• Technical logs: For the period needed to operate and secure the Service and investigate relevant incidents.
• Marketing data: While lawful and relevant, subject to withdrawal or objection; minimal suppression records and necessary evidence of consent may be retained for compliance.
• Google data: As described in Section 3.
• Application data: Under the employer’s instructions, retention policy and DPA.

Deletion requests are assessed under applicable law; data may be retained where a legal exception to erasure applies.

8. Your Rights

Subject to GDPR conditions, you may:

• Access and obtain a copy of your data, correct inaccuracies, and request erasure or restriction of processing.
• Receive data you provided in a structured, commonly used, machine-readable format and request transfer to another controller where technically feasible, if processing is automated and based on consent or a contract with you.
• Object to processing based on legitimate interests for reasons relating to your situation. We stop unless compelling overriding grounds or legal claims justify continued processing. You may always object to direct marketing and related profiling without giving a reason.
• Withdraw consent without affecting earlier lawful processing. This affects the processing based on that consent; a feature dependent on it may become unavailable.
• Complain to a supervisory authority, particularly in your country of residence, workplace or the alleged infringement. In Finland: Office of the Data Protection Ombudsman.

Send requests to privacy@jobilla.com. We request only information needed to handle the request and, where reasonably necessary, verify identity. We respond without undue delay, normally within one month. A permitted extension of up to two further months is explained within the first month. Application-related requests are handled with the employer as described in Section 1.

9. Privacy Notice Updates and External Services

External websites and services have their own privacy notices. We may update this notice to reflect processing or legal changes and communicate material changes through our website, Service or another appropriate channel. Where new processing requires consent, we obtain it before starting.

10. Terms for Job Seekers

10.1 Scope and Responsibilities

By using Jobilla Oy’s online recruitment tool as a job seeker, you agree to these terms. The Service facilitates applications and recruitment communications; the employer is responsible for vacancies, hiring decisions and employment arrangements. Use does not guarantee an interview, offer or employment.

You are responsible for the information and materials you submit and your right to provide them. Do not submit unlawful content, impersonate others, disrupt the Service or attempt unauthorized access.

10.2 Content and Intellectual Property

You retain rights in your content and authorize Jobilla to handle it as needed to provide the Service to you and the relevant employer. Personal data is processed under the Privacy Notice, the employer’s notice and the DPA; this authorization does not replace a required legal basis.

Jobilla may use genuinely anonymous aggregate information for statistics and analysis. Any processing to produce it must comply with applicable law, the DPA and the employer’s instructions. Pseudonymized data remains personal data; Google data remains subject to Section 3.

The Service, its software, updates and Jobilla-provided content remain the intellectual property of Jobilla or its licensors. You receive only a right to use the Service for its intended recruitment purposes; no ownership rights transfer.

10.3 Changes

Jobilla may modify the Service and these terms for functionality, security, legal or operational reasons. Material changes are notified with an effective date and reasonable advance notice where appropriate; urgent legal or security changes may take effect sooner, subject to law. You may stop using the Service if you disagree. Continued use after the notified effective date constitutes acceptance to the extent permitted by law. Changes do not themselves constitute consent to new data processing or limit mandatory rights.

10.4 Applicable Law and Disputes

Finnish law applies, excluding conflict-of-law rules. Disputes are settled in the District Court of Helsinki, subject to mandatory jurisdiction and consumer protection rules. EU consumers retain mandatory protections of their country of domicile and may bring proceedings in their home courts where applicable law permits.

Where the dispute falls within their remit, Finnish consumers may contact Consumer Advisory Services or the Consumer Disputes Board.

Security and Sub-processors

Consolidated draft: 16.10.2026

This document describes Jobilla’s technical and organizational security measures and the companies involved in processing data for the Service. When processing personal data on behalf of customers, Jobilla acts as a processor and its customers act as controllers. The applicable Data Processing Agreement (DPA) governs that processing.

Technical and Organizational Measures  |  Sub-processors  |  Jobilla Group Processing

1. Technical and Organizational Measures

The following measures address confidentiality, integrity, availability, resilience and recovery under Article 32 GDPR. Customers remain responsible for their obligations as controllers under Article 24 GDPR.

1.1 Privacy Governance and Training

• Privacy by design and privacy-friendly defaults are addressed in feature refinement and software development. All staff receive GDPR and data protection training; product and engineering teams receive additional training on privacy-focused design.
• The Data Protection Officer and legal department may be consulted on new functionality and review data protection policies and documents annually. Documents are updated following review or as needed.

1.2 Access Controls and Internal Handling

• Staff receive roles reflecting their responsibilities and the minimum access needed for their duties. Assignments are recorded and reviewed at least every six months.
• Internal policies encourage staff to share links or anonymous unique record identifiers instead of personal data, so access remains subject to the platform’s controls wherever possible.
• Individual user accounts are distinguished from software service accounts. Access management checks every requested action against the account’s permissions.
• Limited-access service accounts and a microservice architecture restrict the personal data available to individual software components.

1.3 Encryption and Infrastructure Security

• Storage: Personal data storage uses encryption at rest with Amazon Key Management Service (KMS). AWS manages the RDS database storage keys, which rotate automatically each year. Hardware security modules (HSMs) protect the encryption system. Internal policies require regular evaluation of encryption, key rotation and database encryption.
• Employee devices: All employee computers are encrypted and managed through mobile device management (MDM). Encryption keys are remotely escrowed, and devices can be remotely erased.
• Network connections: External data transfers use TLS encryption; internet connections between the Service and users use TLS 1.3. Internal connections use certificate-based encryption, network rules and private networking in a Virtual Private Cloud (VPC). Direct external access to systems in the VPC uses an encrypted VPN.
• Physical security: Infrastructure providers maintain strong security standards, such as ISO 27001 and SOC 2 Type II. Stored data and applications run on separate hardware, with HSMs providing a further physically separate component protecting access to data.

1.4 Integrity and Logging

Encryption and access controls protect data integrity. Significant system activities are logged with the actor, system component, activity, target resource and timestamp, with additional context where relevant. System logs are retained for 15 days. Candidate data access and modifications are recorded in an internal audit log retained for a minimum of three years. Provider-specific retention periods are listed separately below.

1.5 Availability and Recovery

• A backup policy defines backup availability, geographic redundancy and restore testing requirements.
• An incident response plan covers availability and security, with triage and resolution commitments based on severity and the criticality of affected systems.
• At least one engineer is on call at all times. Automated availability alerts notify the engineer; unresolved incidents escalate to the Chief Technology Officer.
• A disaster recovery plan addresses natural and human-made disasters, political disturbances, internal and external threats, malicious activity and failure of a core infrastructure provider.
• Data storage is replicated across at least two availability zones within the same EU region. Following a data center failure, replicas can be activated and software systems provisioned in a functioning availability zone within 24 hours.
• Code-driven automated provisioning supports recovery of servers, databases and software. Monitoring identifies availability issues and capacity bottlenecks in relevant systems.

1.6 Retention Controls

Customers can specify a data retention policy that anonymizes and/or erases data after a defined period. Processing, retention and deletion remain subject to the applicable DPA and customer instructions.

Technical review history: 18.08.2022 — Version 1.0; 06.04.2023 — Annual review, no changes. The consolidation date above is an editorial date and does not represent a new technical review.

2. Sub-processors

The following providers support Jobilla’s Service. The server locations below describe hosting locations; they do not independently describe all possible access locations or transfer arrangements. Approval and notification of sub-processor changes are governed by the applicable DPA.

3. Jobilla Group Processing

The following Jobilla entities carry out the activities listed below. Where Jobilla Oy contracts directly with the customer as processor, Jobilla Oy is the primary processor rather than its own sub-processor. The role of each entity depends on the applicable customer agreement and processing arrangement.

4. Contact

For questions about these measures or processing arrangements, contact privacy@jobilla.com.