GENERIC DATA PROCESSING AGREEMENTS
FOR PROVIDERS AND CLIENTS
Last updated on 11 August 2023
Congratulations, you have just created an account as a Provider or a Client on the PitchandMatch’s platform available at https://pitchandmatch.biz (hereinafter referred to as the “Platform”).
PitchandMatch offers intermediation services between providers of IT services and companies with a need for IT services through the platform available on the website accessible at www.pitchandmatch.biz.
As a Provider, you are a company specialized in IT you will be able to offer your services to potential Clients registered on the platform. As a Client, you are a corporation looking for IT services (project-based or staff augmentation).
Both Providers and Clients on the Platform are acting through their Account Managers (i.e. their employees or authorized agents).
In order for Providers to answer Clients’ needs posted on the Platform (in the form of “Pitches”), Providers may need to create a profile for their own Consultants (IT experts hired by them under a work contract or as freelancers), especially for staff augmentation Pitches (recruitment or Time&Material).
In such regard, PitchandMatch, Providers and Clients (for those latter only regarding their Account Managers’ Personal Data) can be considered as independent data controllers under the General Data Protection Regulation (European Parliament and Council Regulation 2016/679).
The present Generic Data Processing Agreement aims at laying out the obligations of PitchandMatch, Providers and Clients, with regards the protection of Personal Data in the frame of the Platform’s use. This agreement completes our Terms of Services and our Privacy Policy, so every Provider and Client using the Platform must comply with it. DO NOT USE the Platform if you do not agree with the provisions of the present agreement.
Please note that any word starting with a capital letter should have the meaning given to it in our Terms of Service or in our Privacy Policy.
I. PROVIDERS’ OBLIGATIONS:
1. When creating a Consultant’s profile:
PitchandMatch is a tool provided “as is” with its already existing processes and providers (Subprocessors of Personal Data). Therefore, it is your obligation to read and understand our Terms of Use and our Privacy Policy, as well as the functioning of the Platform (including the fact that Consultant’s and Account Managers’s Personal Data is transferred to our Subprocessors based in the US) and to explain it to the Consultants (which are deemed to be in a contractual relationship with you, either on the basis of a work contract or a freelancer contract) you want to create a profile for.
When creating a Consultant profile, you have two options:
- Create an “Anonymized Profile” with only basic information but no personal details about a Consultant. Such information is: country and city of residence, gender, current employer and position, expertise in certain technologies, years of experience, languages spoken, previous experience in industry, availability for professional missions and interviews with potentially interested Clients. Such information (if provided extensively) could still be deemed to be Personal Data under the GDPR as long as the aggregate of such information can make a person identifiable. Therefore, even when choosing this option you should obtain prior consent of the Consultant before creating their profile. PitchandMatch can in no case be held liable in the absence of such Consultant’s prior consent.
- Create a “Detailed Profile”. In this case, since more Personal Data is required (such as the name, surname, email address and phone number of the Consultant) is required, you commit to provide the truthful phone number and email address of the respective Consultant. Indeed, we will use both the phone number and the email address to send the Consultant a link to go on the Platform, accept the creation of their account and give their consent to Our Privacy Policy. PitchandMatch can in no case be held liable if you did not indicate the right phone number or email address, which led in the absence of consent of the Consultant to our Terms of Use and/or Privacy Policy.
The Personal Data provided by Provider when creating a Consultant’s profile is transmitted to Airtable (Formagrid Inc.), based in the United States of America. Airtable is the database provider for PitchandMatch, on which all the information concerning a user of the Services (Account Manager and Consultant) is stored. As such, all the information about You provided on the Platform (Professional Information and Personal Data) is accessible and stored by them on their server in the United States. Their privacy policy is available at: https://www.airtable.com/privacy
Even though PitchandMatch has signed a data processing agreement based on the Standard Contractual Clauses issued by the European Commission with Formagrid Inc., we draw your attention to the fact that the THE EUROPEAN COURT OF JUSTICE (ECJ) RULED THAT THE PRIVACY SHIELD FRAMEWORK, WHICH HAD PREVIOUSLY ALLOWED DATA TRANSFERS OF PERSONAL DATA FROM THE EU TO THE UNITED STATES OF AMERICA DID NOT PROVIDE SUFFICIENT SAFEGUARDS FOR THE PROTECTION OF EU CITIZENS PERSONAL DATA, ESPECIALLY BECAUSE THE LAWS OF UNITED STATES AUTHORIZE LOCAL PUBLIC AUTHORITIES TO ACCESS PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION TO THE UNITED STATES, THESE LAWS NOT BEING COMPATIBLE WITH THE EU GENERAL DATA PROTECTION REGULATION. THEREFORE, THE UNITED STATES OF AMERICA ARE CURRENTLY CONSIDERED AS A NON-ADEQUATE COUNTRY FOR THE PROTECTION OF PERSONAL DATA. As a consequence, you commit to collect the enlightened consent of Your Consultant, by explaining them the content of our Privacy Policy (especially article 3 regarding initial recipients of Personal Data) and how their data will be transferred under this agreement, BEFORE you create an account for them.
In addition, when creating a Consultant’s profiles, you can use our API to OpenAI to extract necessary information for the provision of Services (as defined in the Terms of Service) from the Consultant resume, in order to save time in creating the Consultant’ profiles. We draw your attention on the fact that OpenAI LLC (with registered office at 3180 18th St., San Francisco, CA 94110) is based in the United States of America. Therefore, before using this tool, WHICH IS OPTIONAL, you must collect the specific enlightened consent of Your Consultant to do so, by explaining them what such use of OpenAI entices (including a higher risk of not being able to not perform their rights under the GDPR and a potential access to their Personal Data by the US Government). Moreover, you must always use a resume that does NOT contain the following information about your consultant: name and contact details to avoid any potential leak of such information. Such information shall be added manually during the process.
As already mentioned, it is your obligation to make sure you obtain Your Consultants’ consent BEFORE you create them a profile on the Platform and additional specific consent if you want to use the OpenAI API. You should keep track of such consent and be able to prove it at any time if PitchandMatch requests so (especially in case of a control of a Personal Data protection agency). PitchandMatch shall not be held liable for any consequence in the absence of such Consultant’s consent or your impossibility to prove it, or if the resume used for the extraction of data by OpenAI API did contain the name of contact details of the Consultant. Should PitchandMatch be condemned to pay a fine or any damages on this basis, We reserve all rights for an action against you to be made whole.
Regarding the creation of a “Detailed Account”, as mentioned above, after you create a profile for one of your consultants, we will send them a message in order to them to access the Platform to validate the creation of their profile and to accept our Privacy Policy.
Should a Consultant refuse the Privacy Policy, we will proceed to the deletion of their profile and therefore delete their information from the Platform.
Should a Consultant not access the Platform and/or not accept our Privacy Policy within a period of one month after the creation of their Detailed Profile, we will transform their Detailed Profile into an Anonymized Profile and will therefore delete all extra information that is not necessary for this type of profile.
2. No Sensitive Data or Personal Data relating to children:
Please note that PitchandMatch will never ask for Sensitive Data and that it is strictly forbidden to introduce any such data on the Platform. As a consequence, in no case shall PitchandMatch be liable for Sensitive Personal Data that may be introduced on the Platform by You or Your Provider.
Also, PitchandMatch is not intended for use by children under the age of 18 years old and does not collect personal information from them. If PitchandMatch learns that We have collected personal information from a child, we will take reasonable steps to delete such information from our files as soon as is practicable.
3. When submitting a Consultant profile to a Client:
During the performance of the Services, Providers are able to submit their Consultants’ profiles towards Clients in order to offer their services. It is your duty to inform your Consultants whenever You want to submit their profile to a Client, especially if the Client is not based in the European Union. Again, PitchandMatch shall not be held responsible in the absence of such Consultant’s consent or the impossibility of a Provider to prove it.
On its side, PitchandMatch, after the creation of a Consultant’s profile, attributes them a reference ID. This reference ID will be visible
II. PROVIDERS’ AND CLIENT’S OBLIGATIONS:
1. When inviting another Account Manager on the Platform:
Account Managers are your employees. In order to add an Account Manager on the Platform (by clicking on “Add a new user seat”), you have to provide their full name, function, email address and phone number (which are necessary in order to organize interviews with interested Clients). As a consequence, you commit to obtain the consent of the invited Account Manager for the transfer of their Personal Data BEFORE entering them on the Platform.
2. When discussing together:
Should a Client be interested in having an interview with a Consultant, the Client will be put in contact with the Provider (both through their acting Account Manager(s)). From this point, any exchange of Personal Data regarding a Consultant shall not be deemed to be done by PitchandMatch anymore. However, we still invite both Providers and Clients to respect the provisions of the General Data Protection Regulations as well as any other law relating to Personal Data protection.
III. CLIENT’S OBLIGATIONS:
As a Client, you will receive proposals from Providers in reply to your needs (posted in the form of “Pitches”) and you will also be able to consult the Consultants’ database and ask for an interview with Consultants whose profile you are interested in. Until you indicate that you are interested in having an interview with a Consultant or request an interview, you will not have access to any Personal Data of the Consultant, unless Provider has failed to anonymize properly the resume of said Consultant. In this latter case, you commit not to save any of this information outside of the platform (on any means such as a screenshot) and you commit not to make any use of this information that could be considered a further transfer of Personal Data under the General Data Protection Regulation.
Once a Provider decides to sign a Partnerhsip Agreement with PitchandMatch, a Data Processing Agreement will be included in annex, further detailing the obligations of parties regarding the protection of Personal Data.
Should you need further information or assistance, please do not hesitate to contact us at: personaldata@pitchandmatch.biz