Data Processing Agreement (DPA) — pilot template
v2026-07-19
This template governs processing of personal data that the Employer (Controller) makes available to doki.help (Processor) when collecting documents from candidates through the Service.
1. Parties and roles
The Employer is the data Controller and determines the purposes of processing. The doki.help operator is the Processor and processes personal data only on the Controller's documented instructions.
2. Subject matter and duration
Processing covers candidate documents and application data submitted via the Employer's vacancy links, for as long as the Employer's account is active or until deletion is requested.
3. Nature and purpose
Collecting, storing, organizing and making available candidate documents so the Employer can review application completeness. No automated decision-making that produces legal effects.
4. Categories of data and data subjects
Data subjects: job candidates. Data: identity documents, certificates, contact details, and any sensitive data (e.g. medical, financial) a candidate chooses to upload.
5. Processor obligations
Confidentiality of personnel; appropriate technical and organizational security measures (RLS isolation, private storage, signed links, encryption in transit); assistance with data-subject requests and with the Controller's own compliance obligations.
6. Sub-processors
The Processor uses infrastructure sub-processors (e.g. Supabase for hosting/database/storage; an email/SMS provider; an AI provider only where the Controller or candidate enables recognition). A current list is available on request.
7. Cross-border transfer
Data may be stored on servers located outside Indonesia. Transfers follow Arts. 55–56 of UU PDP 27/2022, with disclosure and consent obtained at the point of upload.
8. Personal-data breach
The Processor notifies the Controller without undue delay and supports notification to affected data subjects and the authority within 3×24 hours, as required by UU PDP. Security contact: [email protected].
9. Return and deletion
On termination, the Processor deletes or returns personal data at the Controller's choice, save where retention is legally required. Candidates may request deletion of their own data at any time.
10. Audit and governing law
The Processor makes available information necessary to demonstrate compliance. Governing law and dispute resolution to be finalized with counsel (UU 24/2009 language requirements considered).
Email us and we'll send a countersigned DPA for your pilot: [email protected]