General terms and conditions
Welcome to the Jungle Solutions

MASTER MSA - Welcome to the Jungle Solutions

Welcome to the Jungle Solutions makes companies more attractive by enhancing their employer brand and offering a smooth recruitment experience for candidates and recruiters. This contract governs the obligations of each party in providing this recruitment experience.

This Master subscription agreement (MSA) is entered into between Coruscant, a simplified joint stock company, whose registered office is located at 8-10 rue Saint Fiacre, 75002, Paris, France, registered with the Paris trade and companies register under number 802 162 629 (hereinafter referred to as "Welcome to the Jungle" or "WTTJ") and the Client and governs the provision of services by WTTJ to the client pursuant to an Order Form incorporating this MSA by reference.

The person signing the Order Form declares that they have the authority to bind the Client.

1. DEFINITIONS

Contract: means this MSA and their Annexes, as well as any applicable Order Form.

Authorized Users: means the Client's employees, contractors, consultants and representatives who are authorized by the Client to use the Services.

Company Profile: means the page on the Website, presenting in particular the Client's company profile, Job Offers and Client Content.

Creations: means the final content produced by WTTJ for the benefit of the Client and more particularly the photographs, videos appearing on the Company Profile.

Client: means the entity that places an order for the Services through the signature of one or more Order Forms.

Client Content: means any data or content provided, imported or uploaded to WTTJ Solutions by the Client or Authorized Users.

Price: means all applicable fees described in the Order Form(s).

Intellectual Property Elements: means all intellectual property elements attached to the Services and more generally to WTTJ, including all or part of its websites (including their design, layout and content), its trademarks and/or logos, systems, software, databases and content of any nature (texts, images, music, videos, visuals, etc.).

Job Offer: means any publication of a job offer, regardless of nature, by the Client with a view to filling a vacant position, appearing on the Company Profile.

Order Form: means the order document(s) signed by the Client which describes in particular the Services subscribed to, the Initial Period and the Price.

Participants: means any person appearing in the Creations.

Party: means in the singular WTTJ or the Client, in the plural, WTTJ and the Client.

Personal Data Regulation: means the applicable regulation regarding the processing of personal data and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 applicable from May 25, 2018 (hereinafter the "General Data Protection Regulation" or "GDPR") and law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms as amended.

Services: means all services provided by WTTJ to the Client as specified in the Order Form(s) and which may be subject to specific conditions, as detailed in Annex 1.

Duration: means cumulatively the Initial Period as well as each Renewal Period.

Website: means WTTJ's website, accessible at www.welcometothejungle.com.

WTTJ Solutions: means the software applications made available to the Client by WTTJ via the Services.

2. SUBSCRIPTION TO SERVICES

This Contract govern the conditions for subscribing to the Services in accordance with an Order Form detailing the subscribed services.
Certain Services are subject to additional conditions, detailed in Annex 1 "Specific Conditions for Certain Services".

In case of contradiction between the MSA or their Annexes and the Order Form, the Order Form shall prevail. In case of contradiction between the MSA and their Annexes, the Annexes shall prevail.

WTTJ may modify this MSA as well as their Annexes. In case of substantial modification of these terms, WTTJ will inform the Client by email at the administrator's address as identified in WTTJ Solution. The Client will have a period of thirty (30) calendar days from this notification to object to this update. In case of Client objection, the updated version will not apply to them. The absence of client objection within this 30-day period will constitute acceptance of the updated Contract.

Any particular conditions possibly negotiated between WTTJ and the Client prevail over this Contract.

3. ACCESS TO SERVICES

Access Rights: Subject to the provisions of this Contract, WTTJ will provide Authorized Users with access to WTTJ Solutions as specified in the Order Form.

WTTJ grants the Client, for the duration of the Contract, a personal, worldwide, non-exclusive and non-transferable right to access and use WTTJ Solutions only to the extent necessary for the Client to benefit from the Services. All rights not expressly granted under this Contract remain the exclusive property of WTTJ.

Restrictions: The Client undertakes not to, nor to allow a third party to (1) disassemble, decompile, reverse engineer or otherwise attempt to identify or discover any source code or object code (2) copy, modify, translate or create derivative works of the Intellectual Property Elements (3) reproduce, represent, distribute or exploit all or part of the Intellectual Property Elements for purposes other than those authorized by this Contract.

Any use of WTTJ Solutions and Intellectual Property Elements, not expressly authorized by this Contract, constitutes counterfeiting within the meaning of articles L.335-2 et seq. of the Intellectual Property Code.

Client Content: Subject to the provisions of this Contract, the Client grants WTTJ, during the Duration, a worldwide non-transferable and non-exclusive license on Client Content for the purpose of providing the Services, storing, processing, displaying, using and making available Client Content on the internet and more particularly on the Website, WTTJ's social networks, WTTJ's communications and newsletters. 
 

4. SUBSCRIPTION DURATION AND TERMINATION

Duration: This Contract comes into effect from the signature of the Order Form by the Client, for the initial duration indicated in the latter, starting from the publication of the Company Profile, or three (3) months from the signature of the Order Form, whichever date is earlier (the "Initial Period").

It is specified that in case of subscription for an initial duration greater than or equal to three (3) years, the Client will be required to sign several Order Forms and the Initial Period must be understood as the sum of the durations specified in the applicable Order Forms.

At the end of the Initial Period, the Contract will be automatically renewed for successive periods of twelve (12) months (each being a "Renewal Period") unless one of the Parties sends the other written notification informing of its intention not to renew the Contract at least two (2) months before the end of the Initial Period or Renewal Period, in which case the Contract will expire at the end of the Initial Duration or the current Renewal Period.

Termination for breach: The Contract may be terminated by right by one of the Parties in case of serious breach by the other Party of its contractual obligations.

Termination for breach may only occur after the expiration of a period of thirty (30) calendar days from the first presentation to the defaulting Party of a reasoned formal notice sent by registered letter with acknowledgment of receipt by the other Party, which remains unsuccessful.

Termination for convenience: Notwithstanding the foregoing, during the first contractual year, and for a maximum period of three (3) months after signing the Order Form, the Client has the right to terminate the Contract provided that, cumulatively (i) the Company Profile has not been published, (ii) photo shoots and video filming have not been carried out by WTTJ and (iii) subject to payment by the Client of a lump sum equivalent to 30% of the Price.

Termination for damage to image: WTTJ reserves the right to terminate this Contract by right, without notice or compensation, in case of damage to its image, reputation or interests, directly or indirectly caused by the Client.

The following constitute damage to WTTJ's image, without this list being exhaustive:

• The dissemination of defamatory or injurious statements against WTTJ or its representatives;
• Participation in illegal or unethical activities;
• Any public behavior or statements likely to negatively impact WTTJ's image or values.

The termination will take effect on the date of receipt by the Client of WTTJ's written notification noting the damage to its image and pronouncing the termination of the Contract.

Effects of termination: Upon expiration or termination of the Contract for any reason whatsoever, WTTJ will automatically cease to provide the Services.

In case of termination of the Contract by WTTJ for serious breach by the Client, all sums due by the Client will be immediately payable. In case of termination of the Contract by the Client for serious breach by WTTJ, WTTJ will reimburse the Client pro rata of the Price paid.

5. PRICE AND FINANCIAL CONDITIONS

Price: The Client agrees to pay the Price in the currency indicated in the Order Form(s). Prices are indicated excluding taxes. Any discount indicated in a Order Form is only applicable for the period specified in the Order Form and does not apply to Renewal Periods.

Unless otherwise stated in the Order Form, invoices are issued at the start of the Initial Period and on each anniversary date of the Contract and are payable within thirty (30) days from the invoicing date.

Non-payment: Any delay in payment by the client of more than thirty (30) days after the agreed deadline, and after reminder by email from WTTJ to the Client, will entail for WTTJ the right to suspend the provision of all or part of the Services with simultaneous information to the Client, without other notice or formality.

In case of late payment, WTTJ may apply to the Client a late penalty per day of delay at a rate equal to three (3) times the legal interest rate applicable in France as well as a collection fee compensation of forty (40) Euros.

Notification by WTTJ of the termination of the Contract for non-payment by the Client under the above conditions makes certain, liquid and payable the total amount owed by the Client to WTTJ.

Price Modification: WTTJ reserves the right to revise the price of Services at any time subject to notifying the Client with reasonable notice, and in any case, at least seventy-five (75) days before the end of the current contractual year. The revised price will only apply for the following Renewal Period (the Order Form will be deemed modified to reflect this price revision).

6. INTELLECTUAL PROPERTY

All Intellectual Property Elements are the property of WTTJ or its licensors.

Unless expressly mentioned herein, the Contract does not grant the Client any rights to these Intellectual Property Elements, nor any other rights concerning the Services.

The Client grants WTTJ, worldwide and for the Duration of the Contract, the right to use its corporate name, trade name, trademark and logo as a commercial reference on its promotional materials, provided that the Client does not expressly object by email.

7. RESPONSIBILITIES AND WARRANTIES

WTTJ's responsibilities and warranties: Subject to payment of the Price by the Client, WTTJ will provide the Services under the conditions provided for in the Contract.

In this perspective, WTTJ undertakes to make its best efforts to ensure accessibility and availability of WTTJ Solutions 24 hours a day and 7 days a week.

In case a malfunction or anomaly would hinder the proper functioning of WTTJ Solutions, WTTJ undertakes to perform the necessary operations as soon as possible and to keep the Client duly informed by any means.

The Client can consult the availability rates of the Services, in real time, at https://status.welcometothejungle.com/.

WTTJ may limit or suspend access to one or more Services in order to perform maintenance operations or to evolve its Services. In order to minimize the impact of these operations, WTTJ will endeavor to perform these operations between 11:30 PM and 8:30 AM (Paris time, France - Central European Time), except in case of absolute necessity.

However, the Client expressly acknowledges that these obligations do not cover failures or interruptions resulting from the internet network or arising from third parties, particularly telecommunications operators and/or companies hosting the Services, or resulting from acts of malice or force majeure.

WTTJ's total liability under the Contract may not exceed the total Price paid by the Client for the current contractual year. Under no circumstances will WTTJ be liable for indirect damages suffered by the Client (including, but not limited to, loss of data, revenue, margin, clientele, damage to image or reputation).

Client's responsibilities and warranties: The Client is responsible for using the Services under the conditions provided for in this Contract and undertakes not to allow any third party, other than Authorized Users, to access or use the Services.

The Client is responsible for Client Content and warrants that it: (i) does not infringe or violate any intellectual property right or any other right of a third party, (ii) does not violate any law or regulation, (iii) is not fraudulent, misleading, or otherwise reprehensible, (iv) does not contravene the Recruitment Charter as well as the Acceptable Use Policy.

In case of breach of one or more of these obligations, WTTJ reserves the right to suspend the benefit of any part of its Services to the Client or to terminate this contract.

The Client remains responsible towards WTTJ and guarantees WTTJ against any action, claim, complaint of any nature relating to the Client's responsibilities and warranties under the Contract and will bear all costs relating to disputes, claims, complaints, proceedings or actions brought against WTTJ and/or to convictions that could be pronounced against WTTJ, and which are linked to said responsibilities and/or warranties.

8. PERSONAL DATA

In the context of providing the Services, WTTJ is likely to process certain Client Content that is considered personal data within the meaning of the GDPR. In this case, the parties agree to comply with the terms of Annex 2 - "Data Processing Agreement - DPA".

9. FORCE MAJEURE  

Neither Party will be liable to the other in case of failure to perform or any suspension of performance of the obligations incumbent upon it under the Contract if this failure or suspension results or flows in any way from a force majeure event within the meaning of article 1218 of the Civil Code and the jurisprudence of the Court of Cassation.

Provided, however, that: (1) the Party wishing to invoke such a case of force majeure to justify a failure to perform or a suspension informs the other Party without delay in writing, indicating its foreseeable duration and the period during which a suspension of performance is requested, (2) the Parties will consult in good faith to consider modifying the conditions of the Contract to take into account this suspension and other (possible) modifications desired by any of them as a result, and (3) if the Parties do not reach an agreement in this context after a period of sixty (60) calendar days, either Party will be entitled to terminate the Contract subject to informing the other in writing by registered letter with acknowledgment of receipt. In case of termination for a force majeure cause, no liability will be incurred by one Party towards the other.

Force majeure may not, however, be invoked by the Client to contest its obligation to pay the Price

10. CONFIDENTIALITY

Each Party undertakes to treat as confidential and not to disclose to third parties to the Contract all information communicated to it in the context of the Contract or necessary for the performance of the Services, excluding Client Content, including information relating to the Price appearing on the Order Form(s), trade secrets and industrial, commercial or financial specifications, for the entire duration of the Contract as well as for a period of two (2) years from its expiration or termination for any reason.

In the event that one of the Parties would be forced to reveal to a third party the existence of the Contract or its content, or confidential information communicated in the context of its performance, it should imperatively and beforehand inform the other Party as soon as possible by any means (except if it is a request from a tax administration, an auditor or an accountant).

11. MISCELLANEOUS

Notification: Unless otherwise stated in this Contract, notifications must be addressed:

• To the Client: by email, to the administrator's address as identified in WTTJ Solutions and/or by email to WTTJ's commercial contact.
• To WTTJ: by email, to contact@wttj.co.

Contract Assignment: WTTJ Services are provided to the Client in consideration of their person and needs and cannot be transferred or assigned without WTTJ's prior agreement.

Entire Agreement: The Contract constitutes the entire agreement between the Parties and replaces the negotiations, declarations and agreements that may have existed between the Parties.

Non-waiver: If one of the Parties does not require the application of one of the stipulations of the Contract, this cannot be considered as a waiver by said Party of its rights under said stipulations.

Severability: If a provision of this Contract is, for any reason, deemed invalid or inapplicable, the other provisions will remain fully in force without being altered or invalidated in any way. The Parties agree to replace any invalid provision with a valid provision that most closely approximates the intention and economic effect of the invalid provision.

Applicable Law and Jurisdiction: The Contract is governed by French law. In the absence of amicable resolution, the Parties agree to submit any dispute or contestation relating to the Contract, whatever the legal basis, to the exclusive jurisdiction of the Commercial Court of Paris.

Annex 1 - Specific Conditions for Certain Services 

1. Company Profile - Production of Creations

1.1 SERVICE DESCRIPTION

The production of Creations by WTTJ consists of filming and taking shots and/or one or more shoots with a view to WTTJ producing the Creations necessary for putting the Company Profile online, under the conditions specified in the Order Form(s).

1.2 FILMING

From the signature of an Order Form, and within a maximum period of five (5) working days after signing, WTTJ will contact the Client by any means to plan, by mutual agreement with the latter, the organization of filming, and in particular to determine the filming date. Once the filming date is set, the Client has the right to request postponement of this date, limited to once per year and provided that it informs WTTJ by email at least ten (10) working days before the initially planned date. Nevertheless, given the specificity of "Culture +" video filming, the Client has, for these, the right to request postponement of the initially planned date, once per year and provided that it informs WTTJ by email at least one (1) month before the initially planned date.

Any filming postponement request not respecting the above conditions will result in payment by the Client of compensation in the lump sum amount of five hundred and fifty (550) euros excluding tax corresponding to expenses incurred due to the postponed filming. In such a case, filming will be rescheduled jointly between the Parties.

Any "Culture +" video filming postponement request not respecting the above conditions will result in payment by the Client of compensation in the lump sum amount of two thousand five hundred (2500) euros excluding tax corresponding to expenses incurred due to the postponed filming. In such a case, filming will be rescheduled jointly between the Parties.
If for reasons beyond its control, WTTJ is forced to postpone filming, WTTJ undertakes to immediately inform the Client and to propose a new filming date within forty-eight (48) hours.

1.3 CREATIONS

The Client undertakes to provide WTTJ by email, or by any other means made available by WTTJ, and within at least ten (10) days before the filming date, all information and Client Content requested by WTTJ and necessary for filming.

WTTJ undertakes to provide the Client with the Creations within ten (10) working days following the filming day.

Unless otherwise stated in the Order Form, the Client only has the right to request retouching of the Creations in case of technical defects present on them (e.g. defect in sound recording). Any other retouching request must be accepted by WTTJ and may result in additional fees.

Once validated for online publication on the Company Profile, the Client will only have access to the final versions of the Creations and may not request any subsequent modification from WTTJ on the final versions of the Creations delivered by WTTJ.

1.4 CREATION UPDATES

The Client will be entitled to one Creation update for each contractual year, under the same conditions, by making a written request to WTTJ. This request must be made at most eight (8) months after the start of the current contractual year and the Client must allow filming to take place within the month following their request.

1.5 IMAGE RIGHTS

The Client declares and warrants that it has obtained and will maintain during the Contract Duration all rights of Participants to appear in the Creations and in particular, on the Company Profile.

1.6 COMPANY PROFILE ONLINE PUBLICATION

The Client undertakes to act in good faith and to assist WTTJ by providing all necessary information, in due time, to enable publication of the Company Profile.

1.7 USE OF CREATIONS

License: Subject to full payment of the Price, WTTJ grants the Client a personal, limited and non-transferable license to use the final version of the Creations, subject to the stipulations below and the author's moral right.

This license is granted by WTTJ to the Client, from the publication of the Company Profile for the world and for the duration of the Contract, subject to the rights obtained by the Client from the Participants.

This license includes only the right for the Client to reproduce and represent the Creations for promotional purposes on the Internet (including purchase of advertising space and social networks), for the purpose of promoting its employer brand and Job Offers. The Client is not authorized to make modifications or adaptations to the Creations or to remove the associated "Welcome to the Jungle" brand and/or logo.

The Client retains the possibility of notifying WTTJ of its intention to acquire rights not assigned under this clause on the Creations.

WTTJ Warranties: WTTJ warrants that it:

• is the owner or holder of exploitation rights attached to the Creations and that it has full powers and qualifications to conclude this license or assignment; and
• will not grant any license or assignment to a third party on the Creations created for the Client and that it will only distribute the Creations within the framework of providing the Services.

Client Warranties: The Client acknowledges and declares that it will be solely responsible for compliance with the obligations incumbent upon it under its own distribution of the Creations, particularly the author's moral right. It is specified that in case of promotion of the Creations with purchase of advertising space, the Client will handle authorizations for broadcasting music possibly contained in the Creations. The Client guarantees WTTJ against any request, action or procedure initiated by a third party in this regard. The Client will particularly handle any authorization possibly required from Participants concerning their personality attributes and/or their personal data.

Any exploitation by the Client of the Creations not provided for by, or in contradiction with, these terms is strictly prohibited and will constitute counterfeiting.

1.8 CREATION CONSERVATION

The Client has a period of twelve (12) months from filming to request WTTJ to send the Creations. After this period, WTTJ has no obligation to preserve the Creations.

2. Welcome to the Jungle Solutions ATS

2.1 FUNCTIONALITY DESCRIPTION

By subscribing to WTTJ Solutions, the Client benefits from access to Welcome to the Jungle Solutions ATS which offers the Client:

• a management and distribution service for Job Offers on its Company Profile within the limits of its subscription as specified in the Order Form;
• a service dedicated to managing applications received for a Job Offer proposed by the Client (storage, evaluation, integrated electronic messaging) and management and classification of application history; and
• the creation of a so-called "careers site" dedicated to the Client as specified in the Order Form.

Any distribution of Job Offers exceeding the annual limit specified in the Order Form will constitute a serious breach by the Client.

2.2 CLIENT OBLIGATIONS

The Client undertakes to (i) only communicate Job Offers that conform to reality, are honest and loyal (ii) not publish Job Offers on behalf of third parties.

In addition, the Client expressly guarantees the legality, truthfulness and reality of information contained in Job Offers (position to fill, profile sought, information concerning the Client, etc.) and the processing of applications in compliance with all applicable regulations regarding labor law and personal data protection.

In case of breach of one or more of these obligations, WTTJ reserves the right to suspend the Client's access to Welcome to the Jungle Solutions ATS.

The Client undertakes to read the Recruitment Charter available on the Website and will endeavor to act in accordance with it.

WTTJ undertakes to inform the Client of any complaint or claim, initiated by a third party, due to the content of a Job Offer, and addressed to WTTJ. The Client undertakes to handle the complaint or claim as soon as possible.

Without prejudice to the foregoing, WTTJ reserves the right to remove any manifestly illegal Job Offer.

2.3 DATA RECOVERY

The Client may recover data contained in Welcome to the Jungle Solution ATS. WTTJ may assist the Client to recover said data, after validation by the latter of a complementary Order Form.

3. Job booster 

3.1 FUNCTIONALITY DESCRIPTION

In case of express mention on the Order Form, the Client will have the possibility to promote one or more Job Offers via the "Job booster" functionality on the Website. This functionality allows the Client to promote Job Offers through dedicated slots (the "Boosts") that will guarantee improved placement of the Job Offer on certain pages of the Website. These Boosts may be activated at any time during the current contractual year, for a period of thirty (30) consecutive days after which they expire. Any Boost not used during the current contractual year will be lost for the following year.
WTTJ will determine the placement and positioning of Job Offers promoted by the Client on the Website.

3.2 WARRANTY LIMITATION

WTTJ does not guarantee any results from using the Job booster functionality and in particular: (i) on the volume of applications, (ii) on the fact that candidates will meet hiring criteria or (iii), on the volume of hires that will result.

4. Featured

4.1 FUNCTIONALITY DESCRIPTION

In case of express mention on the Order Form, the Client will have the possibility to publish articles and content themselves, particularly to promote their news and events, through a dedicated tab on their Company Profile (the "Featured" tab). The Client is responsible for creating and publishing this content.

4.2. PROHIBITED USES

The Client undertakes not to authorize a third party or any Authorized User to use the Featured tab, for, without this list being exhaustive:

• publishing false, erroneous or misleading content;
• publishing content that infringes third parties' intellectual property rights;
• publishing discriminatory, racist, xenophobic, anti-Semitic, homophobic, pornographic, child pornographic content or otherwise offensive to human dignity;
• publishing offensive, defamatory content or infringing privacy, image or personality rights of third parties, contrary to public order, law or good morals;
• publishing commercial or advertising information without WTTJ's prior written authorization, except for information relating to promoting the Client's employer brand;
• publishing hyperlinks on the Website referring to sites whose content would be contrary to one of these rules.

In case of violation of one of the above rules, WTTJ reserves the right to remove any content from the Company Profile, without prejudice to its right to suspend the Client's access to all or part of the Services.

4.3 CLIENT WARRANTIES

The Client declares that it has all necessary rights, licenses and authorizations for articles and any content published on the Featured tab.

In case of complaint or claim initiated by a third party and which would be addressed to WTTJ, due to information, data or content of any nature from the Client and published on the Featured tab, the Client must immediately provide WTTJ with all explanations and evidence requested by WTTJ. WTTJ may remove the disputed content.

In any case, the Client remains responsible, both towards WTTJ and third parties whose rights the Client may have infringed, for any damage as well as consequences of its acts with regard to applicable legal or regulatory provisions.

5. Sourcing 

5.1  ACCESS TO FUNCTIONALITY

In case of express mention on the Order Form materializing subscription to the sourcing service, the Client will benefit from access license(s) to functionalities allowing it particularly to view candidate CVs (the "Sourcing"). The Client undertakes to respect the number of licenses provided for in the Order Form. Licenses are individual.

5.2 CLIENT OBLIGATIONS

In the context of using Sourcing, the Client undertakes to:

• preserve the confidentiality of information relating to candidates and particularly those contained in CVs. The client is prohibited from using this information for purposes other than recruitment and is prohibited from communicating this information to third parties. The Client acknowledges that information concerning candidates' openness to new professional opportunities is strictly confidential and undertakes not to disclose it to third parties, in any form whatsoever, without the prior written agreement of the candidate concerned;
• not extract candidate data or make use of it in any way without having obtained prior consent from the latter via the dedicated functionality;
• not contact candidates for purposes other than those related to recruitment for the job offer for which they agreed to be contacted;
• generally, respect the recruitment charter;
• not use automated means to retrieve, extract, access, modify, download, query or collect information from the Website, except in cases where this is strictly authorized by WTTJ.

In case of non-compliance with these obligations, WTTJ reserves the right to suspend or remove the Client's access to the Services.

5.3 PERSONAL DATA

The Parties acknowledge and agree that they will act as separate and independent data controllers regarding personal data they process for the purpose of performing the Sourcing processing purpose.

As such, each Party undertakes to (i) comply with all applicable legal and regulatory provisions, particularly Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016 (hereinafter, the "GDPR"), (ii) implement and maintain technical and organizational measures to guarantee protection of personal data against any unauthorized or illegal access as well as against any breach, loss, unauthorized disclosure or accidental destruction, and (iii) alert the other Party if one of these hypotheses occurs, so that it can alert the concerned natural persons.

Annex 2 - Data Processing Agreement - DPA

PREAMBLE

This Data Processing Agreement (the "DPA") details the respective obligations of the Parties regarding Personal Data Processing implemented by Welcome to the Jungle on behalf of the Client within the framework of the Services.

The details of Processing operations for each of the Services appear in Sub-Annex 1 - "Details of Processing operations".

Only the stipulations of this document relating to Services actually subscribed by the Client within the Order Form are applicable to the Parties.

DEFINITIONS

The terms "personal data", "data processing", "purpose", "data subject", "processor", "data controller", and any other term relating to data protection have the meaning attributed to them by the GDPR, particularly as defined in article 4.

For the purposes of this DPA, certain additional terms specific to services and personal data processing are capitalized and have the meanings defined below. The definitions mentioned in the Contract also remain applicable to these terms.

"DPA" means this Data Processing Agreement (and its Sub-Annexes), concluded between WTTJ and the Client.

"Personal Data Regulation" means the applicable regulation regarding Personal Data Processing and, particularly, regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016 ("GDPR"), as well as law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms, in its amended version;

"Data Controller" means the Client insofar as it determines the Purposes and means of Processing operations performed on Personal Data within the framework of its use of Services under the conditions provided for in this DPA;

"Processor" means WTTJ, when it processes Personal Data on behalf of and on instructions from the Client under the conditions provided for in this DPA.

"Sub-processor" means any subsequent processor engaged by the Processor to conduct certain Processing activities.1. DESCRIPTION DES TRAITEMENTS FAISANT L’OBJET DE LA SOUS-TRAITANCE

1. DESCRIPTION OF PROCESSING

The Processor is authorized to process on behalf of the Data Controller the Personal Data necessary for providing the Services subject to the Contract.

The nature of Processing operations implemented within the framework of this DPA, their legal basis, their Purpose(s), the Personal Data subject to Processing operations, the categories of Data Subjects, the duration and location of Processing, are described in Sub-Annex 1 - "Details of Processing operations".

2. DPA DURATION

This DPA comes into effect upon signature of the Order Form by the Client and remains in effect for the duration of the Contract.

3. DATA CONTROLLER OBLIGATIONS

The Data Controller acknowledges and warrants:

1. providing the Processor with Personal Data necessary for providing Services, in compliance with Personal Data Regulation;
   
   
2. documenting in writing any instruction concerning Personal Data Processing operations entrusted to the Processor under this DPA;
   
   
3. that all its instructions relating to Processing operations are given in compliance with Personal Data Regulation provisions and that any Data Subject has been informed of the Purpose of said Processing operations, their rights and recipients of Personal Data;
   
   
4. that it will respond, within the timeframes provided by Personal Data Regulation, to requests for exercising rights by any Data Subject concerning Processing operations entrusted to the Processor;
   
   
5. ensuring, beforehand and during all Processing operations, compliance by the Processor with its obligations under Personal Data Regulation;
   
   
6. that it will not ask the Processor to process sensitive Personal Data as defined in Article 9 of the GDPR;
   
   
7. that it will respond, as soon as possible to requests from any competent supervisory authority, where applicable.

 

4. PROCESSOR OBLIGATIONS

The Processor undertakes to:

1. perform Personal Data Processing operations only on instructions from the Data Controller and for the sole Purposes identified in Sub-Annex 1 "Details of Processing operations";
   
   
2. if it considers that an instruction from the Data Controller constitutes a violation of Personal Data Regulation, immediately inform the Data Controller, the latter then acknowledging being solely responsible for changing said instruction to make it compliant and guaranteeing the Processor against any recourse in this regard;
   
   
3. guarantee confidentiality of Personal Data subject to Processing operations within the framework of this DPA;
   
   
4. ensure that persons authorized to perform Personal Data Processing operations under this DPA:
   - undertake to respect confidentiality or are subject to an appropriate legal confidentiality obligation; and
   - receive necessary training in Personal Data protection;
   
   
5. take into account, regarding its tools, products, applications or services, the principles of Personal Data protection by design and Personal Data protection by default;
   
   
   
6. implement and maintain precise documentation outlining technical and organizational protection and confidentiality measures surrounding Personal Data as well as their access;
   
   
7. inform its employees of their responsibility concerning Personal Data protection, particularly regarding confidentiality of this data;
   
   
8. in case of possible legal, administrative or judicial prohibition that could prevent it from performing Processing operations, the Processor will inform the Data Controller and may then terminate the Contract, without the Data Controller being able to question the Processor's responsibility or request damages;
   
   
9. cooperate with any competent supervisory authority in case of information request from it and comply with any CNIL recommendation relating to Processing operations.
   
   
10. Sub-processing
    The Processor is authorized by the Data Controller to use Sub-processors to conduct certain specific Processing operations. The Sub-processors used by the Processor are described in Sub-Annex 2 - "Sub-processing".
    
    The Processor informs the Data Controller beforehand and in writing of any planned change regarding addition or replacement of other Sub-processors. This information must clearly indicate the sub-contracted Processing operations, the identity and contact details of the Sub-processor, any Personal Data transfers outside the European Union and appropriate means adopted by the Processor to frame such transfers.
    
    The Data Controller has a period of fifteen (15) calendar days from the date of sending this information to present its objections. Sub-processing can only be performed if the Data Controller has not issued a written objection during this period.
    
    In case of duly justified objection in writing and sent within the time limit by registered letter with acknowledgment of receipt by the Data Controller concerning the choice of a new Sub-processor, the Processor will take into account the Data Controller's remarks either:
    - by asking the Sub-processor to comply with reasonable requests from the Data Controller;
    - by proposing a new Sub-processor to the Data Controller, in which case the Data Controller will have fifteen (15) calendar days to formulate a new written objection if necessary;
    - by offering the Data Controller the possibility to terminate the Contract, without the Data Controller being able to question the Processor's responsibility or request damages.
    
    The Sub-processor is required to respect the obligations of this Sub-processing Contract on behalf of and according to instructions from the Data Controller. It is the Processor's responsibility to ensure that any Sub-processor presents sufficient guarantees regarding implementation of appropriate technical and organizational measures so that sub-contracted Processing operations meet GDPR requirements.
    
    The Processor remains fully responsible to the Data Controller for performance by any Sub-processor of its obligations under sub-contracted Personal Data Processing operations.
    
    
11. Personal data transfers
    Any transfer of Personal Data to a third country to the European Union or an international organization by the Processor is only performed based on documented instructions from the Data Controller or to satisfy a specific requirement of European Union law or member state law to which the Processor is subject and is performed in compliance with chapter V of the GDPR or regulation (EU) 2018/1725.
    
    The Data Controller agrees that when the Processor recruits a Sub-processor in accordance with Article 10 and the concerned processing activities involve a transfer of Personal Data outside the European Union, the Processor and concerned Sub-processor will guarantee compliance with chapter V of the GDPR, prior to implementing the concerned Processing operations, either:
    - by verifying that the destination country for Personal Data benefits from an adequacy decision from the European Commission; or
    - by providing appropriate guarantees framing said transfer through signature of standard contractual clauses issued by the European Commission (including any updates to them), provided that the conditions for using said standard contractual clauses are met.
    
    
12. Data subject information rights
    

    It is the Data Controller's responsibility to provide information to Data Subjects concerned by Processing operations at the time of Personal Data collection.

13. Exercise of data subject rights
    

    To the extent possible, the Processor assists the Data Controller in fulfilling its obligation to respond to requests for exercising Data Subject rights: right of access, portability, rectification, erasure and objection, right to processing limitation, right to data portability, right not to be subject to individual automated decision-making (including profiling).

    When Data Subjects exercise directly with the Processor requests for exercising their rights on their Personal Data subject to Processing, the Processor addresses these requests without delay by email to a Data Controller contact point.

14. Personal data breach notification
    

    The Processor notifies the Data Controller of any Personal Data Breach as soon as possible and, at the latest, forty-eight (48) hours after becoming aware of it. This notification is accompanied by any useful documentation to allow the Data Controller, if necessary, to notify this Personal Data Breach to the competent supervisory authority and, where applicable, to Data Subjects.

    The Processor will inform the Data Controller of identified causes of this Personal Data Breach and take all measures that seem necessary and reasonable to remedy the origin of this Personal Data Breach when this repair is under the Processor's control.

15. Processor assistance in data controller compliance
    The Processor may reasonably assist the Data Controller for:
    - conducting data protection impact assessments, and
    - conducting prior consultation with the supervisory authority.
    
    

    These requests must be reasonable regarding the pursued objective, both in terms of human and financial cost they may represent for the Processor, and may be subject to a complementary quote where applicable.

16. Security measures
    The Processor undertakes to implement the technical and organizational measures outlined in Annex 3 - "Security measures" to guarantee an appropriate level of security for Personal Data Processing.
    
    The Processor must at all times have technical and organizational measures to prevent unauthorized access to Personal Data and use of Personal Data for Purposes other than those agreed between the Parties.
    
    The Processor declares and warrants that security measures taken are in no case inferior to those required by Personal Data Regulation or those that a person exercising the same activity as the Processor would have reasonably taken for protecting Personal Data against unauthorized access or use.
    
    In cases where the Processor has obtained prior authorization from the Data Controller for transmitting Personal Data to a third party, the Processor must again take appropriate security measures allowing secure transmission of Personal Data.
    
    
17. Personal data fate
    At the end of service provision relating to Personal Data Processing, the Processor undertakes to destroy or anonymize all Personal Data processed on behalf of the Data Controller.
    
    The Data Controller may ask the Processor to retain certain Personal Data, particularly photos and videos, to be able to reactivate its Company Profile in the event of subscribing to a new subscription, within a maximum period of 2 years.
    
    The Processor may, where applicable and before the destruction or anonymization provided above, assist the Data Controller so that the latter can recover certain Personal Data in a particular format, after validation by the latter of a quote detailing the price of such service.
    
    
18. Record of processing activities
    The Processor declares to keep in writing a record of processing activities including details of Processing performed on behalf of the Data Controller and including:
    
    - the name and contact details of the Data Controller on whose behalf it acts, any Sub-processors and, where applicable, the DPO of each of the Parties;
    
    - categories of Processing operations performed on behalf of the Data Controller;
    where applicable, Personal Data transfers to a third country or international organization, including identification of this third country or international organization and documents attesting to the existence of appropriate guarantees for framing said transfer;
    
    - to the extent possible, a general description of technical and organizational security measures, including among others, according to needs:
    > pseudonymization and encryption of Personal Data;
    > means to guarantee constant confidentiality, integrity, availability and resilience of Processing systems and services; 
    > means to restore availability of Personal Data and access to it within appropriate timeframes in case of physical or technical incident;
    > a procedure to regularly test, analyze and evaluate effectiveness of technical and organizational measures to ensure Processing security.
    
    
    
19. Documentation
    The Processor keeps at the Data Controller's disposal the documentation necessary to demonstrate compliance with all its obligations and to allow audits (maximum one (1) audit per year), including inspections, by the Data Controller or another auditor it has mandated at its sole expense, and contribute to these audits.
    
    To be admissible, any audit request must be addressed to the Client with notice sent by registered letter with acknowledgment of receipt of at least forty-five (45) calendar days before the provisional audit date. Any audit that would mobilize the Processor for a duration exceeding one (1) man-day per year will be subject to additional billing.
    
    

5. DATA PROTECTION OFFICER

• The Processor has designated, in accordance with Article 37 of the GDPR, a DPO reachable at privacy@wttj.co.
• In case the Data Controller has also designated a DPO, the Data Controller will communicate the contact details of the latter to the Processor upon first request.

6. LIABILITY

Any limitation of liability applicable under the Contract also applies to this DPA, without prejudice to individual liability that the Data Controller or Processor could incur towards any Data Subject or competent supervisory authority, particularly under Article 82 of the GDPR.

7. APPLICABLE LAW

By express agreement between the Parties, this Annex is subject to French law, excluding any other legislation.

8. DISPUTE RESOLUTION

In the absence of amicable resolution, the Parties undertake to submit any dispute or contestation relating to the validity, interpretation, execution and/or breach of this DPA to the exclusive jurisdiction of the Courts of the Paris Court of Appeal jurisdiction.

Sub-annex 1: Details of Processing Operations  

Within the framework of the signed Contract and DPA, WTTJ acts as Processor following Client instructions for processing operations applicable to Services actually subscribed by the Client and as indicated within the Order Form.

Sub-annex 2: List of Sub-processors

Annex 3 - Security Measures

Security measures for Personal Data that the Processor must take within the framework of Processing operations include, non-exhaustively, the following measures:

• all Processor personnel must be trained and regularly informed of developments in security and Personal Data protection;
• to protect Personal Data confidentiality, the Processor must include, within employment contracts signed by personnel members having access to Personal Data, a clause requiring these personnel members to acknowledge their duty to protect confidentiality of all Personal Data they access under the Sub-processing Contract;
• only authorized personnel members may have access to Personal Data, provided this access is necessary. Prevention measures for Personal Data access by unauthorized persons must be implemented;
• a Personal Data access method must be developed, and adequate authorization level must be required;
• Any access to Personal Data must be protected by an authentication system allowing identification and an access log must be maintained. The Processor must implement a password policy adapted to Personal Data access. When technically possible, MFA and/or SSO are mandatory.
• any electronic media and software on which Personal Data is stored must be regularly updated and protected against malware and unauthorized access, using protective software (such as antivirus) and advanced security policy (bug bounty for example);
• Personal Data must not be stored within environments (such as Internet) accessible to third parties and which are not subject to Processor authorization;
• adequate security measures (e.g. firewalls etc.) must be implemented at the interface between environments accessible to third parties and company storage areas, as well as measures to fight virtual attacks threatening Personal Data security;
  
  
• Personal Data transmission must always be performed through encrypted communication services;
• the environment (servers, Personal Data storage systems, etc.) for storing Personal Data on behalf of the Data Controller must be physically protected and access to it must be controlled and limited to authorized personnel members only;
• Personal Data is deleted using adequate methods. Deletion of Personal Data stored in an electronic environment must make any Personal Data recovery impossible. Personal Data subject to physical storage (documents etc.) are destroyed using adequate methods or equipment (shredder etc.).