Parties and background
This Data Processing Agreement (DPA) forms part of the Agreement between Wollemia Pty Ltd (ABN 35 692 226 323, ACN 692 226 323), trading as Cavuno, of 22 Crown Street, St Peters NSW 2044, Australia (Cavuno, we, us) and the customer that accepts the Agreement (Customer, you). It takes effect on the later of 14 October 2026 and the date the Customer accepts the Agreement (Effective Date).
Background
A. Cavuno provides a platform for creating and operating job boards under the Cavuno Terms of Service at cavuno.com/terms-of-service (the Agreement).
B. In providing that platform, Cavuno processes personal data on the Customer's behalf. Article 28 of the EU GDPR and the UK GDPR require that processing to be governed by a written contract.
C. Cavuno is established in Australia and uses Subprocessors in other countries, including the United States. Transfers of personal data from the EEA, Switzerland or the UK to Cavuno are therefore Restricted Transfers that require appropriate safeguards.
D. A Customer may also sign this DPA under clause 14.6. The signed version then applies to that Customer.
E. Cavuno may itself be subject to the GDPR under Article 3(2). The European Commission has said that the SCCs are not designed for importers in that position and that it is preparing clauses for them. Until those clauses are adopted, the parties use the SCCs together with this DPA as the transfer safeguard, and Cavuno will offer to adopt the new clauses within 60 days of their adoption.
Terms
1. Definitions
Applicable Data Protection Law means, to the extent it applies to the processing: the EU GDPR; the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; and the Australian Privacy Act 1988 (Cth).
Customer Personal Data means personal data Cavuno processes on the Customer's behalf in providing the Services, as described in Annex I.
EU GDPR means Regulation (EU) 2016/679. UK GDPR has the meaning in section 3 of the Data Protection Act 2018. GDPR means the EU GDPR or the UK GDPR, as applicable.
SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022).
Restricted Transfer means a transfer of Customer Personal Data from the EEA, Switzerland or the UK to a country that does not have an adequacy decision or regulations covering that transfer.
Services means the Cavuno platform and related services provided under the Agreement, including the AI website builder (the Builder), which creates and edits job board sites with AI.
Subprocessor means a third party Cavuno engages to process Customer Personal Data.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings in the EU GDPR or UK GDPR, as applicable.
2. Roles of the parties
2.1 For Customer Personal Data, the Customer is the controller and Cavuno is the processor. Where the Customer itself acts as a processor for another controller, Cavuno is its subprocessor and the Customer will pass on any instructions from that controller.
2.2 Cavuno is an independent controller of the personal data it collects to run its own relationship with the Customer: account sign-up and log-in details of the Customer's users, the Customer's subscription billing, support correspondence, security logs and product usage analytics. Cavuno processes that data under its Privacy Policy at cavuno.com/privacy-policy, not as the Customer's processor.
2.3 Where the Customer connects its own Stripe account to take payments from employers, Stripe processes that payment data under its own agreement with the Customer. Cavuno stores only the references it needs to show order and billing status, and those references are Customer Personal Data.
2.4 Cavuno may create and use aggregated, de-identified data that does not identify the Customer or any individual.
3. Processing on instructions
3.1 Cavuno will process Customer Personal Data only on the Customer's documented instructions, including about Restricted Transfers, unless Union or Member State law (or, for UK personal data, UK law) to which Cavuno is subject requires otherwise. In that case Cavuno will tell the Customer about that legal requirement before processing, unless that law prohibits it.
3.2 The Customer's instructions are this DPA, the Agreement, the Customer's configuration and use of the Services (for example, which features it turns on and which webhook endpoints and integrations it connects), and any further written instructions agreed between the parties.
3.3 Cavuno will immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
3.4 The Customer is responsible for having a lawful basis for the processing, for giving data subjects the required notices (including on its job board's privacy policy), and for the lawfulness of its instructions.
3.5 The Customer will not configure the Services (for example, through custom profile or application fields) to collect special category data or data about criminal convictions without Cavuno's prior written agreement.
3.6 Webhook endpoints, integrations, scripts and code that the Customer adds or instructs through the AI website builder, and the recipients of data sent through them, are the Customer's responsibility and are not Subprocessors.
3.7 Cavuno may suspend processing under an instruction it reasonably considers unlawful until the Customer confirms or changes it.
4. Confidentiality
Cavuno will ensure that anyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality, whether contractual or statutory, and has access only to the extent needed to provide, support or secure the Services.
5. Security
5.1 Cavuno will implement and maintain the technical and organizational measures in Annex II, which are designed to give a level of security appropriate to the risk, as required by Article 32 GDPR.
5.2 Cavuno may update those measures as technology changes, provided the update does not materially lower the overall level of protection.
6. Subprocessors
6.1 The Customer gives Cavuno general written authorization to engage Subprocessors. The Subprocessors in Annex III are approved at the Effective Date.
6.2 Cavuno will notify the Customer by email to its account owners and the contact in Annex I.A at least 7 days before adding or replacing a Subprocessor, stating the Subprocessor's name, the processing it will perform and its location. Cavuno will also update cavuno.com/subprocessors. If a Subprocessor must be replaced urgently for security, service continuity or legal reasons, Cavuno may make the replacement with shorter notice; it will notify the Customer as soon as practicable, and the objection period in clause 6.3 runs from that notice.
6.3 The Customer may object on reasonable data protection grounds by email within that 7-day period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Services, and Cavuno will refund prepaid fees pro rata for the period after termination.
6.4 Except for restricted providers under clause 6.5, Cavuno will impose on each Subprocessor, by written contract, data protection obligations that are in substance those required by Article 28(3) GDPR and, for Restricted Transfers, Clause 9(b) of the SCCs, including sufficient guarantees on security. The Customer agrees that the Subprocessor terms described in Annex III meet this requirement. Cavuno remains liable to the Customer for each Subprocessor's performance of those obligations as required by Article 28(4) GDPR, subject to clause 13.
6.5 Restricted providers. The providers marked "restricted provider" in Annex III are not bound by SCCs with Cavuno: DeepSeek processes data in China, and Xiaomi MiMo processes data in Singapore and the Netherlands under its own processor terms. They are used only for the AI website builder and for enrichment and translation, and receive only: (a) instructions, files and images that the Customer's users give the AI website builder; (b) content published on the Customer's board, which may include job ads, company pages and any candidate profiles the board makes public; and (c) public company information and the names of job categories, skills and markets. Cavuno does not send them job applications, CVs, job alert subscriptions or non-public profile data. The Customer warrants that content it supplies to the AI website builder contains no personal data other than business contact details it has chosen to make public, and that it has a lawful basis for, and has given notice of, that processing. The Customer acknowledges that content published under (b) may include candidate profiles the board makes public. The Customer acknowledges that these providers are not bound by SCCs or by terms equivalent to this DPA, specifically authorizes their use for these purposes, and accepts the resulting transfer risk.
7. Data subject requests
7.1 Taking into account the nature of the processing, Cavuno will help the Customer respond to requests from data subjects to exercise their rights, mainly through the self-service tools in the Services (editing and deleting candidate, subscriber, employer and application records, and the CSV exports available in the Services). Where those tools do not cover a request, Cavuno will assist on request.
7.2 If Cavuno receives a request directly from a data subject about the Customer's job board, it will promptly pass it to the Customer and will not respond itself except to direct the person to the Customer, unless the Customer instructs otherwise or law requires it.
8. Personal Data Breaches
8.1 Cavuno will notify the Customer without undue delay after becoming aware of a Personal Data Breach.
8.2 The notice will describe, as far as then known: the nature of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Cavuno will provide further information in phases as it becomes available.
8.3 Cavuno will take reasonable steps to contain and remedy the breach and will cooperate with the Customer so it can meet its own notification duties. A notice under this clause is not an admission of fault.
9. Impact assessments and consultation
Cavuno will give the Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 GDPR, to the extent the Customer does not otherwise have access to the information needed.
10. Deletion and return
10.1 Before the Services end, the Customer can export its data using the self-service exports and may ask Cavuno to coordinate the return of data those exports do not cover, such as applications.
10.2 When the Services end, or on the Customer's written request, Cavuno will delete Customer Personal Data without undue delay. Deletion starts when the Customer deletes its account or job board, on the Customer's written request, or, if neither happens, within a reasonable period after the Agreement ends. On request, Cavuno will confirm in writing that its deletion process has completed for its primary systems; the copies listed in clause 10.3 are deleted as stated there.
10.3 Some copies are deleted on their own schedules rather than straight away: (a) encrypted database backups, which expire on the backup cycle and are restored only for disaster recovery; (b) logs and analytics events, which are deleted on the retention periods set for them (Cavuno's server access logs within 30 days); and (c) inputs that AI providers keep for abuse monitoring under their own terms. Cavuno also keeps a protected keyed identifier for each erased subscriber, so that the person is not subscribed again, and a record that deletion was completed, which it deletes after one year. Data that Union or Member State law (or, for UK personal data, UK law) requires Cavuno to keep is kept only for that purpose and period. Everything retained under this clause is used only for the purposes stated here and remains protected by this DPA.
11. Audits and information
11.1 Cavuno will make available all information reasonably necessary to show compliance with Article 28 GDPR and this DPA, including reasonable written answers to a security questionnaire on request.
11.2 If that information is not enough, or a supervisory authority requires it, Cavuno will allow and contribute to audits, including inspections, by the Customer or an independent auditor it appoints. The Customer will give at least 30 days' written notice, agree on the scope in advance, keep the results confidential and audit no more than once in any 12 months, except after a Personal Data Breach or at a supervisory authority's request. Each party bears its own costs, except that the Customer will pay Cavuno's reasonable costs for an on-site audit.
11.3 Audits under the SCCs are carried out under this clause, to the extent it is consistent with the SCCs.
12. International transfers
12.1 EEA transfers. For a Restricted Transfer subject to the EU GDPR, the SCCs are incorporated into this DPA: Module 2 where the Customer is a controller and Module 3 where it is a processor, with the Customer as data exporter and Cavuno as data importer. The elections in Annex IV apply and Annexes I to III complete the SCC appendix.
12.2 Swiss transfers. For transfers subject to Swiss law, the SCCs apply as amended in Annex IV.
12.3 UK transfers. For a Restricted Transfer subject to the UK GDPR, the UK Addendum is incorporated into this DPA, completed as set out in Annex IV.
12.4 Onward transfers. Cavuno will transfer Customer Personal Data to a Subprocessor outside the EEA, Switzerland or the UK only in accordance with Clause 8.8 of the SCCs, relying on an adequacy decision (including the EU-U.S. Data Privacy Framework for a certified Subprocessor), the SCCs in the form described in Annex III, or another valid mechanism. This clause does not apply to restricted providers under clause 6.5.
12.5 Government access. Cavuno warrants that, to the best of its knowledge at the Effective Date, it has not received any legally binding request from a public authority for access to Customer Personal Data and has no reason to believe that the laws applying to it prevent it from meeting its obligations under the SCCs. Cavuno will tell the Customer about any such request unless legally prohibited, challenge it where there are reasonable grounds, and disclose only the minimum required.
12.6 Cavuno will provide the Customer with the information it reasonably needs to complete its transfer impact assessment under Clause 14 of the SCCs.
13. Liability
To the maximum extent permitted by law, each party's aggregate liability arising out of or related to this DPA, including the SCCs and the UK Addendum, is limited to the amount specified in the Agreement and subject to its exclusions. This does not limit either party's liability to data subjects under the SCCs or Article 82 GDPR, or any liability that cannot be limited by law.
14. Term and general
14.1 This DPA lasts for as long as the Agreement is in force and afterwards for as long as Cavuno holds Customer Personal Data.
14.2 If there is a conflict, the following order applies: the SCCs and UK Addendum; this DPA; the Agreement.
14.3 This DPA is governed by the laws of New South Wales, Australia, except that the SCCs are governed by the law set out in Annex IV and the UK Addendum by the law it specifies.
14.4 Notices under this DPA may be given by email. Cavuno's address for notices is hi@cavuno.com. The Customer's is the contact in Annex I.
14.5 If any provision is invalid, the rest continues in force.
14.6 The Customer may sign this DPA electronically. When it does, Annex I.A is completed with the details the Customer gives, Cavuno's signature is applied, and the Effective Date is the date the Customer signs. Each party agrees that electronic signatures are valid and binding.
14.7 Cavuno may update this DPA by notice to reflect changes in law, replacement SCCs, or changes that do not materially reduce the protection of Customer Personal Data. Other changes need written agreement. A signed version of this DPA prevails over the online version, and a Customer with a signed version may adopt a later online version by accepting it. Cavuno's signature applies only to the unmodified version identified in the signed document.
Annex I — Parties and description of processing
A. List of parties
| Data exporter | Data importer | |
|---|---|---|
| Name | The Customer, as identified in its Cavuno account | Wollemia Pty Ltd (ABN 35 692 226 323), trading as Cavuno |
| Address | As in the Customer's account | 22 Crown Street, St Peters NSW 2044, Australia |
| Contact | The Customer's account owners, and anyone who signs this DPA for the Customer, who also receive Subprocessor notices | Abi Tyas Tunggal and Jack Walsh, Directors, hi@cavuno.com |
| Activities | Operates its job boards on the Services | Provides the Services |
| Role | Controller (or processor, where clause 2.1 applies) | Processor (or subprocessor) |
B. Description of processing and transfer
Categories of data subjects: job seekers and candidate profile holders; applicants; job alert and newsletter subscribers; employers and employer users, including job poster contacts; the Customer's own staff who use the Services; visitors to the job board.
Categories of personal data:
- Employer and job poster data: contact names, email addresses, phone numbers where collected, company and job details, order and billing status, employer account log-in details.
- Candidate profile data: name, email, hashed password, headline, biography, avatar, location, job search status, work authorization, social links, work history, education, skills, languages, uploaded CV and data extracted from it.
- Application data: name, email, headline, location, cover note, CV, application stage and history, employer notes.
- Subscriber data: email, optional name, alert preferences, consent records and suppression identifiers.
- Technical and usage data: IP address, user agent, session identifiers, page views and events, and the searches people run on the board.
Special categories: none intended. The Services do not ask for special category data by default (see clause 3.5), but candidates may include it in a CV or cover note on their own initiative. Those files are protected by the measures in Annex II.
Frequency: continuous, for as long as the Services are used.
Nature of processing: hosting, storage, retrieval, display, search and indexing (including AI embeddings of jobs and candidate profiles), AI parsing of CVs, location lookup, candidate recommendations, payments for paid features, email delivery, webhook delivery to endpoints the Customer configures, analytics, export and deletion.
Purpose: to provide the Services to the Customer under the Agreement.
Retention: for the term of the Agreement, then deleted under clause 10. Server access logs are deleted after 30 days, webhook payloads after 30 days, and export files 30 days after the export completes.
Transfers to Subprocessors: as listed in Annex III, for the purposes stated there and for the duration of the Services. Cavuno personnel access the data remotely, mainly from Australia and occasionally while traveling; this is Cavuno's own processing and remains subject to this DPA and the SCCs.
C. Competent supervisory authority
The supervisory authority of the EU Member State where the data exporter is established. For a data exporter with no EU establishment that is subject to Article 3(2) GDPR, the supervisory authority of the Member State where its Article 27 representative is established. For UK transfers, the Information Commissioner's Office.
Annex II — Technical and organizational measures
| Area | Measures |
|---|---|
| Encryption in transit | TLS 1.2 or higher on all pages, APIs and webhooks; HTTP redirected to HTTPS; HSTS with includeSubDomains on pages Cavuno serves (sites made with the Builder set their own headers); outbound webhooks HTTPS-only and signed (Standard Webhooks). |
| Encryption at rest | AES-256 on the primary database and its backups; provider-managed encryption on object and file storage. |
| Tenant isolation | Customer data is scoped by account in server functions. Private data requires an authenticated user with the right account membership and role. Content the Customer publishes on its board is publicly readable by design. |
| Access to the Services | Hashed passwords; multi-factor authentication available for dashboard users; HTTP-only, Secure, SameSite session cookies; CSRF protection; role-based permissions within each account; scoped API keys. |
| Access to production | Limited to authorized personnel on a least-privilege basis; SSO and MFA on provider consoles where available; administrative access only over an authenticated private network. |
| Personnel | Confidentiality obligations for everyone with access to production data. |
| Secure development | Strict TypeScript; schema validation of API and server inputs; separate development and production environments; code review before deployment; automated dependency and vulnerability scanning; signature checks on inbound webhooks; file type and size checks on uploads. |
| Availability and recovery | Daily encrypted database backups, kept for 7 days, including stored CVs; restores can be verified in a separate deployment before cut-over. |
| Logging and monitoring | Application and infrastructure logs held with logging providers; server access logs deleted after 30 days; security events reviewed under the incident process. |
| Incident response | Incident process: contain, investigate, remediate, notify (clause 8). |
| Payments | Card data goes directly to Stripe (PCI DSS Level 1) and never reaches Cavuno's servers. |
| Data minimization and deletion | Self-service deletion of records, accounts and job boards through a tracked, retried purge; export files and webhook payloads deleted after 30 days; candidates can choose not to keep the original CV after parsing. |
| Vulnerability disclosure | Vulnerability reports to hi@cavuno.com are acknowledged and assessed; the process is described at cavuno.com/security. |
Annex III — Authorized subprocessors
This list reflects an audit of Cavuno's code on 13 October 2026. "Job seeker data" shows whether the Subprocessor receives candidate profiles, CVs, applications, job alert subscriptions or job seekers' searches; "Published profiles only" means it can receive candidate profiles a board has made public, and no other job seeker data. Tools Cavuno uses only as controller, integrations and tags the Customer installs itself, and sign-in providers that job seekers choose are not Subprocessors. Each Subprocessor's own DPA, where one exists, was checked on 12 and 13 October 2026.
AI model providers are used for the Services' AI features, including site building, CV parsing, search, translation and enrichment.
| Subprocessor | Purpose | Processing location | Job seeker data | Transfer safeguard |
|---|---|---|---|---|
| Convex, Inc. | Primary database and private file storage: candidate profiles, applications and CVs, subscribers, board data, Builder source, support conversations | US (AWS) | Yes | SCCs Module 2 and UK Addendum, deemed executed with Convex's terms |
| Hetzner Online GmbH | Application hosting and background processing | United States; entity in Germany | Yes | Hetzner DPA v1.2, concluded 13 Oct 2026, which requires an Article 44 safeguard for Hetzner's US subprocessor; Hetzner states it uses SCCs with Hetzner US LLC |
| Cloudflare, Inc. | Network, CDN, storage and hosting | Global network; storage in US and EEA | Yes | DPF; SCCs Modules 2 and 3 as fallback, incorporated in self-serve terms |
| Stripe, LLC | Cavuno's own subscription billing. Checkout for employer job posts and paid candidate access runs on the Customer's own connected Stripe account (clause 2.3) | US | No (see clause 2.3) | SCCs Modules 1 to 3 (Data Transfers Addendum), incorporated in Stripe's terms |
| OpenAI | AI processing, including CV parsing | US | Yes | SCCs Modules 2 and 3 and UK Addendum, accepted on use |
| Google LLC | Cloud hosting and AI models | United States and other Google locations | Yes | DPF; SCCs in Google's processor terms (Gemini API on a billed project) |
| Voyage AI Innovations, Inc. | Search | US | Yes | SCCs and UK Addendum, deemed signed with Voyage's terms |
| Qdrant Solutions GmbH | Search | United States; entity in Germany | Yes | SCCs Modules 2 and 3 for any non-EEA processing |
| PostShiba by Bento (Backpack Internet Pty Ltd) | Email delivery | Australia, US, EU | Yes | SCCs and UK Addendum in Bento DPA, accepted with Bento's terms |
| Resend (Plus Five Five, Inc.) | Fallback email delivery | US | Only if used as the fallback, or in support replies | DPF; SCCs Modules 2 and 3 |
| Mapbox, Inc. | Location services | US | Yes | DPF; SCCs Modules 2 and 3, deemed signed |
| Tinybird, Inc. | Analytics | United States | Yes | SCCs Module 2, agreed in Tinybird's terms |
| Axiom, Inc. | Logging | US or EU | Yes | SCCs Module 2 and UK clauses, accepted on use |
| Better Stack | Logging and monitoring | EU, US | Yes | SCCs Modules 2 and 3, part of Better Stack's terms |
| Anthropic | AI models for board setup and imports | US | No | SCCs Modules 2 and 3, part of Anthropic's commercial terms |
| xAI (SpaceXAI LLC) | AI models for the website builder, including dictation | US | Published profiles only | SCCs Modules 2 and 3 and UK Addendum, part of Enterprise terms that govern API use |
| TypeSafe AI, Inc. | AI checks of imported job data | US | No | SCCs Modules 2 and 3 and UK Addendum, part of TypeSafe's terms |
| Exa Labs, Inc. | Web search for the website builder | US | No | SCCs Modules 2 and 3 and UK Addendum, part of Exa's terms |
| OpenRouter, Inc. | AI model routing for translation and enrichment | US, plus the model hosts' locations | No | SCCs Module 2 and UK Addendum, part of OpenRouter's terms |
| RunInfra (RightNow AI, Inc.) | AI model hosting for the website builder and translation | United States; files in Sweden | Published profiles only | SCCs Module 2 and UK Addendum, accepted on use |
| Alibaba Cloud (Singapore) Pte. Ltd. | AI models for the website builder | Singapore | Published profiles only | SCCs Modules 2 and 3 and UK Addendum, deemed entered with the Membership Agreement |
| Xiaomi Technologies Singapore Pte. Ltd. (MiMo) | AI models for the website builder, enrichment and translation | Singapore, Netherlands | Published profiles only (see clause 6.5) | Processor terms in MiMo service agreement, no SCCs; restricted provider |
| Hangzhou DeepSeek AI Co., Ltd. | AI models for the website builder and job post enrichment | China | Published profiles only (see clause 6.5) | None; restricted provider |
Annex IV — SCC elections and UK Addendum
EU SCCs
| SCC clause | Election |
|---|---|
| Module | Module 2 (controller to processor); Module 3 (processor to processor) where clause 2.1 applies |
| Clause 7 (docking) | Included |
| Clause 9(a) (subprocessors) | Option 2, general written authorization; at least 7 days' notice, as in clause 6 of this DPA, except urgent replacements under clause 6.2 |
| Clause 11(a) (redress) | Optional wording not included |
| Clause 13 (supervision) | As in Annex I.C |
| Clause 17 (governing law) | Option 1: the law of Ireland |
| Clause 18 (forum) | The courts of Ireland |
| Annexes I, II, III | Annexes I, II and III of this DPA |
Switzerland
For transfers subject to the Swiss Federal Act on Data Protection (FADP): references to the GDPR mean the FADP; the competent authority is the Federal Data Protection and Information Commissioner; and "Member State" does not exclude data subjects in Switzerland from suing in their place of habitual residence.
UK Addendum
| Table | Content |
|---|---|
| Table 1 (parties) | As in Annex I.A. Start date: the Effective Date |
| Table 2 (selected SCCs) | The Approved EU SCCs incorporated by clause 12.1, with the modules and elections above |
| Table 3 (appendix information) | Annexes I, II and III of this DPA |
| Table 4 (ending the Addendum) | Neither party |
The UK Addendum's mandatory clauses (Part 2) apply as issued by the Information Commissioner.
The Customer accepts this DPA, including the SCCs and the UK Addendum incorporated into it, by accepting the Agreement.