Who is responsible for the data stored in the employee referral program?

When using the employee referral program, the customer acts as the "data controller" in terms of §4 GDPR, the employee referral program acts as the "data processor". Thus, the customer is responsible for all content and data, the program acts exclusively on the instructions of the customer. Therefore, the program can only offer non-binding templates for data protection texts such as the data protection notice, which must be adapted and finalized by the customer. All aspects of order processing are regulated in a separate "Data Processing Agreement".