Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the agreement between the customer named in the signature block ("Customer", the controller) and HireAgent (the processor) for the HireAgent recruiting service. It applies to personal data about candidates, contacts and the Customer's users that HireAgent processes on the Customer's behalf.

2. Instructions

HireAgent processes Customer personal data only on the Customer's documented instructions, which are the agreement, this DPA and the Customer's use of the service: opening roles, adding candidates, running screening and ranking, sending the outreach the Customer approves or switches on, and scheduling interviews. HireAgent informs the Customer if an instruction appears to break applicable data protection law.

3. Nature, purpose and duration

Subject matter: recruiting support. Categories of data subjects: candidates, people who apply through a job link, the Customer's users. Categories of data: names, contact details, CV content, work history, screening results, messages and interview times. No special category data is required by the service, and the Customer does not upload it on purpose. Duration: the term of the subscription plus the deletion period in section 9.

4. Confidentiality

Everyone at HireAgent who can access Customer personal data is bound by confidentiality and accesses it only as needed to run and support the service.

5. Security

HireAgent keeps technical and organisational measures appropriate to the risk, including encryption in transit, encrypted secrets at rest, private workspace links that can be rotated, single sign-on on Scale and Enterprise, seat removal that ends access at once, and an append-only audit log of what was applied to each candidate and when.

6. Sub-processors

The Customer authorises HireAgent to use sub-processors in these categories: hosting and infrastructure, transactional email delivery, payment processing, and AI model providers used for screening and drafting. Each is bound by written terms that protect the data at least as well as this DPA. HireAgent gives at least 30 days notice by email before adding a sub-processor in a new category, and the Customer may object in that time.

7. International transfers

Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor) or another lawful mechanism, which are incorporated into this DPA by reference.

8. Assistance and data subject requests

HireAgent helps the Customer answer requests from data subjects (access, correction, deletion, objection) and with impact assessments, taking into account the nature of the processing. Inside the workspace the Customer can export candidates and the audit log and remove candidates directly.

9. Breach notification, deletion and audits

HireAgent notifies the Customer without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting Customer data. When the subscription ends, HireAgent deletes Customer personal data within 90 days, unless law requires keeping it. HireAgent makes available the information needed to show compliance with this DPA and answers reasonable audit questionnaires once a year.

10. Order of precedence

If this DPA and the agreement conflict on the processing of personal data, this DPA prevails. Liability under this DPA follows the limits of the agreement.

Ready for it? See HireAgent Enterprise, or write to [email protected].