Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between a Customer and RecruitCandidates and describes how we process candidate personal data on the Customer's behalf.

Roles

For candidate data — applications, CVs, cover notes, application answers, assessment responses, video recordings, transcripts, and AI-generated screening or interview analysis — the Customer is the data controller and RecruitCandidates is the data processor, processing this data solely to provide the service and on the Customer's documented instructions.

Categories of data processed

• Candidate identity and contact data (name, email, phone, location, LinkedIn/portfolio links)
• CV files and extracted text
• Application and assessment answers
• Video interview recordings and generated transcripts
• AI-generated screening scores, explanations, and interview analysis

Processing activities

• Storing CVs and videos in access-controlled, tenant-isolated storage
• Extracting CV text and generating semantic screening results against Customer-defined job requirements
• Transcribing video responses and generating question-level analysis against Customer-defined scoring criteria
• Sending Customer-configured candidate emails (receipts, invitations, reminders, status updates)
• Drafting rejection explanations for Customer review and approval

Sub-processors

RecruitCandidates uses sub-processors for database/storage hosting, transactional email delivery, AI model inference (screening, transcription, interview analysis), and payment processing. We remain responsible for sub-processor compliance with this DPA.

Security measures

• Row-level tenant isolation — no cross-company access to candidate data
• Private storage buckets with time-limited signed URLs for CVs and videos
• Hashed candidate access tokens for assessment and video interview links
• Webhook signature validation for all payment and email provider callbacks
• Audit logging of sensitive employer actions

Retention and deletion

Candidate data is retained per the Customer's plan-level retention setting or until the Customer deletes it. On account termination, Customer data is deleted or returned within a reasonable period, subject to legally required retention.

Data subject requests

RecruitCandidates will assist the Customer in responding to data subject access, correction, or deletion requests relating to candidate data, consistent with our role as processor.