Data Processing Addendum

1. Scope, parties and precedence

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between the customer organization ("Customer") and [Company legal name] ("Processor", "we"). It applies to all personal data that we process on Customer's behalf in providing NextVerseTech ("Customer Personal Data"), and it is effective when Customer accepts the Agreement. No separate signature is required; customers who need a countersigned copy can request one at [Privacy email].

If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of personal data. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.

2. Definitions

• Data Protection Laws — all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other US state privacy laws.
• Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR; business, service provider, sell and share have the meanings given in the CCPA.
• Subprocessor — any third party we engage that processes Customer Personal Data.
• Standard Contractual Clauses or SCCs — the clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum — the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

3. Roles and processing instructions

Customer is the controller (or, where Customer acts for its own clients, a processor) of Customer Personal Data, and we are a processor (or subprocessor). We will process Customer Personal Data only on Customer's documented instructions, which are: to provide the Services in accordance with the Agreement and the Documentation; as initiated by Customer's authorized users through the Services (for example, configuring forms, moving candidates between stages, running AI screening, exporting or deleting data); and as otherwise agreed in writing.

We will promptly inform Customer if, in our opinion, an instruction infringes Data Protection Laws, and we may suspend the affected processing until the instruction is confirmed or modified. We may also process Customer Personal Data where required by law to which we are subject, in which case we will inform Customer before processing unless the law prohibits it.

4. Details of processing (Annex I)

• Subject matter and duration — provision of the Services for the term of the Agreement and the post-termination period in Section 12.
• Nature and purpose — hosting, storage, organization, retrieval, display, transmission, analysis (including optional AI-assisted screening initiated by Customer), export and deletion of data to operate Customer's recruiting process, careers pages and application forms.
• Categories of data subjects — job applicants and candidates; Customer's authorized users (employees and contractors); referees or other individuals named in application materials.
• Categories of personal data — identification and contact details; professional and educational history; resumes, cover letters and other files; answers to application questions; work authorization, availability and salary expectations; hiring-team notes, ratings, stages and dispositions; AI screening outputs; communications and audit records; account credentials of authorized users (processed by our authentication provider).
• Special categories / sensitive data — only if Customer enables voluntary equal-employment self-identification: gender, race or ethnicity, veteran status and disability status, provided voluntarily by candidates, stored separately from applications, excluded from AI processing and used only for aggregate reporting. Customer should not otherwise request special-category data unless permitted by law.
• Frequency — continuous, for as long as Customer uses the Services.
• Retention — as configured and instructed by Customer during the term, then as set out in Section 12.

5. Customer obligations

Customer is responsible for the lawfulness of the processing it instructs, including having a valid legal basis, providing required notices to candidates (including about AI tools), obtaining any required consents, configuring retention periods, and ensuring that the personal data it or its candidates submit is accurate and limited to what is necessary. Customer will not instruct us to process personal data in violation of Data Protection Laws.

6. Confidentiality of personnel

We ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as needed to provide, support or secure the Services.

7. Security measures (Annex II)

We implement and maintain appropriate technical and organizational measures, taking into account the state of the art, costs and the risks to data subjects, including:

• Hosting — Google Cloud / Firebase infrastructure in the United States (managed hosting, a multi-region replicated database and object storage), operated under Google's independently audited security program.
• Encryption — TLS for all data in transit; encryption at rest for databases, file storage and backups maintained by our infrastructure provider.
• Tenant isolation and access control — data is partitioned per workspace; every server request verifies the user's identity and workspace membership; role-based permissions are enforced on the server and in database security rules; there is no unauthenticated access to the database or uploaded files.
• Authentication — passwords are hashed by our authentication provider; optional Google sign-in; secure, HTTP-only session cookies with revocation checks.
• Least privilege — administrative access to production systems is limited to personnel who need it; service credentials are stored in a managed secret store.
• Application security — server-side input validation, HTML sanitization, restrictions on uploaded file types and sizes, isolated delivery of uploaded files, security headers, same-origin checks and rate limiting on public endpoints.
• Data minimization — AI requests contain only the application content needed for the task, trimmed in size, and never include equal-employment self-identification data; Customer can set retention periods and anonymize candidates.
• Logging and accountability — audit logs of significant workspace actions, available to Customer administrators; server logs for security monitoring.
• Resilience — managed, automatically scaled infrastructure with replicated storage.
• Change and vulnerability management — code review before release, dependency updates, and prompt remediation of identified vulnerabilities.
• Incident response — procedures to detect, investigate, contain and notify personal data breaches (Section 10).

We may update these measures provided the overall level of protection is not reduced.

8. Subprocessors

Customer gives general authorization for us to engage the Subprocessors listed on our Subprocessors page. We will impose data-protection obligations on each Subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

We will notify Customer (by email to the workspace owner and by updating the Subprocessors page) at least 30 days before a new Subprocessor begins processing Customer Personal Data, except in an emergency where a replacement is needed to maintain the Services, in which case we will notify as soon as possible. Customer may object on reasonable data-protection grounds within that period. We will discuss the objection in good faith; if we cannot reasonably accommodate it, Customer may terminate the affected subscription and receive a refund of prepaid fees for the unused part of the term.

9. Data subject requests

Taking into account the nature of the processing, we will assist Customer by appropriate technical and organizational measures to respond to requests from data subjects to exercise their rights. The Services let Customer access, export, correct, anonymize and delete candidate data. If we receive a request directly from a data subject who identifies Customer, we will forward it to Customer without undue delay and will not respond ourselves except to direct the person to Customer, unless required by law.

10. Personal data breach notification

We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and we will supplement it as more information becomes available. We will take reasonable steps to contain and remediate the breach and will cooperate with Customer's notifications to authorities and data subjects. Our notification is not an acknowledgment of fault or liability.

11. Impact assessments and consultations

We will provide reasonable information and assistance to help Customer carry out data-protection impact assessments (including assessments relating to AI-assisted screening) and any prior consultations with supervisory authorities, to the extent Customer cannot reasonably do so with information available to it.

12. Deletion or return of data

Customer can export Customer Personal Data at any time during the subscription using the Services' export tools, and for 30 days after the subscription ends on request. After that period we will delete Customer Personal Data from our active systems within 90 days, unless Data Protection Laws or other applicable law require us to retain it. Residual copies in backups are isolated, protected and overwritten in the ordinary course of backup rotation. On request, we will confirm deletion in writing.

13. Information and audits

We will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including written responses to reasonable security questionnaires and, where available, our providers' third-party certifications and audit reports. If that information is insufficient to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an audit (by itself or an independent auditor bound by confidentiality) no more than once in any 12-month period, on at least 30 days' notice, during business hours, in a way that does not disrupt our operations or compromise other customers' data, and at Customer's cost.

14. International transfers

Customer Personal Data is hosted in the United States. To the extent Customer Personal Data originating in the European Economic Area is transferred to a country without an adequacy decision, the parties agree that the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. For the SCCs: Clause 7 (docking) applies; under Clause 9(a), Option 2 (general written authorization) applies with the notice period in Section 8 of this DPA; the optional language in Clause 11 does not apply; under Clause 13, the competent supervisory authority is the one determined by Customer's establishment or representative; Clauses 17 and 18 are governed by, and disputes resolved by the courts of, Ireland. Annex I is completed by Section 4 of this DPA, Annex II by Section 7, and Annex III by the Subprocessors page.

For transfers from the United Kingdom, the UK Addendum is incorporated, with its tables completed by the information in this DPA and the SCC selections above. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority where applicable. If an alternative transfer mechanism (such as a recognized certification) becomes available, we may rely on it instead.

15. US state privacy laws (CCPA service-provider terms)

To the extent Customer Personal Data is subject to the CCPA or similar US state laws, we act as Customer's service provider (or processor) and we will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement, or outside the direct business relationship with Customer;
• combine it with personal information we receive from or on behalf of others, or collect ourselves, except as permitted by law.

We will comply with applicable obligations and provide the same level of privacy protection required of businesses; notify Customer if we can no longer meet our obligations; and allow Customer to take reasonable steps to stop and remediate unauthorized use. We certify that we understand and will comply with these restrictions.

16. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Laws do not permit such limitation as between the parties and data subjects. This DPA remains in effect for as long as we process Customer Personal Data.

17. Contact

Data-protection questions and requests for a countersigned copy: [Privacy email], [Company legal name], [Company address].