Data Processing Agreement

1. Scope

This DPA covers personal data the Controller uploads or collects through the Platform for hiring and assessments. It does not cover data the Processor handles as an independent controller: account security logs, billing data, and candidate talent profiles created with the candidate's opt-in (see §3.4).

2. Definitions

Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have their GDPR meanings, and the equivalent DPDP/PDPL terms apply where relevant. "Services" means Edgeryt Hire, Edgeryt Assessment and Edgeryt Campus.

3. Roles

3.1 The Controller decides the purposes and means of processing. The Processor acts only on the Controller's documented instructions, including product configuration.

3.2 CCPA: The Processor is a service provider. It will not sell or share the data, retain or use it outside the business purpose, or combine it with other data, except as the CCPA regulations allow. It certifies that it understands these restrictions.

3.3 The Processor will tell the Controller if it can no longer meet its obligations.

3.4 Candidate-directed reuse. When a candidate separately opts in to a talent profile (unticked by default, with double opt-in confirmation), Edgeryt keeps a copy of that candidate's profile and results as an independent controller under its Privacy Policy. The Controller agrees to this. Edgeryt will not use Controller confidential information, recruiter notes or interview feedback for this purpose, and will share results with another employer only when the candidate approves each share.

4. Instructions

The Processor processes data to host applications, assessments, interviews, files, emails and reports as configured. It will not use Controller data for its own marketing. It will tell the Controller if it believes an instruction breaks the law.

5. Personal data

Identity and contact data; application answers; CVs and files; assessment answers and scores; device and network metadata; integrity events; optional camera, microphone and screen media; identity photos and ID documents; biometric data (face and voice comparison results); interview metadata; and support content.

6. Data subjects

Candidates and applicants; interviewers and workspace members.

7. Processing activities

Hosting, scoring, AI-assisted grading (when enabled), proctoring evidence storage, email delivery, retention enforcement, export and erasure tools, and meeting scheduling.

8. Controller responsibilities

The Controller warrants that it has a lawful basis, gives candidates the notices they need, sets retention appropriately, and obtains the consents it requires.

8A. Hiring-AI and biometric laws

The Controller is responsible for:

• Illinois BIPA: written release and notice (the Platform's biometric consent screen helps with this);
• Illinois AI notices: 775 ILCS 5/2-102(L) and 820 ILCS 42;
• NYC Local Law 144: candidate notice and alternative process;
• California: ADMT pre-use notice and opt-out from 1 January 2027;
• EU AI Act Art. 26: deployer duties.

The Processor supplies template wording, instructions for use and its bias-audit summary when one is available.

9. Processor responsibilities

The Processor will:

• process only on instructions;
• keep personnel under confidentiality;
• maintain the Annex II security measures;
• help with data-subject requests, DPIAs and prior consultations;
• notify breaches (see §15);
• delete or return data at the end of the agreement.

10. Confidentiality

Everyone with access is bound by confidentiality.

11. Security

See Annex II and the Trust Center.

12. Subprocessors

The Controller authorises the subprocessors listed at /legal/subprocessors (Annex III). The Processor gives 30 days' notice of new subprocessors, and the Controller may object on reasonable grounds. The Processor flows down equivalent terms and remains liable for its subprocessors.

13. International transfers

• EEA: EU SCCs (Decision 2021/914), Module 2 (C→P) and Module 3 (P→P), incorporated by reference. Clause 7 (docking) included; Clause 9(a) Option 2 with 30 days' notice; Clause 11 optional language omitted; Clause 17 Irish law; Clause 18 Irish courts. Annexes I–III of the SCCs are completed by this DPA's Annexes.
• UK: ICO International Data Transfer Addendum (version B1.0).
• Switzerland: the SCCs as adapted for the FADP, with the FDPIC as authority.
• Saudi Arabia: SDAIA Standard Contractual Clauses (in the relevant module), plus a transfer risk assessment where required.
• UAE: the recipient is bound to the PDPL's measures and controls under Art. 23.
• Singapore: obligations giving protection comparable to the PDPA (s.26 and Reg. 10).

A transfer impact assessment is available on request. Signed copies: {{OWNER: confirm SCC/IDTA/SDAIA execution process and signatory}}.

14. Data subject requests

The Processor forwards requests within 2 business days and provides tools for export and erasure.

15. Breach

The Processor notifies the Controller without undue delay and within 48 hours of becoming aware. It provides the details the Controller needs to meet GDPR's 72-hour deadline, the DPDP Rules' 72-hour report to the Board, and other local deadlines.

16. Retention and deletion

The Processor deletes or anonymises data according to the Controller's settings and the Platform's limits:

• media: no more than 30 days (7 by default);
• biometric data and identity photos: within 30 days;
• candidate records: no more than 12 months after a decision or the job closing.

17. Audits

The Processor provides the information needed to demonstrate compliance, including third-party reports when available. The Controller may audit once a year with 30 days' notice, or after a breach, at its own cost and under confidentiality.

18. Return or deletion at the end

On termination, the Controller may export its data for 30 days. After that, the Processor deletes it within 60 days, except where the law requires retention. Backups roll off within 35 days.

19. Liability

As set out in the main agreement, except where the law does not allow liability to be limited.

20. Term

This DPA lasts as long as the Processor processes Controller data.

21. Annex I: Processing details

• Parties: as above.
• Subjects and data: see §§5–6.
• Purpose: hiring and assessment services.
• Duration: term of the agreement plus the deletion period.
• Frequency: continuous.
• Special categories: biometric data, used only for identity and presence checks, with candidate consent.

Annex II: Security measures

• Encryption in transit; encryption at rest for tokens.
• Role-based access.
• Rate limiting.
• File storage kept separate from database records.
• Malware scanning of uploads, when enabled.
• Logging.
• Least-privilege staff access.

Annex III: Subprocessors

See /legal/subprocessors. Data is stored at: Convex (US, Virginia) and Cloudflare R2 ({{OWNER: R2 bucket jurisdiction}}).

Annex IV: Transfer mechanism

See §13.