Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Business Terms between Parzr, LLC ("Inleika") and the Customer. It applies when Inleika processes Customer Data on the Customer's behalf. For that data, the Customer is the controller (responsable) and Inleika is its processor (persona encargada).

1. Scope of processing

2. Instructions

2.1 Inleika processes Customer Data only on the Customer's documented instructions. The Business Terms, this DPA and the Customer's use of the Service's features are those instructions.

2.2 Inleika will not process Customer Data for its own purposes. It may process it when the law requires; in that case it will inform the Customer unless the law forbids it.

2.3 Inleika will tell the Customer if it believes an instruction violates applicable data protection law.

3. Confidentiality

Inleika ensures that personnel authorized to process Customer Data:

• are bound by confidentiality obligations that continue after their engagement ends;
• access it only as needed to provide, support or secure the Service.

4. Security

Inleika maintains the measures in Annex 1. It may update them provided the overall level of protection does not decrease.

5. Subprocessors

5.1 The Customer authorizes Inleika to use the subprocessors listed at /legal/subprocessors.

5.2 Inleika will give at least 30 days' notice of a new subprocessor through that page and by email to the Customer's Owners.

5.3 The Customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of unused purchased Credits.

5.4 Inleika imposes data protection obligations on each subprocessor that are no less protective than this DPA. It remains responsible for its subprocessors.

6. International transfers

6.1 Customer Data is processed in the United States and in the locations of the listed subprocessors.

6.2 The Customer is responsible for having a lawful basis for transferring data to Inleika, including any consent or notice its local law requires. For candidates who use the Service directly, Inleika also collects their express consent to the transfer to the United States.

6.3 Where the law requires contractual safeguards for international transfers, this DPA serves as those safeguards. The parties will sign any additional standard clauses a competent authority requires.

7. Assistance

7.1 Requests from individuals.

• Inleika will forward to the Customer, without undue delay, any request it receives from an individual about Customer Data.

• Inleika will help the Customer respond through the Service's features or as reasonably requested, within the deadlines that apply to the Customer.

  7.2 Impact assessments and regulators. Inleika will provide reasonable information for the Customer's impact assessments and consultations with authorities, including the AI in Hiring Notice.

8. Security breaches

8.1 Inleika will notify the Customer without undue delay after becoming aware of a security breach affecting Customer Data, targeting 72 hours.

8.2 The notice will describe:

• the nature of the breach;
• the affected data and individuals, where known;
• the likely consequences;
• the measures taken or proposed.

Inleika will update the Customer as it learns more.

8.3 Inleika will help the Customer meet its own breach-notification duties, including notifying affected individuals where required.

9. Deletion and return

9.1 For 30 days after the Business Terms end, the Customer can export Customer Data.

9.2 Inleika will then delete Customer Data within 30 days, except where the law requires it to be kept. In that case Inleika will keep it confidential and process it only for that purpose.

9.3 Inleika will confirm deletion in writing on request.

9.4 During the term, the Customer can delete Customer Data through the Service. Deletion also happens under Inleika's published retention periods.

10. Audits

10.1 Once a year, Inleika will provide on request:

• a written summary of its security measures;

• reasonable answers to the Customer's security questionnaire.

  10.2 If that is not sufficient to show compliance, or if a competent authority requires it, the Customer may conduct a remote audit:

• with 30 days' notice;

• during business hours;

• at its own cost;

• subject to confidentiality.

11. Liability

Each party's liability under this DPA is subject to the limits in the Business Terms.

12. Order of precedence

On the processing of Customer Data, this DPA prevails over the Business Terms if they conflict.

---

Annex 1: Security measures

• Access control:
  • access is based on role and organization;
  • every query on Customer Data is restricted to the Customer's organization in the application layer, with tests to prove it;
  • candidate and organization authentication are kept separate;
  • privileged database connections are restricted.
• Authentication: handled by a specialized provider. It supports multi-factor authentication, passkeys and single sign-on for organizations.
• Encryption: in transit (TLS). At rest, the hosting and storage providers' native encryption.
• Logging hygiene:
  • personal data and confidential content are excluded from application logs, traces and error reports;
  • error monitoring runs with personal data collection turned off.
• AI safeguards:
  • an independent review of every sentence the AI interviewer says, so confidential preparation is not disclosed;
  • human approval for consequential actions;
  • no voice biometrics;
  • no AI model training on Customer Data.
• Interview media: no audio or video recording is kept. Only text transcripts are stored, for the retention period in the Privacy Notice.
• Operational access: platform operator access to Customer Data is limited to support, safety and legal purposes, and is logged.
• Resilience: managed database backups and infrastructure monitoring by the hosting providers.
• Personnel: confidentiality obligations; least-privilege access.
• Incident response: a documented procedure for breach assessment and notification.