Data Processing Agreement

1. Subject matter and duration

HirePortal processes personal data in order to provide the Service for the term of the main agreement, and thereafter only for deletion or return or insofar as a statutory retention duty applies.

2. Nature and purposes

Hosting, storage, structuring, retrieval, consultation, Customer-instructed enrichment, matching support, communications preparation, AI voice interaction, recording and transcription, appointment scheduling, logging, synchronisation with ATS/CRM and support. AI voice calls are recorded and transcribed by default. Recordings and transcripts are used to provide the Service, create call reports, update candidate records, troubleshoot calls and allow customer follow-up. HirePortal does not use customer conversations to train its own AI models.

3. Categories of data subjects

Candidates, applicants, prospective candidates, Customer contacts and other natural persons the Customer lawfully processes in the Service.

4. Categories of data

Identity and contact details; professional profile; employment history; education; skills; role preferences; correspondence; appointments; call status; technical metadata; publicly available professional information insofar as instructed by the Customer. Special categories of personal data are excluded by default.

5. Documented instructions

HirePortal processes only on the Customer's documented instructions, including transfers outside the EEA, unless Union or Dutch law requires HirePortal to process. Where, in HirePortal's judgement, an instruction infringes privacy law, HirePortal informs the Customer and may suspend execution.

6. Confidentiality

Persons processing personal data under HirePortal's authority are bound by appropriate confidentiality obligations.

7. Security

HirePortal implements a risk-based security programme, including access restriction, least privilege, logging, encryption in transit and where appropriate at rest, backup and recovery, vulnerability management, incident procedures and periodic review of measures.

8. Subprocessors

The Customer grants general authorisation for the use of subprocessors. HirePortal maintains the list below, gives notice of material changes in advance or as soon as reasonably possible and imposes materially equivalent data protection obligations on subprocessors. The Customer may object to a change on substantiated data-protection grounds.

9. International transfers

Personal data may be processed inside and outside the EEA. International transfers are protected using an adequacy decision, the EU-US Data Privacy Framework where applicable, Standard Contractual Clauses or equivalent legal safeguards.

10. Data subject rights

Taking into account the nature of the processing, HirePortal assists the Customer with appropriate technical and organisational measures for requests concerning access, rectification, erasure, restriction, portability, objection and rights regarding automated decision-making. HirePortal does not respond substantively on the Customer's behalf unless instructed to do so.

11. Personal data breaches

HirePortal notifies the Customer of a personal data breach without undue delay and, in any event, within 48 hours after becoming aware of a breach affecting Customer Personal Data. HirePortal provides the available information the Customer reasonably needs for assessment and any notification to the supervisory authority or data subjects. A notification is not an admission of liability.

12. DPIA and prior consultation

HirePortal provides reasonable assistance with information within its control for DPIAs and any prior consultation. The Customer remains responsible for the necessity, execution and decision-making involved.

13. Audit

HirePortal makes available the information reasonably necessary to demonstrate compliance with GDPR Article 28. Audits take place at most once a year, unless an incident or supervisory authority requires more, with reasonable prior notice, during office hours, without unnecessary disruption and protecting the confidential information of other customers.

14. Deletion and return

Personal data is retained while required to provide the Service and according to the Customer's instructions. After account termination or a valid deletion request, active data is normally deleted within 30 days. Residual encrypted backups may remain for up to 90 days unless the law requires longer retention.

15. Customer obligations

The Customer remains the controller and is responsible for lawfulness, having a lawful basis, informing Candidates, obtaining and evidencing consent where legally required, upload and ATS instructions, retention periods, accuracy, data subject requests, objections and suppression, DPIA decisions and the lawfulness of every contact moment. HirePortal may block processing where consent or authority is missing.

16. Liability

The liability regime of the main agreement applies, taking into account the mandatory liability regime of the GDPR. No provision limits the rights of data subjects or the powers of supervisory authorities.

Annex A — Processing instructions

• Purpose: recruitment support according to the Customer's settings and instructions.
• Duration: subscription term plus the agreed deletion period.
• Frequency: ongoing while modules are activated.
• SmartWatcher: enrichment only of candidates, sources and fields selected by the Customer, or criteria demonstrably configured by the Customer.
• AI Voice: calling only numbers authorised by the Customer, with the required consent and contact-authority metadata.
• Recording and transcription: enabled by default for AI voice calls and used only to provide the Service, create call reports, update candidate records, troubleshoot calls and allow Customer follow-up.
• Automated decisions: HirePortal does not make autonomous hiring, selection or rejection decisions.
• Connected services: Zoho Recruit, calendars and other ATS systems are activated by the Customer and receive only the data required for the integration.
• Special-category data: not permitted as a standard instruction.