HireUp Data Processing Addendum

1. Definitions

• "Data Protection Laws" means the laws on data protection and privacy that apply to the processing of Customer Personal Data under the Agreement. These include the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection ("FADP").
• "Customer Personal Data" means personal data that HireUp processes on Customer's behalf to provide the Service.
• "Subprocessor" means a third party that HireUp engages to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "Controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR.

2. Roles and scope

Customer is the controller of Customer Personal Data, or a processor acting for its own clients. HireUp is Customer's processor, or subprocessor. Annex I describes the processing. Section 3 sets out the one exception.

3. HireUp Insights Program

The HireUp Insights Program is optional. Where Customer's administrator makes the Program available, HireUp uses the organisation's contributed recruiting data to create anonymised, aggregated benchmarks. Where a user also joins, HireUp uses data from that user's own connected accounts for the same purpose. For that use only, HireUp acts as an independent controller, not as Customer's processor, under Section 10A of the Terms and Section 6A of the Privacy Policy. That use is outside this DPA. In all other respects, the contributed data remains Customer Personal Data under this DPA. The resulting benchmarks are anonymised and are not Customer Personal Data. If the Program is not made available, this Section does not apply.

4. Customer's instructions

4.1 HireUp processes Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise. If it does, HireUp will tell Customer before processing, unless that law forbids it. Customer's instructions are the Agreement, this DPA, and Customer's use and configuration of the Service, including requests for profile enhancement.

4.2 HireUp will tell Customer if it believes an instruction breaches Data Protection Laws.

4.3 Customer is responsible for having a lawful basis for the processing, for giving data subjects the notices the law requires (including those described in Section 8A of the Terms), and for the accuracy of the Customer Personal Data it provides.

5. Confidentiality

HireUp ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality.

6. Security

HireUp maintains the technical and organisational measures in Annex II. HireUp may update these measures, but will not reduce the overall level of protection.

7. Subprocessors

7.1 Customer gives HireUp general authorisation to engage Subprocessors. The current Subprocessors are listed in Annex III.

7.2 HireUp imposes data protection obligations on each Subprocessor, in a written contract, that are no less protective than this DPA. HireUp remains liable to Customer for each Subprocessor's performance of those obligations.

7.3 HireUp will tell Customer about any new or replacement Subprocessor at least 30 days before it starts processing Customer Personal Data. HireUp will do this by updating Annex III and by email or a notice in the Service. Customer may object on reasonable data protection grounds within that 30 days. If it does, the parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service. HireUp will then refund any prepaid fees for the rest of the term.

8. Data subject requests

8.1 Taking into account the nature of the processing, HireUp will help Customer respond to requests from data subjects to exercise their rights. HireUp does this through appropriate technical and organisational measures, including the Service's own tools for viewing, correcting, exporting and deleting contacts.

8.2 If HireUp receives a request directly, it will pass it to Customer without undue delay. HireUp will not respond itself, except to direct the data subject to Customer, unless the law requires it to.

9. Assistance with compliance

Taking into account the nature of the processing and the information available to it, HireUp will reasonably help Customer meet its obligations under GDPR Articles 32 to 36. These cover security, Security Incident notification, data protection impact assessments and prior consultation with supervisory authorities.

10. Security Incidents

10.1 HireUp will notify Customer without undue delay after becoming aware of a Security Incident.

10.2 The notice will describe, as far as the information is available: the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. HireUp may provide this information in stages.

10.3 HireUp will take reasonable steps to contain and investigate the Security Incident and to reduce its effects. A notice is not an admission of fault.

11. International transfers

11.1 HireUp stores Customer Personal Data on Amazon Web Services in the European Union (Ireland, eu-west-1). HireUp, Inc. is a US company, and HireUp personnel and some Subprocessors may access Customer Personal Data from outside the European Economic Area ("EEA"), the UK and Switzerland.

11.2 Where Customer Personal Data is transferred from the EEA to a country that does not have an adequacy decision, the SCCs apply and are incorporated into this DPA by reference:

• Module Two applies where Customer is a controller, and Module Three where Customer is a processor;
• Clause 7 (docking clause) applies;
• under Clause 9, Option 2 (general written authorisation) applies, with the notice period in Section 7.3;
• the optional wording in Clause 11 does not apply;
• under Clause 17, Option 1 applies, and the governing law is the law of Ireland;
• under Clause 18, disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

11.3 Where Customer Personal Data is transferred from the UK, the UK Addendum applies and is incorporated by reference. Table 1 is completed with the parties' details in Annex I. Table 2 refers to the SCCs as set out in Section 11.2. Table 3 is completed by Annexes I to III. For Table 4, neither party may end the UK Addendum under its Section 19.

11.4 Where Customer Personal Data is transferred from Switzerland, the SCCs apply as set out in Section 11.2, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR include the FADP, and the term "Member State" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

11.5 HireUp ensures that any onward transfer to a Subprocessor is covered by an appropriate transfer safeguard under Data Protection Laws.

11.6 If the SCCs or the UK Addendum conflict with this DPA, they prevail.

12. Audits

12.1 HireUp will make available to Customer the information needed to show that it complies with this DPA and GDPR Article 28. HireUp does this first by answering Customer's reasonable written security questionnaires and providing relevant documentation.

12.2 If that information is not enough to show compliance, or a supervisory authority requires it, Customer may audit HireUp's compliance, itself or through an independent auditor bound by confidentiality. Customer must give at least 30 days' notice. Audits take place during normal business hours, no more than once in any 12 months (unless after a Security Incident or at a supervisory authority's request), and at Customer's cost.

13. Deletion and return

13.1 During the term, Customer can delete Customer Personal Data through the Service at any time.

13.2 When the Agreement ends, HireUp will, at Customer's choice, return Customer Personal Data or delete it. Customer can request a return by emailing privacy@hireup.cloud before the Agreement ends. HireUp deletes Customer Personal Data within 30 days after the Agreement ends, unless the law requires HireUp to keep it. Anonymised benchmarks created under Section 3 are not Customer Personal Data and are kept.

14. Liability and order of precedence

14.1 Each party's liability under this DPA is subject to the limitations in the Agreement, to the extent Data Protection Laws allow.

14.2 If documents conflict, this order applies: first the SCCs and the UK Addendum, then this DPA, then the rest of the Agreement.

15. Changes to this DPA

HireUp may update this DPA to reflect changes in Data Protection Laws, in Subprocessors (under Section 7) or in the Service. HireUp will tell Customer about material changes as set out in Section 15 of the Terms. No update will reduce the protection this DPA gives to Customer Personal Data.

16. Contact

HireUp, Inc., 300 Delaware Ave, Ste 210 #246, Wilmington, DE 19801, USA. Email: privacy@hireup.cloud.

Annex I: Description of the processing

• Data exporter: Customer, as identified in its HireUp account. Role: controller (or processor for its own clients).
• Data importer: HireUp, Inc., 300 Delaware Ave, Ste 210 #246, Wilmington, DE 19801, USA. Contact: privacy@hireup.cloud. Role: processor (or subprocessor).
• Categories of data subjects: Customer's users; candidates, clients, hiring contacts and other people whose information Customer holds or communicates with through the Service.
• Categories of personal data: names, email addresses, phone numbers and profile URLs; communication content and metadata from connected channels (email, messaging, calls and meetings, including recordings and transcripts); data extracted from communications and documents (such as skills, job titles, employers, salary expectations, location preferences and employment history); uploaded documents such as resumes; ATS records; public professional profile information added by profile enhancement; and account and usage data for Customer's users.
• Special categories of data: the Service is not designed to process special categories of personal data. Any such data that appears in communications or documents Customer brings into the Service is processed only to provide the Service, under the measures in Annex II.
• Frequency of transfer: continuous, for the term of the Agreement.
• Nature and purpose of processing: providing the Service described in the Agreement, including aggregating and storing communications, maintaining contact profiles, search, AI-powered extraction, summaries and drafts, campaign sending, ATS synchronisation and profile enhancement.
• Duration and retention: for the term of the Agreement, then deletion under Section 13. Specific retention periods are set out in Section 7 of the Privacy Policy.
• Transfers to Subprocessors: as listed in Annex III, for the purposes stated there.

Annex II: Technical and organisational security measures

• Encryption in transit (TLS/HTTPS) for all API communications.
• Encryption at rest for stored data, including documents and files in Amazon S3.
• OAuth credentials and API keys stored in AWS Secrets Manager.
• Role-based access control with organisation-level data isolation.
• JWT-based authentication for every API request.
• The HireUp Browser Extension stores data only in Chrome's isolated extension storage, and talks to the HireUp platform only over authenticated HTTPS.
• AI processing runs on Amazon Bedrock, which does not use Customer Personal Data to train its foundation models.
• HireUp staff do not read data received from Google or Microsoft APIs, except with the user's explicit consent for a specific support request, or where needed for a security investigation or to comply with the law.
• Personnel who process Customer Personal Data are bound by confidentiality (Section 5).
• Application logs are kept for 90 days.

Annex III: Subprocessors