Data Processing Agreement (DPA)

Version: 2.0 (revision prepared 2026-10-09)

• "Controller": the recruiting organization (customer) that determines the purposes and means of processing personal data through the Services.
• "Processor": AI Interview Analyzer Sp. z o.o., which processes personal data on behalf of the Controller.
• "Sub-processor": a third party engaged by the Processor to process personal data on behalf of the Controller.
• "Personal Data": any information relating to an identified or identifiable natural person as defined in Art. 4(1) GDPR.
• "Processing": any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Subject": the natural person whose personal data is processed (primarily job candidates).
• "Services": the AI Interview Analyzer platform and all related services provided by the Processor to the Controller.
• "GDPR": Regulation (EU) 2016/679 of the European Parliament and of the Council.

Subject matter: Processing of candidate personal data for AI-assisted interview analysis.

Duration: The initial DPA takes effect on acceptance. Updated revisions take effect as specified in Section 14. The agreement continues for the duration of the Controller's subscription to the Services, plus any applicable data retention period.

Nature of processing: Automated processing including transcription, AI analysis, scoring, and storage, as well as manual access by authorized personnel for support purposes.

Purpose: To provide recruitment document extraction, CV ranking, interview transcription, question-and-answer extraction, requirement scoring, candidate comparison, AI Coach, assistant interactions, translation and related recruitment support requested by the Controller. The organization administrator chooses a shared Budget, Regular, Premium or custom AI template. System templates use platform-maintained model recommendations. Custom templates keep the concrete models selected while those models remain offered. Available choices and per-operation credit prices are shown in settings. The model and tariff configuration used for processing is recorded so a later template change does not relabel earlier work. A template name is not a data-residency guarantee.

The following categories of personal data are processed:

• Candidate data: name, email address, voice recordings, interview transcripts, CV/resume data, AI evaluation results (scores, justifications), feedback text.
• Recruiter data (as platform users): name, email address, IP address (in audit logs).

• Job candidates (primary data subjects).
• Recruiters, hiring managers, and interviewers (as platform users).

The Processor shall:

(a) Process personal data only on documented instructions from the Controller, including transfers to third countries, unless required by EU or Member State law.

(b) Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c) Implement appropriate technical and organizational security measures as described in Annex B.

(d) Not engage another processor (sub-processor) without prior written authorization from the Controller, subject to Section 6.

(e) Assist the Controller in responding to requests from data subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, objection).

(f) Assist the Controller in ensuring compliance with Articles 32 to 36 of the GDPR (security, data protection impact assessments, breach notification, prior consultation).

(g) At the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of Services, and delete existing copies unless EU or Member State law requires storage.

(h) Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, as described in Section 11.

The Controller grants general written authorization for the Processor to engage the sub-processors listed in Annex A. The Processor shall:

(a) Inform the Controller in writing of intended additions or replacements of sub-processors before they process the Controller's Personal Data. The notice shall identify the provider, purpose, data categories, processing locations and applicable transfer safeguards, and give the Controller a meaningful opportunity to object before the changed processing starts. A document release does not remove this requirement.

(b) Consider the Controller's reasoned data-protection objections before commencing the affected processing. Where an objection cannot be resolved, the parties shall agree an alternative compliant route or discontinue the affected feature; the Controller may terminate the subscription. No universal 30-day waiting period applies to document releases or routine model updates within the existing authorized scope.

(c) Ensure that sub-processors are bound by data protection obligations no less protective than those in this DPA.

(d) Remain fully liable to the Controller for the performance of sub-processor obligations.

Sub-processors marked as "conditional" in Annex A are engaged only when the Controller activates the corresponding feature and the applicable contractual and transfer requirements are met. Microsoft Azure provides hosting, storage, model inference, speech, document parsing, malware scanning and operational delivery. Soniox provides speech processing only on its conditional EU content route, with no US fallback; choosing a template does not itself establish the required supplier terms or transfer safeguards for processing outside that content region. The detailed register is in Annex A. No third-party ATS connector is included merely because the Controller has an Enterprise self-service plan; any such processor requires a separately agreed integration and the notice process above.

Replacing a model or model version is routine catalog maintenance, without a new DPA or separate DPA notification, only when the provider, authorized purpose, data categories, protection level and regional/transfer scope remain unchanged. A new provider or a move from an EU route to a global route is a material processing change, not a routine model update. The current model catalog is available in the Services under Settings > AI Models; versioned processing records retain the concrete model, provider and route used for each operation.

The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex B. These measures include, but are not limited to:

• Encryption of personal data at rest and in transit (TLS 1.2 or higher).
• Role-based access control (RBAC).
• Audit logging of all data access and processing operations.
• Automated data deletion per the Controller's configured retention policy.
• Regular security assessments and vulnerability management.

The Processor shall assist the Controller in fulfilling its obligations to respond to data subject requests within 72 hours of receiving the Controller's request. The platform provides self-service tools for:

• Right of Access (Art. 15): Export of all candidate data.
• Right to Rectification (Art. 16): Editing of candidate information.
• Right to Erasure (Art. 17): Deletion of all candidate data and associated interview records.
• Right to Restriction (Art. 18): Limiting processing of specific candidate data.
• Right to Portability (Art. 20): Export in machine-readable format (JSON).
• Right to Object (Art. 21): Withdrawal of consent and cessation of processing.

The Processor shall notify the Controller of a personal data breach without undue delay, and no later than 72 hours after becoming aware of it, in accordance with Article 33 of the GDPR. The notification shall include:

• The nature of the personal data breach, including the categories and approximate number of data subjects and records concerned.
• The name and contact details of the Processor's data protection contact (security@aiinterviewanalyzer.com).
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach and mitigate its effects.

Upon termination of the Services:

(a) The Processor shall, at the Controller's choice, delete or return all personal data within 30 days.

(b) Data return shall be provided in machine-readable format (JSON).

(c) Deletion shall be confirmed in writing (email) to the Controller.

(d) The Processor may retain personal data to the extent required by EU or Member State law, in which case the Processor shall inform the Controller of such requirement.

(a) The Controller may audit the Processor's compliance with this DPA once per calendar year, with 30 days prior written notice.

(b) Remote audit: The Processor shall provide an annual compliance report and responses to the Controller's audit questionnaire. When available, a SOC 2 Type II report shall be provided.

(c) On-site audits: When remote audit is insufficient, on-site audits may be conducted at the Controller's expense, during business hours, subject to a non-disclosure agreement.

(d) The Processor shall cooperate with audits conducted by the Controller or an independent auditor mandated by the Controller.

(a) Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service.

(b) The Processor's aggregate liability under this DPA shall not exceed the total fees paid by the Controller in the 12 months preceding the claim.

(a) Production application records, document storage and audio storage are hosted in Azure West Europe. Azure OpenAI models are offered through EU Data Zone and Global Standard deployment routes, identified in the model catalog and retained in processing records. EU Data Zone uses Microsoft's defined EU Data Boundary, which can include EFTA locations; it is not a promise of processing in one country or exclusively in EU member states. Global Standard may process prompts and responses outside Europe. The Azure account location in Sweden Central does not make a Global deployment EU-only. Current model names and versions may change within these disclosed boundaries under Section 6.

(b) Azure Speech processing uses West Europe for the standard speech resource and North Europe for the LLM speech resource. Soniox is offered only through its European Union (EU) content region for real-time assistance and a separate final transcription of the recording. The US route is not offered. EU use requires a region-specific project, credential and matching EU endpoints, with no US fallback. Account metadata, usage and billing information can be processed outside the Soniox EU content region.

(c) Before transferring Controller Personal Data outside the EEA, the Processor must establish an applicable GDPR Chapter V basis, such as an adequacy decision covering the recipient or the relevant Standard Contractual Clauses together with the required assessment and supplementary measures. Provider terms and technical regional availability alone are not evidence that the required contractual arrangements have been completed.

(d) The Processor shall disclose the actual processing route and any material change through the sub-processor notice process. A new template selection does not override the Controller's documented regional restrictions. Where a required compliant route is unavailable, the restricted processing must not proceed.

(a) The initial DPA takes effect when accepted by the Controller and remains in force for the duration of the Controller's subscription to the Services. The original acceptance version, date and actor remain part of the audit record.

(b) This DPA terminates automatically when all personal data has been deleted or returned in accordance with Section 10.

(c) Updated DPA revisions take effect from the recorded deployment date of the release that activates them for the Controller's service environment. The Processor shall notify the Controller's organization administrator by email of the new version, that effective date, a summary of changes and a link to the exact updated revision. The preparation date printed on a document is not its deployment or effective date.

(d) There is no general 30-day waiting period and no mandatory repeat acceptance for these updates. Release activation and notification are recorded as system events, not as a new human signature. Previous revisions and their acceptance records remain available as historical evidence. Routine model catalog changes meeting Section 6 do not require a new DPA revision.

(e) The Controller may raise objections at legal@aiinterviewanalyzer.com and may terminate the subscription if an update is unacceptable. Section 10 (Data Return & Deletion) applies on termination. The safeguards, documented instructions and opportunity to object for material processing changes in Sections 5, 6 and 13 continue to apply; deploying a DPA revision does not itself authorize new processing outside that scope.

The list identifies services actually used or conditionally offered. It does not appoint an unspecified ATS connector. Soniox customer-data activation requires completed supplier terms, transfer safeguards and the Controller notice process; the existence of an API account or test balance does not establish those conditions. Legacy Azure deployments may remain during a controlled rollout; any selected Global route must be disclosed as Global rather than EU-only.