Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Business Terms between Parzr, LLC ("Inleika") and the Customer. It applies when Inleika processes Customer Data on the Customer's behalf. For that data, the Customer is the controller (responsable) and Inleika is its processor (persona encargada).

1. Scope of processing

2. Instructions

2.1 Inleika processes Customer Data only on the Customer's documented instructions. The Business Terms, this DPA and the Customer's use of the Service's features are those instructions.

2.2 Inleika will not process Customer Data for its own purposes, except in these two ways:

• Improving the Service. Inleika may de-identify Customer Data, combine it with other customers' de-identified data, and use it to measure and improve the Service, for example how often hiring decisions agree with matching results and identity warnings. De-identified data cannot be linked to a person or to the Customer.
• Fraud prevention. When the Customer confirms that a different person took part in an interview, or ends a hiring process because a different person took part, Inleika keeps that report in its own fraud-prevention record, as the Privacy Notice describes. Inleika is the controller of that record and never shows its reports to another customer.

Inleika never sells Customer Data and never uses it to identify or profile a person for any other purpose. It may also process Customer Data when the law requires; in that case it will inform the Customer unless the law forbids it.

2.3 Inleika will tell the Customer if it believes an instruction violates applicable data protection law.

3. Confidentiality

Inleika ensures that personnel authorized to process Customer Data:

• are bound by confidentiality obligations that continue after their engagement ends;
• access it only as needed to provide, support or secure the Service.

4. Security

Inleika maintains the measures in Annex 1. It may update them provided the overall level of protection does not decrease.

5. Subprocessors

5.1 The Customer authorizes Inleika to use the subprocessors listed at /legal/subprocessors.

5.2 Inleika will give at least 30 days' notice of a new subprocessor through that page and by email to the Customer's Owners.

5.3 The Customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of unused purchased Credits.

5.4 Inleika imposes data protection obligations on each subprocessor that are no less protective than this DPA. It remains responsible for its subprocessors.

6. International transfers

6.1 Customer Data is processed in the United States and in the locations of the listed subprocessors.

6.2 The Customer is responsible for having a lawful basis for transferring data to Inleika, including any consent or notice its local law requires. For candidates who use the Service directly, Inleika also collects their express consent to the transfer to the United States.

6.3 Where the law requires contractual safeguards for international transfers, this DPA serves as those safeguards. The parties will sign any additional standard clauses a competent authority requires.

7. Assistance

7.1 Requests from individuals.

• Inleika will forward to the Customer, without undue delay, any request it receives from an individual about Customer Data.

• Inleika will help the Customer respond through the Service's features or as reasonably requested, within the deadlines that apply to the Customer.

  7.2 Impact assessments and regulators. Inleika will provide reasonable information for the Customer's impact assessments and consultations with authorities, including the AI in Hiring Notice.

8. Security breaches

8.1 Inleika will notify the Customer without undue delay after becoming aware of a security breach affecting Customer Data, targeting 72 hours.

8.2 The notice will describe:

• the nature of the breach;
• the affected data and individuals, where known;
• the likely consequences;
• the measures taken or proposed.

Inleika will update the Customer as it learns more.

8.3 Inleika will help the Customer meet its own breach-notification duties, including notifying affected individuals where required.

9. Deletion and return

9.1 For 30 days after the Business Terms end, the Customer can export Customer Data.

9.2 Inleika will then delete Customer Data within 30 days, except where the law requires it to be kept. In that case Inleika will keep it confidential and process it only for that purpose.

9.3 Inleika will confirm deletion in writing on request.

9.4 During the term, the Customer can delete Customer Data through the Service. Deletion also happens under Inleika's published retention periods.

10. Audits

10.1 Once a year, Inleika will provide on request:

• a written summary of its security measures;

• reasonable answers to the Customer's security questionnaire.

  10.2 If that is not sufficient to show compliance, or if a competent authority requires it, the Customer may conduct a remote audit:

• with 30 days' notice;
• during business hours;
• at its own cost;
• subject to confidentiality.

11. Liability

Each party's liability under this DPA is subject to the limits in the Business Terms.

12. Order of precedence

On the processing of Customer Data, this DPA prevails over the Business Terms if they conflict.

---

Annex 1: Security measures

• Access control:
  • access is based on role and organization;
  • every query on Customer Data is restricted to the Customer's organization in the application layer, with tests to prove it;
  • candidate and organization authentication are kept separate;
  • privileged database connections are restricted.
• Authentication: handled by a specialized provider. It supports multi-factor authentication, passkeys and single sign-on for organizations.
• Encryption: in transit (TLS). At rest, the hosting and storage providers' native encryption.
• Logging hygiene:
  • personal data and confidential content are excluded from application logs, traces and error reports;
  • error monitoring runs with personal data collection turned off.
• AI safeguards:
  • an independent review of every sentence the AI interviewer says, so confidential preparation is not disclosed;
  • human approval for consequential actions;
  • no voice biometrics;
  • face comparison only with the candidate's consent, without keeping face templates;
  • no AI model training on Customer Data.
• Interview media: no audio or video recording is kept. Text transcripts and who joined and left the meeting are stored and, when the candidate consents to face comparison, a few still images of their face, each for its retention period in the Privacy Notice.
• Code challenge workspaces: each runs in isolation, runs a command only after an independent review allows it, and is deleted when the challenge ends. Recordings are signed, so any later change to them can be detected.
• Operational access: platform operator access to Customer Data is limited to support, safety and legal purposes, and is logged.
• Resilience: managed database backups and infrastructure monitoring by the hosting providers.
• Personnel: confidentiality obligations; least-privilege access.
• Incident response: a documented procedure for breach assessment and notification.