Data Processing Addendum

1. Introduction and Definitions

This Data Processing Addendum ("DPA") forms part of the agreement between CoreHire ("CoreHire", "Processor") and the customer using the CoreHire platform ("Customer", "Controller"). It describes how CoreHire processes personal data on behalf of the Customer. Capitalized terms not defined here have the meaning given in the Terms of Service.

2. Roles of the Parties

For candidate personal data submitted to or collected through the platform, the Customer is the controller and CoreHire is the processor. Each party will comply with the data protection laws that apply to it. For account and billing data relating to the Customer's own users, CoreHire acts as an independent controller as described in the Privacy Policy.

3. Subject Matter and Duration

The subject matter of processing is the provision of the CoreHire hiring platform, including candidate assessments, scoring, interview management, and automated communications. Processing continues for the term of the Customer's subscription and until candidate data is deleted or returned under this DPA.

4. Processing Instructions

CoreHire will process candidate personal data only on the Customer's documented instructions, which consist of the agreement, this DPA, and the Customer's configuration and use of the platform. CoreHire will inform the Customer if it believes an instruction infringes applicable data protection law.

5. Confidentiality

CoreHire ensures that personnel authorized to process candidate personal data are bound by appropriate confidentiality obligations and access the data only as needed to provide the service.

6. Security Measures

CoreHire implements appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit.
• Role-based access controls and row-level data segregation between customers.
• Audit logging of access to sensitive records.
• Authentication safeguards, including optional two-factor authentication.

7. Subprocessors

The Customer authorizes CoreHire to engage subprocessors to process candidate personal data. The current list is available at https://corehire.app/subprocessors. CoreHire will give the Customer at least 30 days' notice of any intended addition or replacement of a subprocessor, during which the Customer may object on reasonable data protection grounds. CoreHire remains responsible for its subprocessors' performance and imposes data protection obligations on them that are no less protective than those in this DPA.

8. Data Subject Requests

Taking into account the nature of the processing, CoreHire will provide reasonable assistance to the Customer in responding to requests from individuals to exercise their rights under applicable data protection law. If CoreHire receives such a request directly, it will direct the individual to the Customer where the Customer can be identified.

9. Personal Data Breach Notification

CoreHire will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's candidate personal data, and will provide information reasonably available to help the Customer meet its own notification obligations.

10. International Transfers

Where processing involves a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses approved by the European Commission (and the UK addendum, where applicable) apply and are incorporated into this DPA by reference.

11. Deletion or Return of Data

On termination or expiry of the agreement, and at the Customer's choice, CoreHire will delete or return candidate personal data, unless retention is required by law. The Customer may also delete candidate records at any time through the platform.

12. Audits

CoreHire will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor appointed by the Customer, on reasonable notice and subject to confidentiality and reasonable scope limits.

13. Contact Us

Questions about this DPA can be sent to hello@corehire.app.