Data Processing Addendum

1. Purpose of this Addendum

This Addendum, together with Section 5.6 of our Terms of Service, is the written mandate under which you entrust personal information to us, as required by section 18.3 of the Act respecting the protection of personal information in the private sector (CQLR, chapter P-39.1). It supplements the Terms of Service. Where they differ, this Addendum prevails with respect to personal information. Terms defined in the Terms of Service, such as "Customer Data" and "Services", have the same meaning here.

Section 18.3 requires the enterprise that entrusts a mandate to:

"(1) entrust the mandate or contract in writing; and
(2) specify in the mandate or contract the measures the mandatary or the person performing the contract must take to protect the confidentiality of the personal information communicated, to ensure that the information is used only for carrying out the mandate or performing the contract and to ensure that the mandatary or person does not keep the information after the expiry of the mandate or contract."

The sections below set out those measures.

2. Subject Matter and Purposes

We process Customer Data solely to:

• Structure and analyze candidate information
• Provide ranking, summarization, and rediscovery features
• Deliver secure storage and retrieval functionality
• Improve system performance and reliability

We do not sell Customer Data. We do not use Customer Data to train public AI models.

3. Personal Information and Persons Concerned

The persons concerned are the candidates and contacts whose information you place in the Services, and your own staff who use the Services. The personal information may include:

• Names
• Contact information (email, phone)
• Employment history
• Education history
• Professional qualifications
• Recruiter notes
• Interview summaries and meeting transcripts
• Uploaded CVs and documents
• Communication records sent and received via the platform

Because CVs may contain additional information, it may also include sensitive personal information, such as gender, date of birth, national origin, photographs and information voluntarily disclosed in resumes.

4. Your Instructions

We process Customer Data only on your instructions. Your instructions are this Addendum, the Terms of Service, and the settings and actions you and your users choose in the Services. You decide what personal information you place in the Services and how long you keep it. You are responsible for having a lawful basis to collect it and to entrust it to us.

5. Use Only for the Mandate

We use Customer Data only to carry out the Services described in the Terms of Service, and for no other purpose. Access by our personnel is limited to those who need it for support, maintenance and security, through individually identified accounts, under confidentiality obligations.

6. Confidentiality and Security Measures

We protect the confidentiality of Customer Data with measures that include:

• Encryption in transit and at rest
• Access controls
• Logical separation between customer accounts
• Regular system monitoring
• Application logs that exclude personal data
• Encryption of the credentials we hold for third-party integrations

No system can be guaranteed fully secure.

7. Subprocessors and Communication Outside Quebec

You authorize us to use the following subprocessors, which are also listed in Section 5.4 of the Terms of Service:

• Amazon Web Services - hosting, file storage, backups and outbound email (Montreal, Quebec, with disaster-recovery copies in Calgary, Alberta)
• OpenAI - AI processing (United States)
• Google Cloud - optical character recognition (Montreal, Canada)
• Cloudflare - network protection and content delivery (global network)
• Twilio - SMS delivery, including verification codes (United States)
• Datadog - system monitoring and logging (United States)
• PostHog - product usage analytics (United States)
• Pusher - real-time updates (United States)

Google Maps (geocoding and address suggestions) is used under Google's terms as an independent controller, not as our subprocessor.

We require comparable confidentiality commitments from each subprocessor. We remain responsible to you for the performance of each subprocessor's obligations.

We communicate Customer Data outside Quebec only to the providers, and for the purposes, listed in Section 8 of our Privacy Policy, after a privacy impact assessment and under a written agreement with each. On request, we will give you the information you reasonably need to carry out your own privacy impact assessment under section 17 of the Act.

We will give at least 30 days' notice by email to your account administrator, and on this page, before adding or replacing a subprocessor or a recipient outside Quebec. You may object in writing within that period on reasonable grounds relating to the protection of personal information. If we cannot address the objection, you may terminate the affected Services before the change takes effect and receive a refund of prepaid fees for the remaining period. In an emergency affecting the security or continuity of the Services, we may make the change with shorter notice and will tell you why.

8. Assistance with Requests from Persons Concerned

We help you respond to requests to access, correct or delete personal information. In the Services you can correct a candidate's information, export a candidate's data in a structured format, and permanently purge a candidate's personal information and files. Where you offer the candidate portal, candidates can download a copy of their own data there. If we receive a request directly, we will redirect it to you unless the law requires otherwise.

9. Confidentiality Incidents

We will notify your privacy officer without delay, and in any case within 72 hours, of any violation or attempted violation by any person of the confidentiality obligations that apply to Customer Data. We will give you the information you need to meet your own legal obligations, and take reasonable measures to reduce the risk of injury and to prevent similar incidents.

10. Verification by Your Privacy Officer

We will allow your privacy officer to conduct any verification relating to the confidentiality requirements of this Addendum, on reasonable notice, by questionnaire, by review of our documentation, including the parts of our privacy impact assessment that concern your data, or, where those are not sufficient, by an audit at your expense.

11. Return and Deletion at the End of the Mandate

When your account ends:

• We will retain Customer Data for up to 30 days to allow export.
• After that period, Customer Data is deleted from active systems.
• Backup copies, including disaster-recovery copies in Calgary, Alberta, are deleted within 30 days after the data is deleted from active systems.

We do not keep Customer Data after the mandate ends beyond these periods.

12. Governing Law

This Addendum is governed by the laws of Quebec and the applicable federal laws of Canada. Disputes shall be resolved in Montreal, Quebec.

13. Contact