Data Processing Agreement

1. Definitions

• "Customer Personal Data" means personal data (personal information, under PIPEDA) that Hyrr processes on behalf of the Customer in providing the Services.
• "Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR. Under PIPEDA, the Customer is the organization accountable for the personal information it transfers to Hyrr for processing, and Hyrr is the third party processing it.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data; under PIPEDA, a "breach of security safeguards".
• "Subprocessor" means a third party engaged by Hyrr that processes Customer Personal Data.
• Other capitalized terms have the meanings given in the Agreement.

2. Roles and Scope

The Customer is the controller of Customer Personal Data and Hyrr is its processor (a "service provider" under the CCPA). Where the Customer is itself a processor for another controller, Hyrr is its subprocessor and the Customer confirms that its instructions are authorized by that controller.

This DPA does not cover personal data for which Hyrr is the controller, such as Hyrr's own account, billing and website data, and the features a candidate uses for their own Hyrr account. That data is handled as our Privacy Policy describes.

3. Details of the Processing

• Subject matter: the provision of the Services to the Customer under the Agreement.
• Duration: the term of the Agreement, and afterwards until the Customer Personal Data is deleted or returned under Section 12.
• Nature and purpose: hosting and storage; résumé screening against the Customer's criteria; conducting, recording and transcribing AI interviews in the browser or by phone; assessing answers against the Customer's scorecard and writing reports; identity verification when the Customer turns it on; scheduling, email and text-message notifications; the human-interview assistant (Copilot) and applicant-tracking or HR system connections when the Customer turns them on; search and candidate matching; talent management for the Customer's employees; reporting to the Customer; and support.
• Categories of data subjects: candidates and applicants, including people the Customer invites or imports; the Customer's authorized users; the Customer's employees, where the Customer uses talent management; and interviewers and other participants in interviews the Customer records with Copilot.
• Categories of personal data: names and contact details; résumés, work history, education and skills; application and form answers; interview audio and video recordings, transcripts and interview workspace content (code, whiteboard drawings and AI exercises); integrity events during an interview; assessments, scores, reports, decisions and human-review requests; the result of an identity check; employee records (role, team, manager, skills, assessment results and assigned learning); authorized users' account details and activity logs; and device, browser and connection metadata.
• Sensitive data: Hyrr does not ask for special categories of personal data, and the AI is instructed not to use or infer them, but a candidate may disclose them in a résumé or an answer. When the Customer turns on identity verification, Stripe Identity processes ID document images and a selfie on Hyrr's behalf, as Section 10 describes.

4. Processing on Documented Instructions

Hyrr processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's configuration and use of the Services are the Customer's complete instructions; further instructions must be agreed in writing. Hyrr may process Customer Personal Data otherwise only where the law requires it, and will tell the Customer before it does unless the law forbids that. Hyrr will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law.

The Customer is responsible for the lawfulness of its instructions and of the personal data it provides, including any notice, consent or legal basis the processing needs, and any disclosure the law requires of it, such as disclosing the use of AI in publicly advertised job postings under the Ontario Employment Standards Act.

5. No Training, No Sale

Hyrr does not use Customer Personal Data to train or fine-tune AI models, and its AI Subprocessors process it under terms that prohibit training on Hyrr's data. Hyrr does not keep copies of Customer Personal Data, anonymized or otherwise, for that purpose (see Privacy Policy, Section 3.3).

Hyrr does not sell or share Customer Personal Data (as the CCPA uses those words), does not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Services, and does not combine it with personal data it receives from others except as the Services require.

6. Confidentiality of Personnel

Hyrr limits access to Customer Personal Data to personnel who need it to provide, secure or support the Services, and ensures that everyone authorized to process it is bound by an obligation of confidentiality and has received data-protection and security training.

7. Security

Hyrr implements and maintains the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Personal Data Breaches and are appropriate to the risk. Hyrr may update them, provided the overall level of protection is not reduced.

8. Subprocessors

The Customer gives Hyrr general authorization to engage the Subprocessors listed at hyrr.ai/subprocessors, which states each one's purpose, the data it handles, where it processes it and the transfer safeguard. Providers marked optional there receive data only when the Customer turns on the feature that uses them.

• Hyrr binds each Subprocessor by a written agreement with data-protection obligations no less protective than this DPA, including the prohibition on training AI models on Hyrr's data.
• Hyrr will notify the Customer's administrators by email at least 30 days before a new Subprocessor begins processing Customer Personal Data, and update the Subprocessors page at the same time.
• The Customer may object to a new Subprocessor on reasonable data-protection grounds by writing to Hyrr within that period. The parties will try in good faith to resolve the objection; if they cannot, the Customer may terminate the affected Services without penalty, and Hyrr will refund any fees prepaid for them for the period after termination.
• Hyrr remains responsible to the Customer for each Subprocessor's performance of its data-protection obligations.

9. Data Subject Requests and Assistance

The Services give the Customer tools to find, export, correct and delete the personal data of a candidate or employee, and to review and decide on AI-assisted results, including a candidate's request for a human review. Taking account of the nature of the processing, Hyrr will also give the Customer reasonable assistance in responding to requests from data subjects exercising their rights under Data Protection Law.

If Hyrr receives such a request directly about Customer Personal Data, it will forward it to the Customer without undue delay and will not respond to it, other than to tell the person that it has been passed to the Customer, unless the Customer authorizes it to.

Hyrr will give the Customer the information it reasonably needs to carry out data protection impact assessments and prior consultations with supervisory authorities relating to the Services.

10. Identity Verification

When the Customer requires identity verification, the check is performed by Stripe Identity. Hyrr does not store ID document images or a template of the candidate's face: the images are held by Stripe, and Hyrr keeps only the result of the check. A selfie may be compared with frames of the interview recording to confirm that the verified person took the interview; it is used only for that comparison and is not kept by Hyrr. Hyrr does not create or keep voiceprints.

11. Personal Data Breach Notification

Hyrr will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and Hyrr will supplement it as more becomes known.

Hyrr will take reasonable steps to contain and remedy the breach and will cooperate with the Customer so it can meet its own obligations to notify regulators and affected individuals and to keep records of breaches. A notification is not an admission of fault.

12. Retention, Return and Deletion

During the term, the Customer sets how long applications and interviews are kept: 1, 2, 3 or 7 years after the last activity on an application, or until the Customer deletes them. The default is 7 years. When the period ends, the personal content (contact details, résumé, recordings, transcripts, answers and reports) is deleted, and only an anonymized record that no longer identifies anyone is kept. The Customer may delete records sooner at any time.

On termination of the Agreement, or on the Customer's written request, Hyrr will delete or, at the Customer's choice, return Customer Personal Data within 30 days, unless the law requires Hyrr to keep it, in which case Hyrr will keep it confidential and process it only for that purpose. The Customer can export its data from the Services before then. Copies in backups are deleted as the backups age out, within 98 days, and are not restored meanwhile except for disaster recovery.

13. Data Location and International Transfers

Customer Personal Data is stored and processed in the United States, on Google Cloud. Subprocessors process it where the Subprocessors page states. Transfers are made under the safeguards described in Section 11 of our Privacy Policy.

Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (European Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For those clauses:

• the Customer is the data exporter and Hyrr the data importer;
• Clause 7 (docking) applies; under Clause 9, option 2 (general written authorization) applies, with the notice period in Section 8 of this DPA; the option in Clause 11 does not apply;
• Clauses 17 and 18: the law and the courts of Ireland;
• Annex I is Section 3 of this DPA, Annex II is Annex 2, and Annex III is the list at hyrr.ai/subprocessors;
• for transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU clauses, issued by the Information Commissioner, is incorporated, and for transfers from Switzerland the clauses apply as adapted for the Swiss Federal Act on Data Protection.

For personal information subject to PIPEDA or provincial law, Hyrr protects it by the contractual and technical means in this DPA wherever it is processed, and the Customer remains accountable for it as that law provides. If this DPA and the Standard Contractual Clauses conflict, the clauses prevail.

14. Audits and Information

Hyrr will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. It does so through its SOC 2 Type 2 report once issued (the audit is in progress), provided under confidentiality; through its trust centre at trust.hyrr.ai; and by answering a reasonable security questionnaire once a year.

An on-site audit or inspection takes place only where Data Protection Law or a supervisory authority requires it and the information above does not satisfy that requirement. It must be requested in writing at least 30 days ahead, conducted during business hours by the Customer or an independent auditor bound by confidentiality, scoped to avoid disrupting Hyrr's operations and the confidentiality of other customers' data, and carried out at the Customer's cost.

15. Liability

Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement: the Master Services Agreement where one is signed, otherwise the Company Terms and Conditions.

16. Precedence, Changes and Governing Law

• Precedence: on data protection, this DPA prevails over the rest of the Agreement, and the Standard Contractual Clauses prevail over this DPA. A data processing agreement signed by Hyrr and the Customer prevails over this published version.
• Changes: Hyrr may update this DPA to reflect changes in law or in the Services. It will notify the Customer's administrators by email at least 30 days before a material change takes effect, and no change will reduce the overall protection of Customer Personal Data.
• Governing law: this DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, except where Data Protection Law or the Standard Contractual Clauses require otherwise, and disputes are resolved as the Agreement provides.

Annex 2: Technical and Organizational Security Measures

• Encryption: data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
• Access control: role-based access with least privilege; each customer's data is separated from every other customer's; staff access is limited to those who need it and is revoked promptly when a role changes or ends; customers can require single sign-on for their users.
• Logging and monitoring: security-relevant events and administrative actions are logged and monitored, and customers can review their account's activity in its audit log.
• Secure development: code review, and automated security and dependency scanning before release.
• Availability and recovery: regular backups, with disaster recovery procedures.
• Incident response: a documented incident response plan, including the notification in Section 11.
• Personnel: confidentiality obligations and data-protection and security training.
• Subprocessors: bound by written agreements as Section 8 describes.
• Minimization: only the data each service needs is kept, for example only the result of an identity check.
• Assurance: controls are operated to the SOC 2 Trust Services Criteria; Hyrr's SOC 2 Type 2 audit is in progress.