Data Processing Addendum

Last updated: March 2025

1. Introduction

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer" / "Controller") and TalentGPT ("Processor"). It governs the processing of Personal Data (as defined below) in connection with the Service.

2. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person (e.g., candidate names, contact details, work history).
  • "Processing" means any operation performed on Personal Data, including collection, storage, evaluation, and deletion.
  • "Controller" means the entity that determines the purposes and means of Processing (you, the Customer).
  • "Processor" means the entity that Processes Personal Data on behalf of the Controller (TalentGPT).

3. Roles & Responsibilities

Customer (Controller): Determines which candidates to evaluate, what criteria to apply, and when to export shortlists. Responsible for compliance with employment laws, consent for outreach, and data subject rights requests.

TalentGPT (Processor): Processes candidate resumes per your instructions, generates outcome signals, and provides explainable rankings. Does not make final hiring decisions or contact candidates without your direction.

4. Scope of Processing

Subject matter: Pre-employment evaluation and candidate ranking for recruiting purposes.

Duration: For the term of your Service agreement plus retention period (default: active search + 90 days).

Nature: Automated evaluation of resume text, generation of outcome signals (retention risk, 90-day success, etc.), and export of shortlists.

Categories of data: Candidate contact info, work history, education, skills, certifications, and derived signals (scores, reason codes).

5. Processor Obligations

  • Process Personal Data only per your documented instructions
  • Ensure employees processing data are bound by confidentiality obligations
  • Implement appropriate technical and organizational security measures
  • Assist with data subject rights requests (access, rectification, deletion)
  • Notify you of any personal data breach without undue delay
  • Delete or return Personal Data upon termination (unless legal attrition required)
  • Make available information to demonstrate compliance (audit rights)

6. Sub-Processors

TalentGPT may engage sub-processors (e.g., cloud hosting, AI model providers) to assist with Service delivery. Current sub-processors include:

  • AWS (cloud infrastructure) - USA
  • Google Cloud AI (model inference) - USA
  • Stripe (payment processing) - USA

We will notify you of any new sub-processor at least 30 days in advance. You may object on reasonable data protection grounds.

7. International Transfers

If Personal Data is transferred outside India or the EEA, we ensure adequate protection via:

  • Standard Contractual Clauses (SCCs) approved by relevant authorities
  • Adequacy decisions (where applicable)
  • Additional safeguards (encryption, access controls)

8. Security Measures

TalentGPT implements:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Role-based access controls with MFA
  • Regular vulnerability scans and penetration testing
  • Incident response plan with 72-hour breach notification
  • Separation of production and development environments

9. Data Subject Rights

If a candidate exercises rights (access, rectification, deletion, portability), notify us promptly. We will assist with fulfilling the request within 30 days or as required by applicable law.

Contact privacy@talentgpt.com for assistance.

10. Audit Rights

Upon reasonable notice (at least 30 days), you may audit our compliance with this DPA, subject to confidentiality obligations. Audits limited to once per year unless triggered by a breach or regulatory requirement.

11. Termination

Upon termination of the Service, we will delete or return all Personal Data within 30 days, except as required by law (e.g., tax records, legal holds). You may request a certificate of deletion.

12. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service. Nothing in this DPA reduces either party's liability for gross negligence, fraud, or willful misconduct.

13. Contact

For DPA-related questions, contact privacy@talentgpt.com.