Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer identified in the applicable order, account registration or terms of service ("Customer") and Craftwell Studios Private Limited, a company incorporated in India with its registered office in Mumbai, Maharashtra, operating the Hirevire platform at hirevire.com ("Hirevire") (together the "Agreement"). It reflects the parties’ agreement on the processing of personal data under Article 28 GDPR.

No signature is required: this DPA is incorporated into the Agreement and takes effect when the Customer accepts the Agreement or uses the Service. Customers who require a countersigned copy may request one at [email protected].

1. Definitions

1.1 "GDPR" means Regulation (EU) 2016/679 and, where applicable, the UK GDPR as defined in the UK Data Protection Act 2018.

1.2 "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.3 "Customer Personal Data" means personal data processed by Hirevire on behalf of the Customer in providing the Service, principally data relating to job candidates and the Customer’s users.

1.4 "Service" means the Hirevire asynchronous video screening and candidate interview platform.

1.5 Terms such as "controller", "processor", "processing", "data subject" and "personal data breach" have the meanings given in the GDPR.

2. Roles and scope

2.1 The Customer is the controller of Customer Personal Data. Hirevire is the processor, acting on the Customer’s documented instructions.

2.2 For data Hirevire processes for its own purposes (customer account administration, billing, product analytics of customer users, marketing to customers) Hirevire acts as an independent controller, and that processing is governed by the Hirevire Privacy Policy, not this DPA.

2.3 This DPA applies where Customer Personal Data is subject to the GDPR, the UK GDPR, or the Swiss FADP.

3. Details of processing

3.1 The subject matter, duration, nature and purpose of processing, the categories of data subjects and of personal data, and the retention rules are set out in Annex I.

4. Customer instructions

4.1 Hirevire will process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by law to which Hirevire is subject; in that case Hirevire will inform the Customer of that legal requirement before processing, unless the law prohibits it.

4.2 The Agreement, this DPA, and the Customer’s configuration of and use of the Service (including enabling or disabling optional features, setting retention options, and instructing integrations) constitute the Customer’s complete documented instructions.

4.3 Hirevire will inform the Customer if, in its opinion, an instruction infringes the GDPR.

4.4 AI scoring is an instruction-gated feature. AI scoring of candidate responses (Annex I, activity 4) runs only where the Customer has enabled it. Its output is advisory and display-only: it does not sort, filter, hide or reject candidates, and the Customer remains responsible for ensuring human review of any decision and for its own Article 22 and transparency obligations toward candidates.

5. Confidentiality

5.1 Hirevire ensures that all persons authorised to process Customer Personal Data are bound by contractual or statutory obligations of confidentiality. Where Hirevire accesses Customer Personal Data to provide support or troubleshoot issues, that access is read-only.

6. Security

6.1 Hirevire implements and maintains the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as required by Article 32 GDPR.

6.2 Hirevire may update Annex II from time to time, provided the updates do not materially reduce the overall level of protection.

7. Sub-processors

7.1 The Customer grants Hirevire general written authorisation to engage the sub-processors listed in Annex III.

7.2 Hirevire maintains its current sub-processor list in Annex III on this page. Hirevire will update that list when it adds or replaces a sub-processor, and the updated list constitutes notice of the change. The Customer may object on reasonable data-protection grounds within 15 days of the list being updated; if the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.

7.3 Hirevire imposes on each sub-processor, by written contract, data-protection obligations materially equivalent to those in this DPA, and remains fully liable to the Customer for the sub-processor’s performance.

7.4 Systems to which Hirevire transmits candidate data at the Customer’s instruction (applicant tracking systems such as Ashby, Recruitee, Manatal and Loxo; automation platforms such as Zapier, Make and Pabbly Connect; Google Drive; and webhook endpoints the Customer configures) are recipients designated by the Customer, not Hirevire sub-processors. The Customer is responsible for its relationship with those recipients.

8. Assistance to the Customer

8.1 Taking into account the nature of the processing, Hirevire will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). The Service provides self-serve tools for viewing and deleting candidate records; requests Hirevire receives directly from candidates will be forwarded to the Customer without undue delay.

8.2 Hirevire will assist the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of processing and the information available to Hirevire.

9. Personal data breach

9.1 Hirevire will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Information may be provided in phases as it becomes available.

10. Deletion and return

10.1 During the term, candidate video and audio recordings are deleted within 90 days of upload by default; the Customer may purchase extended storage. Other candidate data is retained until the Customer deletes the record or the account (see Annex I).

10.2 On termination of the Agreement, Hirevire will delete all Customer Personal Data across all stores and sub-processors, unless EU or Member State law requires storage. Before termination, the Customer may export candidate data via the Service or request assistance with export.

10.3 Deleted data may persist in encrypted point-in-time-recovery backups for up to 7 days before ageing out; backups are not used for any other purpose and deletion is not reversed from backup except at the Customer’s request within that window.

10.4 On request, Hirevire will confirm deletion in writing.

11. Audits and information

11.1 Hirevire will make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, including its Article 30(2) record of processing, sub-processor agreements (subject to confidentiality) and security documentation, and will respond to reasonable written security questionnaires.

11.2 Where the information above is insufficient, Hirevire will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable prior notice (at least 30 days), at most once per 12-month period unless a supervisory authority requires otherwise or a personal data breach has occurred, during business hours, and without disrupting other customers.

12. International transfers

12.1 India, where Hirevire is established and where the primary database is located, is not the subject of an adequacy decision under Article 45 GDPR. Transfers of Customer Personal Data from the Customer (as data exporter) to Hirevire (as data importer) are therefore made under the SCCs, Module Two (controller to processor), which are incorporated into this DPA by reference and completed as follows:

• Clause 7 (docking clause): included.
• Clause 9(a): Option 2 (general written authorisation), with notice given by updating the published sub-processor list as set out in Section 7.2.
• Clause 11(a): the optional independent-redress-body wording is not used.
• Clause 13 / Annex I.C: the competent supervisory authority is determined by Clause 13 (see Annex I.C).
• Clause 17: Option 1, the law of the Republic of Ireland.
• Clause 18(b): the courts of the Republic of Ireland.
• Annexes I, II and III of the SCCs are the Annexes I, II and III of this DPA.

12.2 In case of conflict between this DPA and the SCCs, the SCCs prevail.

12.3 UK and Switzerland. For transfers subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum (version B1.0), with Table 2 referencing the SCCs as completed above and the parties’ details as in Annex I.A. For transfers subject to the Swiss FADP, the SCCs apply with the adaptations required by the FDPIC: references to the GDPR are read as references to the FADP, the competent supervisory authority is the FDPIC, and "Member State" includes Switzerland.

12.4 Supplementary measures. Customer Personal Data is encrypted in transit and at rest; access is limited to named, authorised personnel; onward transfers to sub-processors rely on SCCs Module Three or, where the sub-processor is certified, the EU-U.S. Data Privacy Framework, as listed in Annex III. Hirevire will notify the Customer if it receives a legally binding request for access to Customer Personal Data from a public authority, unless prohibited by law, and will challenge unlawful or overbroad requests.

13. Liability and precedence

13.1 Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where the GDPR or the SCCs do not permit such limitation (in particular, nothing limits either party’s liability to data subjects under Clause 12 of the SCCs).

13.2 In case of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Agreement.

14. Term

14.1 This DPA takes effect on the date the Agreement takes effect and remains in force as long as Hirevire processes Customer Personal Data.

Annex I – Description of processing

A. List of parties

Data exporter. The Customer, as identified in the applicable order, account registration or acceptance of the Agreement. Address: as provided in the Customer’s account. Contact: the Customer’s account owner. Role: controller. Activities relevant to the transfer: use of the Hirevire platform to collect and evaluate candidate screening responses for the Customer’s recruitment purposes. By accepting the Agreement, the data exporter is deemed to have signed the SCCs, including their Annexes, as of the date of acceptance.

Data importer. Craftwell Studios Private Limited (trading as Hirevire). Address: Mumbai, Maharashtra, India (full registered address available on request at [email protected]). Contact: [email protected]. Role: processor. Activities relevant to the transfer: provision of the Hirevire asynchronous video screening and candidate interview platform. By publishing this DPA and providing the Service, the data importer is deemed to have signed the SCCs, including their Annexes.

B. Description of transfer

Categories of data subjects

• Job candidates and applicants who respond to the Customer’s screening questions
• The Customer’s users (recruiters, hiring managers, admins), to the extent their data appears in reviews, ratings, comments and workspace records

Categories of personal data

• Candidate identification and contact data: name, email address, phone number
• Application content: files uploaded in response to questions, including CVs and resumes; answers to text and multiple-choice screening questions
• Media: video, audio and screen recordings containing the candidate’s image, likeness and voice; recording metadata (device, browser, timestamps)
• Derived data: transcripts and captions of candidate speech; processed media renditions
• AI evaluation output (only where enabled by the Customer): numeric scores and written evaluations of candidate responses
• Review data: ratings, scores, comments and decision status entered by the Customer’s users
• Notification data: message content and delivery metadata for candidate-facing emails sent on the Customer’s behalf

Sensitive data. The Service does not solicit special-category data and does not process data for the purpose of inferring special-category attributes. Candidates may volunteer special-category data in free-text answers, uploaded files, or recordings (for example, their image and voice may reveal information about them); such data is processed only as part of the content it appears in, protected by the measures in Annex II, and subject to the same retention and deletion rules as the surrounding record.

Frequency of the transfer. Continuous, for the duration of the Agreement.

Nature and purpose of the processing. Collection, storage, transcoding, transcription, display, evaluation support, transmission at the Customer’s instruction, and deletion of candidate screening responses, comprising the following processing activities (Hirevire’s Article 30(2) record, available on request, gives full detail):

• Candidate application intake through job links and career pages
• Recording, upload, transcoding, storage and delivery of candidate video, audio and screen responses
• Transcription and captioning of recordings
• AI scoring of candidate responses (opt-in per Customer; advisory and display-only)
• Response review, rating and sharing within the Customer’s hiring team
• Candidate-facing notification emails sent on the Customer’s behalf
• Outbound integrations and webhooks to Customer-nominated destinations
• Data subject request support and deletion
• Read-only support access when troubleshooting Customer-reported issues

Retention

• Video and audio recordings: deleted within 90 days of upload by default; the Customer may purchase extended storage
• All other candidate data (profiles, answers, files, transcripts, AI output, review data): retained until the Customer deletes the record or the account
• All candidate data is deleted on account termination; deleted data may persist in point-in-time-recovery backups for up to 7 days

Transfers to sub-processors. As set out in Annex III; onward-transfer safeguards per sub-processor are listed there.

C. Competent supervisory authority. The competent supervisory authority is determined in accordance with Clause 13 of the SCCs: where the data exporter is established in an EU Member State, the supervisory authority of that Member State; otherwise, the supervisory authority of the Member State in which the exporter’s Article 27 representative is established or in which the data subjects whose data is transferred are located. For transfers subject to the UK GDPR, the Information Commissioner’s Office; for transfers subject to the Swiss FADP, the Federal Data Protection and Information Commissioner.

Annex II – Technical and organisational measures

Encryption and network security

• TLS 1.2+ for all data in transit
• Encryption at rest across all data stores (database, object storage, media storage)
• No public bucket exposure; candidate files served via signed URLs
• Web application firewall and CDN-level protections (Cloudflare)

Access control

• Access to production systems and Customer Personal Data is limited to a small number of named, authorised personnel
• Role-based access control (RBAC) within each Customer workspace, configured by the Customer
• Tenant isolation between Customer workspaces
• Support access to Customer workspaces is read-only and logged; no data is extracted or retained outside the platform
• Candidate response share links carry an expiry, optional password protection, and a noindex directive

Media and AI pipeline controls

• Transcription runs within Cloudflare Workers AI; Cloudflare does not train on customer data
• AI scoring uses the OpenAI API with Zero Data Retention: transcripts are not persisted by OpenAI and are not used for training
• AI scoring is opt-in per Customer and its output is advisory and display-only

Data lifecycle

• Default deletion of candidate video and audio within 90 days of upload
• Deletion propagates across all stores (database, media storage, transcripts, caches), with written confirmation to the controller on request; deletion actions are recorded
• Point-in-time-recovery backups age out within 7 days

Organisational measures

• Written data processing agreements with all sub-processors (Annex III)
• Confidentiality obligations on all persons authorised to process personal data
• Records of processing activities maintained under Article 30
• Incident response: customer notification within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data

Assistance to the controller

• Self-serve tools for candidate record access and deletion
• Candidate requests received directly are forwarded to the controller without undue delay
• Security documentation and the Article 30(2) record available to customers on request

Measures for sub-processor transfers

• Sub-processors are bound by SCCs Module Three or are certified under the EU-U.S. Data Privacy Framework, as listed in Annex III
• Sub-processor contracts impose obligations materially equivalent to this DPA

Annex III – Authorised sub-processors

Sub-processors that process Customer Personal Data (candidate data). Vendors that process only Hirevire’s own controller data (for example billing, analytics of customer users, marketing) are listed in the Hirevire Privacy Policy and are outside this Annex.

Changes to this list follow the notice-and-objection process in Section 7 of this DPA.

Questions about this DPA: [email protected]