Data Processing Agreement

Effective: September 4, 2026 · applies to the Screen & Interview recruiting workspace

Template notice. This Data Processing Agreement (“DPA”) is provided so that teams using Resume Guide to process candidate data have the contract that EU, UK and similar privacy laws expect. It is a standard processor agreement and has not been reviewed by a lawyer for your specific situation; if your organisation needs bespoke terms or a countersigned copy, email support@resumeguide.ai.

1. Who this applies to and how it takes effect

This DPA forms part of the Terms of Service between Zenawi (“we”, the “Processor”) and the person or organisation that owns a Screen & Interview team or uses the recruiting workspace (“you”, the “Controller”). It takes effect the first time you upload, paste or otherwise process candidate personal data in the workspace, and it lasts for as long as we hold that data for you. If this DPA conflicts with the Terms, this DPA controls for the processing of candidate data.

2. Roles

For candidate data - the resumes you upload or paste, candidate names and contact details, fit scores and AI analysis, your notes, shared interviewer feedback and interview schedules - you are the controller (you decide why and how it is processed) and we are the processor (we process it only to provide the service to you). For your own account data (your email, your purchases, your usage) we act as an independent controller as described in the Privacy Policy.

3. What we process, and why

Subject matter: screening, scoring and interview preparation for job candidates you choose to evaluate.
Duration: for as long as you keep the candidate in your workspace, or until you or a team owner deletes it, or your account is deleted.
Nature and purpose: storing the data you provide, sending the relevant text to our AI provider to produce fit scores, summaries and interview guides, and displaying the results to you and to team members you have authorised.
Types of personal data: names, contact details, work and education history and any other information contained in a candidate’s resume or your notes. You must not upload special category data (health, religion, sexual orientation, political opinions, biometric or genetic data, criminal records) unless the law of your country permits it and you have a lawful basis.
Data subjects: job applicants and candidates you evaluate.

4. Our obligations as processor

Instructions. We process candidate data only on your documented instructions - which are the Terms, this DPA and your use of the workspace features - unless the law requires otherwise, in which case we will tell you first where we lawfully can.
Confidentiality. Access to candidate data is limited to what is needed to operate and support the service. Anyone we authorise is bound by confidentiality.
Security. We use the measures in Section 7.
Sub-processors. We use the providers listed in Section 6 of the Privacy Policy, each bound by written terms that protect the data at least as well as this DPA. We will update that list before adding a provider that handles candidate data; if you object on reasonable data-protection grounds you may stop using the workspace and delete your data, and we will refund any unused screening credits bought for the team.
Assistance. We will help you respond to candidates who exercise their rights (access, correction, deletion, objection), and with data protection impact assessments and consultations with regulators, to the extent the request concerns our processing.
Deletion and return. You can export or delete individual candidates at any time in the workspace. When you delete a candidate, a team or your account, we delete the associated candidate data from our systems, subject only to short-lived backups that expire on their normal schedule and to any legal retention duty.
Audit. On reasonable written request, no more than once a year unless a regulator requires it or a breach has occurred, we will provide the information reasonably necessary to demonstrate our compliance with this DPA, and will co-operate with an audit conducted by you or an independent auditor you appoint, at your cost, during business hours and without disrupting the service.

5. Your obligations as controller

You have a lawful basis to process each candidate’s data and to share it with us, and you have given candidates the privacy information your law requires.
You use the workspace in line with the fair-hiring obligations in Section 4a of the Terms of Service: fit scores and AI analysis are decision support, not decisions, and a human reviews every outcome that affects a candidate.
You keep your team’s access accurate - removing members who leave - and you are responsible for what your authorised members do in the workspace.
You do not upload data you have no right to process, including data about people who are not candidates.

6. Sub-processors and international transfers

Our application server and database are hosted in the United States, and our AI provider processes candidate text in the United States. If you are in the EU, the UK, Switzerland or another country that restricts international transfers, we rely on the standard contractual clauses or an equivalent lawful transfer mechanism with each provider, and on the safeguards in this DPA. Details of each provider are in Section 6 of the Privacy Policy.

7. Security measures

Encryption in transit (HTTPS/TLS) between your browser or app, our servers, and every provider.
Sign-in through Google Firebase Authentication, with email verification required and additional app-integrity checks (App Check).
Team-scoped access controls: candidate data is visible only to members of the team that owns it, with owner and admin roles.
Server-side validation of every upload, size limits, and protection against server-side request forgery in document rendering.
Rate limiting and abuse controls on all AI endpoints.
Access to production systems restricted to the operator, with credentials held as managed secrets rather than in code.
Deletion of candidate data, generated documents and uploaded files when you delete them or your account.

8. Personal data breaches

If we become aware of a personal data breach affecting candidate data we process for you, we will notify you without undue delay and in any case within 72 hours of becoming aware, at the email address on your account, with the information we have at that time and updates as we learn more. We will take reasonable steps to contain the breach and assist you with any notifications you are required to make.

9. Requests from candidates

If a candidate contacts us directly about data you control, we will not respond on the merits but will promptly forward the request to you, unless the law requires us to respond. You can fulfil most requests yourself by exporting or deleting the candidate in the workspace.

10. Liability and term

Each party’s liability under this DPA is subject to the limitation of liability in the Terms of Service. This DPA ends when we no longer process candidate data for you and have deleted it as described in Section 4.

11. Changes

We may update this DPA to reflect changes in the law or in the service. We will post the new version here with a new effective date; material changes will also be announced in the workspace. Continuing to process candidate data after the effective date means you accept the updated DPA.

12. Contact

Data protection questions, sub-processor objections, audit requests and breach reports: support@resumeguide.ai.