Data Processing Addendum

1. Scope and roles

This DPA applies to personal data Vashly processes on Customer’s behalf under the Agreement (“Customer Personal Data”). Customer acts as controller and Vashly as processor. Where Customer is itself a processor, Customer must be authorised to appoint Vashly as a subprocessor and provide the relevant instructions.

Vashly’s independent-controller activities, including account administration, billing, security, business communications and professional-data processing undertaken for its own purposes, are described in the Privacy Notice. Roles depend on the particular activity; not all Candidate Intelligence processing is performed on Customer’s behalf.

“Personal data”, “controller”, “processor”, “processing” and “personal data breach” have the meanings given in Regulation (EU) 2016/679 (“GDPR”).

2. Instructions and Customer responsibilities

Customer instructs Vashly to process Customer Personal Data to provide the Service under the Agreement, this DPA, the applicable order, Customer’s configuration and authorised use. Additional instructions must be documented and agreed where they change the scope of the Service.

Customer is responsible for lawful collection and disclosure, required privacy information and lawful bases, the relevance of submitted data, and its own recruitment and outreach decisions. Customer must not submit prohibited sensitive information or instruct unlawful processing.

Vashly will process Customer Personal Data only on documented instructions, including instructions concerning transfers, unless EU or Member State law requires otherwise. Where legally permitted, Vashly will inform Customer of that requirement before processing. Vashly will promptly inform Customer if, in its opinion, an instruction infringes applicable data-protection law and may suspend that instruction pending resolution.

3. Confidentiality and permitted use

Vashly will restrict access to authorised personnel who need it for their duties and are subject to confidentiality obligations. Customer Personal Data will not be used for unrelated advertising or other unrelated purposes under this DPA. Private customer workspace content will not be used to train publicly available foundation models.

4. Security

Vashly will maintain technical and organisational measures appropriate to the processing risks, taking account of the nature of the data, available technology, implementation costs and potential impact on individuals. Annex 2 describes the relevant measures. Changes to those measures will maintain appropriate protection.

5. Subprocessors and changes

Customer grants general written authorisation to engage the subprocessors identified on the Subprocessors and service providers page for the relevant processing. Vashly will impose substantially equivalent data-protection obligations and remains responsible to Customer for its subprocessors’ performance.

Vashly will give Customer at least 30 days’ advance email notice of material additions or replacements affecting Customer Personal Data. Customer may object on reasonable data-protection grounds by replying to the notice or emailing hello@vashly.com. Customer should notify Vashly before the proposed change takes effect so the parties can seek a resolution.

The parties will work in good faith to resolve the objection, including a reasonable alternative where feasible. If it cannot be resolved, Customer may terminate the affected service. Other commercial consequences are governed by the Agreement and applicable law.

6. International transfers

Production servers, databases, stored images and attachments, and database backups are hosted on Google Cloud in the europe-north1 region. This does not mean all external service-provider processing occurs in that region or exclusively in the EEA.

Transfers of Customer Personal Data outside the EEA will take place only on documented instructions and with a lawful transfer basis and necessary safeguards. Where required, these may include an applicable adequacy decision or executed European Commission Standard Contractual Clauses, together with necessary supplementary measures. This DPA does not itself complete or execute transfer clauses for a particular provider.

Contact hello@vashly.com for information about the safeguards relevant to your processing.

7. Requests from individuals

Taking account of the nature of the processing, Vashly will assist Customer through appropriate measures in responding to requests under GDPR Chapter III. Vashly will notify Customer of a request concerning Customer Personal Data and will not respond substantively except on Customer’s instructions or as required by law. Customer remains responsible for its controller decisions.

8. Personal data breaches

Vashly will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. As information becomes available, the notification will describe the breach, affected data and individuals where known, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in stages.

Vashly will reasonably cooperate with Customer’s investigation and response. Customer remains responsible for its controller notifications to authorities and individuals. Contact hello@vashly.com about a suspected incident.

9. Assessments and regulatory assistance

Taking account of the nature of processing and information available to it, Vashly will assist Customer with its obligations under GDPR Articles 32–36, including security, breach notifications, data-protection impact assessments and prior consultation. Vashly will notify Customer of relevant authority requests unless prohibited by law and cooperate as legally required.

10. Information and audits

Vashly will make available information necessary to demonstrate compliance with its processor obligations and allow and contribute to audits, including inspections, by Customer or its mandated independent auditor. The parties will agree reasonable arrangements protecting other customers’ data, security and confidentiality without preventing legally required oversight.

11. Return and deletion

Customer can request export or deletion by emailing hello@vashly.com. Both are handled manually. Account closure or subscription termination does not automatically delete workspace data. Vashly will verify the requester’s authority and agree the relevant workspace and data scope, including any shared-team records.

At the end of the relevant processing services, Vashly will, at Customer’s choice, return or delete Customer Personal Data and delete existing copies unless EU or Member State law requires storage. Vashly will handle export and deletion requests without undue delay and within one month of receipt.

Deletion removes the relevant data from active systems and caches. Database backups expire through their normal one-month retention lifecycle. Deleted objects covered by the Storage bucket’s soft delete policy remain recoverable for seven days. These recovery periods are separate from active-system deletion and are not a promise of immediate permanent erasure of every copy.

Recovery copies awaiting expiry will remain protected and outside ordinary use. If restored, applicable deletion and suppression requests will be reapplied. Vashly may retain minimal suppression information where necessary to honour objections and prevent reintroduction or further contact. Data required by law will be restricted to that purpose. Records lawfully processed independently as controller remain subject to the Privacy Notice and their applicable legal basis.

12. Term and priority

This DPA applies for as long as Vashly processes Customer Personal Data on Customer’s behalf. It prevails over conflicting Agreement terms concerning that processing. Applicable executed transfer clauses prevail where required. Other commercial terms remain governed by the Agreement, subject to mandatory law.

Annex 1. Processing details

Subject matter, purpose and duration

Hosting and operating customer workspaces, candidate workflows, Opportunity Content and customer-authorised communications. Processing supports configured features, support and security under Customer’s instructions, during the service term and the applicable return/deletion period.

Nature and frequency

Ongoing storage and feature-triggered collection, organisation, retrieval, search, enrichment, matching assistance, content generation, display, transmission, export, correction and deletion, where performed on Customer’s behalf.

Categories of individuals and data

Customer users and team members; candidates and professional prospects; recipients and correspondents; and individuals included in submitted content. Data may include names, professional profiles and identifiers, work and personal email information where processed through enrichment, employment, education, skills, public-work evidence, role requirements, customer notes and status, prompts and generated copy, team content and uploaded media, message content, questions, reply addresses, thread identifiers, engagement metadata and relevant linked-account information.

Sensitive information

Special-category, criminal-conviction, children’s and other prohibited highly sensitive data are not intended inputs. Customer must not submit such data without express agreement and legally required safeguards.

Annex 2. Technical and organisational measures

• HTTPS transport protection and production secure-cookie settings for relevant web sessions.
• Authentication, team roles and application access controls for customer workspaces.
• Production hosting and stored files on Google Cloud in europe-north1.
• Database backups twice daily, retained for one month; a seven-day soft delete policy on the confirmed Storage bucket.
• Application and proxy logging, service health checks and background-processing controls.
• Access restricted to authorised processing, confidentiality obligations and assistance with requests and incidents as described above.

These measures do not represent a certification, a guaranteed recovery time, or a commitment that all external providers process data only within the EEA.