Data processing addendum

Status, parties, and precedence

This Data Processing Addendum is a product-complete draft and is not binding until it is approved and incorporated into an effective agreement between hirehint LLC and the customer identified in the applicable order.

If approved documents conflict about processing customer-controlled personal data, the final agreement must state the order of precedence among this addendum, the order, the main service terms, approved standard contractual clauses, and any jurisdiction-specific schedule.

Processing roles

The customer generally determines why and how candidate, employee, hiring-team, and workforce information is used in its workspace. For that customer-controlled information, the customer acts as controller or business and HireHint acts as processor, service provider, or contractor as applicable.

HireHint may act as an independent controller for its own account administration, security, support, billing administration, service communications, and legal obligations. Those activities are governed by the approved Privacy Policy rather than the customer’s processing instructions.

Processing details

People and data covered

The customer must identify any special-category, sensitive, regulated, biometric, health, background-check, financial, or government-identifier data it intends to process and obtain written approval where the final agreement requires it.

Documented customer instructions

HireHint should process customer-controlled personal data only on documented instructions contained in the approved agreement, customer configuration, authorized product action, or verified support request. HireHint should notify the customer when it believes an instruction violates applicable data-protection law, unless law prohibits that notice.

An instruction does not authorize bypassing tenant, role, scope, record, workflow, or provider controls. HireHint may refuse or safely constrain an instruction that cannot be authenticated, is technically unsupported, would expose another customer, or would create an unlawful or material security risk.

Customer obligations

• Provide lawful instructions, notices, choices, and any required consent or other legal basis.
• Configure access, scopes, confidential information, retention, integrations, exports, and workflows appropriately.
• Ensure submitted data is relevant, proportionate, accurate where required, and not unlawfully obtained.
• Respond as controller or business to candidate and employee requests and decisions.
• Identify applicable laws, sensitive uses, automated-decision requirements, and restrictions that HireHint cannot determine from the data alone.

Confidentiality and authorized personnel

HireHint should limit access to people who need customer-controlled data for an approved service, security, support, or legal purpose. Authorized personnel must be subject to appropriate confidentiality obligations and access should be removed when no longer required.

Technical and organizational measures

• Identity verification, protected sessions, direct-route protection, and permission refresh behavior.
• Organization, role, scope, job, reporting-line, record, and workflow authorization controls.
• Tenant-scoped data access, validation, safe denied or concealed outcomes, and bounded projections.
• Audit and operational evidence connecting actor, organization, action, record, and outcome.
• Reviewed database migrations, disposable-data verification, architecture gates, dependency checks, build checks, browser tests, and recovery exercises.
• Provider configuration and outbound-action gates that distinguish catalog, configured, ready, active, failed, and deferred states.

The Security Overview describes the verified product-control foundation. Production encryption, hosting, backup, monitoring, recovery, penetration-test, and certification claims require a separately approved security schedule.

Subprocessors

HireHint may appoint a subprocessor only after completing the required privacy, security, contractual, location, and operational review. Each approved subprocessor must be bound to protections appropriate to the processing it performs.

The final addendum must define the method and advance period for subprocessor change notice, the customer’s objection process, available remediation, and any termination right. The public Subprocessor Registry must identify only production-approved entries.

Individual rights assistance

Taking into account the nature of processing, HireHint should provide reasonable product and operational assistance so the customer can respond to verified requests for access, correction, deletion, restriction, portability, objection, appeal, or another applicable right.

HireHint should not independently resolve a request concerning customer-controlled data unless the customer authorizes the action or applicable law requires it. Direct requests should be routed to the customer when the relevant controller can be identified.

Security incidents and notification

HireHint should maintain an incident-response process to contain, investigate, document, remediate, and communicate a confirmed breach of customer-controlled personal data. Notice must be provided without undue delay or within the shorter period stated in an approved agreement or applicable law.

The final incident schedule must define the notice channel, minimum known facts, ongoing updates, cooperation, evidence preservation, customer communications, and limits on admissions. Notice of an incident is not an admission of fault or legal liability.

Assessments, consultations, and authorities

Taking into account the processing and available information, HireHint should provide reasonable information needed for a customer data-protection impact assessment, regulator consultation, or legally required risk assessment. Assistance beyond standard documentation may be subject to agreed scope and fees.

Evidence and audits

HireHint should make approved security and compliance information available to demonstrate the obligations in the final addendum. A customer audit process should protect other customers, confidential information, system security, and operational continuity and should use existing independent evidence before requesting a new inspection.

No certification badge, audit opinion, penetration-test statement, or production assurance is available merely because this draft contains an audit clause.

International transfers

The final production data map must identify hosting regions, support access, subprocessors, and cross-border transfers. Where required, the parties should use an approved transfer mechanism, complete any necessary assessment, and apply supplementary measures appropriate to the risk.

Standard contractual clauses must be completed with the correct modules, annexes, competent authority, governing law, security measures, and subprocessor information. This draft does not activate or complete those clauses.

United States state processing terms

Where an applicable United States privacy law treats the customer as a business or controller and HireHint as a service provider, contractor, or processor, HireHint should process covered personal information only for the approved business purposes and documented instructions in the agreement.

• Do not sell or share customer-controlled personal information for cross-context behavioral advertising.
• Do not retain, use, or disclose covered data outside the direct business relationship or approved service purpose except as permitted by law.
• Provide the level of privacy protection required of the applicable processing role and notify the customer if HireHint can no longer comply.
• Allow reasonable steps to verify and remediate use consistent with the approved contract and applicable law.
• Flow applicable restrictions to approved subprocessors and support verified consumer-rights requests.

California, Virginia, Colorado, Connecticut, and other state schedules must be validated against the customer, thresholds, exemptions, effective law, and actual data flows before execution.

Return, export, and deletion

At the end of the service, the customer should have the supported export opportunity stated in the approved agreement. HireHint should then delete or return customer-controlled personal data according to the approved retention schedule, except for data that law requires to be retained.

Deletion from active systems may precede deletion from bounded backups, security logs, immutable audit evidence, or legal holds. The final schedule must define those periods and the conditions for restricted retained data.

Term, liability, and contact

This addendum should continue for as long as HireHint processes customer-controlled personal data. Liability, indemnification, governing law, venue, and dispute terms must be defined by the approved main agreement and any mandatory data-protection terms.

Use HireHint Support for questions about this draft. A binding addendum must identify approved legal and privacy notice contacts and an execution method before it is offered to customers.