Data Processing Agreement

For candidate and applicant data processed through the platform, the customer is the controller and AIPL Hire is the processor. AIPL Hire processes personal data only on documented instructions from the controller, including as set out in the agreement and this DPA.

Terms such as “personal data”, “processing”, “controller”, “processor”, and “data subject” have the meanings given in applicable data protection law, including the GDPR where it applies.

• Subject matter — provision of the AIPL Hire hiring platform.
• Duration — the term of the agreement plus any legally required retention.
• Nature and purpose — screening, interviewing, scoring, and reporting on candidates.
• Categories of data — identifiers, application materials, interview responses, and recordings.
• Data subjects — the controller's candidates and applicants.

• Process personal data only on the controller's documented instructions.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Assist the controller with data subject requests and compliance obligations.

The controller authorizes AIPL Hire to engage sub-processors (for hosting, AI, email, and payments) under written contracts imposing equivalent data protection obligations. We maintain a current list of sub-processors and provide notice of material changes.

We maintain encryption in transit and at rest, access controls, monitoring, and backup and recovery processes. See our Security page for details.

Taking into account the nature of processing, we assist the controller with appropriate technical and organizational measures to respond to requests from data subjects exercising their rights.

We notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and provide information reasonably needed to meet notification obligations.

Where personal data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses.

We make available information necessary to demonstrate compliance and allow for audits, subject to reasonable confidentiality and security conditions.

Upon termination, we delete or return personal data at the controller's choice, except where retention is required by law.

To request a signed DPA or ask questions, email privacy@aipl.online.