Data Processing Agreement

The purpose of this DPA is to establish the obligations of the parties regarding the Processing of Personal Data and to ensure compliance with applicable data protection and privacy laws.

FastHire provides AI-powered recruitment software that enables Customers to source candidates, manage recruitment workflows, screen applicants, schedule interviews, communicate with candidates, integrate with third-party platforms, and perform related recruitment activities. In providing these Services, FastHire may Process Personal Data on behalf of Customers.

This DPA applies whenever FastHire Processes Personal Data for or on behalf of a Customer while providing the Services. This DPA applies regardless of whether the Personal Data relates to:

• Candidates
• Recruiters
• Hiring managers
• Employees
• Authorized Users
• Customer representatives
• Website users
• Business contacts
• Other identifiable individuals whose Personal Data is Processed through the Services

For purposes of this DPA, the following definitions apply.

"Applicable Privacy Laws" — All applicable laws governing the Processing of Personal Data, including, where applicable: Regulation (EU) 2016/679 (GDPR); UK GDPR; United Kingdom Data Protection Act 2018; Australian Privacy Act 1988 (Cth); Digital Personal Data Protection Act, 2023 (India); applicable United States federal, state, and local privacy laws; and any other applicable privacy or data protection legislation.

"Controller" — The entity that determines the purposes and means of Processing Personal Data, or any equivalent concept under Applicable Privacy Laws. For most Customer Data Processed through the Services, the Customer acts as the Controller.

"Processor" — The entity that Processes Personal Data on behalf of a Controller. FastHire acts as the Processor when Processing Customer Data on behalf of the Customer.

"Subprocessor" — Any third party engaged by FastHire to Process Personal Data on FastHire's behalf in connection with providing the Services.

"Personal Data" — Any information relating to an identified or identifiable natural person, including any equivalent term such as "Personal Information" under Applicable Privacy Laws.

"Processing" — Any operation performed on Personal Data, whether by automated or manual means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, analysis, transmission, disclosure, combination, restriction, deletion, and destruction.

"Security Incident" — Any confirmed or reasonably suspected unauthorized access, acquisition, disclosure, alteration, destruction, loss, or compromise of Personal Data Processed by FastHire. A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as blocked network scans, unsuccessful login attempts, denial-of-service attacks that do not result in unauthorized access, or similar events.

"Customer Data" — All information, documents, files, Candidate information, recruiter information, communications, job postings, resumes, workflows, analytics, configurations, and other content uploaded, imported, synchronized, generated, or otherwise Processed through the Services by or on behalf of the Customer.

"Data Subject" — Any identified or identifiable individual whose Personal Data is Processed under this DPA.

The parties acknowledge and agree that:

• The Customer acts as the Controller (or equivalent legal role under Applicable Privacy Laws) with respect to Customer Data Processed through the Services.
• FastHire acts as the Processor (or equivalent legal role) when Processing Customer Data on behalf of the Customer.
• Nothing in this DPA transfers ownership of Customer Data to FastHire.

Where FastHire Processes Personal Data collected directly for its own business purposes (such as billing, account administration, website analytics, or marketing communications), FastHire acts as an independent Controller and such Processing is governed by the FastHire Privacy Policy.

FastHire shall Process Personal Data only:

• To provide the Services;
• To fulfill contractual obligations under the Agreement;
• On documented instructions from the Customer;
• To maintain and improve the security and reliability of the Services;
• To comply with applicable legal obligations;
• As otherwise expressly permitted under the Agreement or this DPA.

FastHire shall not Process Personal Data for purposes unrelated to providing the Services.

The Customer instructs FastHire to Process Personal Data:

• As necessary to provide the Services;
• As configured by the Customer through the Services;
• As authorized by Customer administrators;
• As necessary to support Customer-authorized integrations;
• As reasonably required to maintain platform security, availability, and performance;
• As otherwise documented in the Agreement.

If FastHire reasonably believes that a Customer instruction violates Applicable Privacy Laws, FastHire may notify the Customer and suspend the affected Processing until appropriate instructions are provided.

FastHire may Process Personal Data to provide AI-powered recruitment services, including:

• Candidate sourcing
• Candidate profile enrichment
• Resume parsing
• Resume storage
• Candidate search
• Candidate matching
• Skills extraction
• Candidate ranking
• AI-generated summaries
• Job description analysis
• Interview scheduling
• Calendar synchronization
• Email synchronization
• Recruiter collaboration
• Candidate communications
• Workflow automation
• Recruitment analytics
• Reporting
• API processing
• User authentication
• Customer support
• Fraud prevention
• Security monitoring
• Backup and disaster recovery
• Platform administration

FastHire Processes Personal Data solely for the purposes of providing and supporting the Services requested by the Customer.

Depending on the Customer's use of the Services, FastHire may Process Personal Data relating to:

• Job applicants
• Candidates
• Prospective candidates
• Recruiters
• Hiring managers
• Human Resources personnel
• Customer employees
• Customer contractors
• Customer administrators
• Authorized Users
• Customer representatives
• Business contacts
• Website users
• Customer support contacts

The categories of Personal Data Processed may include:

• Identity Information: name, email address, telephone number, professional title, employer, business address, username, user ID
• Professional Information: resume, curriculum vitae (CV), employment history, work experience, skills, certifications, education, qualifications, professional licenses, languages, portfolio links, public professional profiles
• Recruitment Information: job applications, candidate status, recruiter notes, interview schedules, interview feedback, candidate evaluations, hiring stage, offer information, salary expectations, availability, work authorization, notice period
• Technical Information: IP address, browser type, device information, login history, usage logs, session identifiers, audit logs, API activity
• Communications: emails, support requests, chat messages, calendar invitations, recruitment communications, meeting information

FastHire shall Process Personal Data for the duration of the applicable Agreement unless the Customer requests earlier deletion; applicable law requires continued retention; retention is necessary to establish, exercise, or defend legal claims; or retention is required to comply with legal obligations.

Upon termination of the Agreement, FastHire shall Process Personal Data in accordance with the data retention and deletion provisions set forth in this DPA.

FastHire shall Process Personal Data only on documented instructions from the Customer, except where otherwise required by Applicable Privacy Laws; for the purposes of providing, maintaining, securing, and supporting the Services; and in accordance with this DPA, the Agreement, and Applicable Privacy Laws.

FastHire shall not:

• Sell Customer Data;
• Rent Customer Data;
• License Customer Data to third parties for independent commercial purposes;
• Use Customer Data to build, train, or improve publicly available artificial intelligence models;
• Process Customer Data for purposes unrelated to providing the Services, except as required by law.

Where FastHire is required by law to Process Personal Data beyond the Customer's instructions, FastHire will, where legally permitted, notify the Customer before carrying out such Processing.

The Customer represents and warrants that it:

• Has all necessary rights, permissions, notices, and lawful bases to provide Personal Data to FastHire;
• Will comply with all Applicable Privacy Laws;
• Will provide all legally required privacy notices to Data Subjects;
• Will obtain any required consents where consent is the legal basis for Processing;
• Will respond to Data Subject requests where acting as Controller;
• Will ensure Authorized Users comply with the Agreement and this DPA.

The Customer remains solely responsible for determining the purposes and means of Processing; recruitment decisions; employment decisions; candidate communications; and compliance with employment, labour, equal opportunity, anti-discrimination, and workplace laws.

FastHire shall ensure that all personnel authorized to Process Personal Data are bound by contractual or statutory confidentiality obligations; receive appropriate security and privacy training appropriate to their role; access Personal Data only where necessary to perform authorized duties; and continue to be bound by confidentiality obligations after their employment or engagement ends.

Access to Customer Data shall be limited according to the principle of least privilege.

FastHire maintains an information security program designed to protect the confidentiality, integrity, and availability of Personal Data. Appropriate safeguards may include:

• Organizational Measures: information security policies; employee confidentiality agreements; background screening where appropriate; security awareness training; access approval processes; vendor risk management; incident response procedures; business continuity planning.
• Technical Measures: encryption of data in transit using industry-standard protocols; encryption of stored data where appropriate; role-based access controls; multi-factor authentication for administrative access where supported; audit logging; infrastructure monitoring; network security controls; malware protection; vulnerability management; regular software updates; backup and disaster recovery procedures; secure software development lifecycle (SSDLC); logging and monitoring of security events.

FastHire may update or improve its security measures over time, provided such changes do not materially reduce the overall level of protection.

FastHire provides AI-assisted recruitment capabilities as part of the Services. Depending on Customer configuration, AI functionality may include resume parsing; candidate matching; candidate ranking; skills extraction; candidate summaries; job description analysis; interview scheduling assistance; communication drafting; workflow automation; and recruitment analytics.

AI-generated outputs are intended solely to assist Customers in performing recruitment activities. Customers remain solely responsible for reviewing AI-generated outputs and making all hiring and employment decisions.

FastHire does not independently determine whether a Candidate should be interviewed, shortlisted, hired, rejected, promoted, or otherwise evaluated for employment.

FastHire does not use Customer Data or Candidate Data submitted through the Services to train publicly available artificial intelligence models.

Where FastHire utilizes third-party AI providers, FastHire will use commercially reasonable efforts to utilize enterprise offerings or contractual arrangements that restrict Customer Data from being used for generalized model training, where such options are available.

FastHire may use anonymized, aggregated, or de-identified operational information for platform performance monitoring, security monitoring, capacity planning, product analytics, and service improvements, provided such information cannot reasonably be used to identify an individual Customer, Candidate, or other Data Subject.

The Customer authorizes FastHire to engage Subprocessors to assist in providing the Services. Subprocessors may provide services relating to cloud infrastructure; artificial intelligence services; authentication; email delivery; calendar synchronization; analytics; payment processing; monitoring; logging; security; customer support; backup and disaster recovery; and other infrastructure or operational services.

FastHire shall conduct appropriate due diligence before engaging Subprocessors; enter into written agreements imposing data protection obligations substantially equivalent to those contained in this DPA; and remain responsible for the performance of its Subprocessors to the extent required by Applicable Privacy Laws.

A current list of material Subprocessors may be made available to Customers upon request or published separately.

FastHire operates globally and may Process Personal Data in countries other than the country in which the Personal Data was originally collected.

Where required by Applicable Privacy Laws, FastHire shall implement appropriate safeguards for cross-border transfers, which may include Standard Contractual Clauses (SCCs); UK International Data Transfer Addendum; contractual commitments with Subprocessors; and other lawful transfer mechanisms recognized by Applicable Privacy Laws.

Customers acknowledge that use of the Services may involve transfers of Personal Data to jurisdictions where FastHire, its affiliates, or its Subprocessors operate.

Taking into account the nature of the Processing, FastHire shall provide reasonable assistance to the Customer in responding to valid requests from Data Subjects, including requests relating to access; correction; deletion; restriction of Processing; data portability; objection to Processing; and withdrawal of consent, where applicable.

Where FastHire receives a request directly from a Data Subject concerning Customer-controlled Personal Data, FastHire may forward the request to the Customer, or inform the Data Subject that the request should be directed to the relevant Customer, unless otherwise required by Applicable Privacy Laws.

FastHire maintains policies and procedures for identifying, investigating, responding to, and mitigating Security Incidents.

Upon becoming aware of a confirmed Security Incident affecting Customer Personal Data, FastHire shall, without undue delay and in accordance with Applicable Privacy Laws:

• Notify the Customer;
• Provide available information regarding the nature of the incident;
• Describe the categories of affected Personal Data, where known;
• Describe the measures taken or proposed to address the incident;
• Cooperate reasonably with the Customer in fulfilling any applicable legal obligations.

FastHire's notification of a Security Incident does not constitute an admission of fault or liability.

Taking into account the nature of the Processing and the information available to FastHire, FastHire shall provide reasonable assistance to the Customer in meeting its obligations relating to data protection impact assessments (DPIAs); prior consultation with supervisory authorities where required; security obligations; breach notification obligations; and compliance with Applicable Privacy Laws.

Such assistance may be subject to reasonable charges where the requested assistance exceeds FastHire's standard support obligations.

Upon reasonable written request and no more than once in any twelve (12) month period, FastHire shall make available information reasonably necessary to demonstrate compliance with this DPA.

Where required by Applicable Privacy Laws and where documentary evidence is insufficient, the Customer may request a reasonable audit. Any audit shall be conducted during normal business hours; be subject to reasonable advance notice; minimize disruption to FastHire's operations; protect the confidentiality of other Customers; and be subject to appropriate confidentiality obligations.

FastHire may satisfy audit obligations by providing current independent security certifications, audit reports, or similar documentation where appropriate.

FastHire shall retain Personal Data only for as long as necessary to provide the Services; perform contractual obligations; comply with applicable legal obligations; resolve disputes; protect legitimate business interests; and enforce legal rights.

Unless otherwise agreed in writing, Personal Data shall not be retained longer than reasonably necessary for these purposes.

Upon expiration or termination of the Agreement, FastHire shall, at the Customer's written request and subject to applicable law, return Customer Data in a commercially reasonable format where technically feasible, or securely delete or anonymize Customer Data.

FastHire may retain limited copies of Personal Data where required to comply with applicable law; meet regulatory obligations; maintain financial or tax records; resolve legal disputes; establish, exercise, or defend legal claims; or maintain disaster recovery backups until they are overwritten in accordance with FastHire's backup retention practices.

Any retained Personal Data shall remain subject to the confidentiality and security obligations set out in this DPA.

The parties agree to cooperate in good faith regarding matters relating to the Processing of Personal Data.

Where reasonably requested by the Customer and taking into account the nature of the Services, FastHire shall provide reasonable assistance concerning regulatory inquiries; supervisory authority investigations; compliance assessments; privacy impact assessments; Data Subject requests; and security incidents.

FastHire may recover reasonable costs for assistance that exceeds the scope of its standard contractual obligations.

Where required by Applicable Privacy Laws, FastHire shall maintain records of Processing activities under its responsibility. Such records may include categories of Processing; categories of Personal Data; categories of Data Subjects; categories of recipients; Subprocessors; security measures; and international data transfers.

Each party shall remain responsible for its own compliance with Applicable Privacy Laws. Nothing in this DPA shall expand either party's liability beyond the liability limitations contained in the Agreement, except where such limitations are prohibited by Applicable Privacy Laws.

The Customer acknowledges that FastHire acts as a Processor for Customer-controlled Personal Data and does not determine the purposes or means of Processing such data.

The Customer remains responsible for providing appropriate privacy notices; identifying the lawful basis for Processing; responding to Data Subject requests where acting as Controller; and ensuring compliance with employment, recruitment, and privacy laws.

Except where prohibited by Applicable Privacy Laws or expressly stated in the Agreement: the liability limitations contained in the Agreement shall apply to this DPA; the aggregate liability of either party arising from or relating to this DPA shall not exceed the liability cap specified in the Agreement; and nothing in this DPA excludes liability that cannot legally be excluded.

This DPA becomes effective on the Effective Date and remains in effect for as long as FastHire Processes Personal Data on behalf of the Customer.

Termination of the Agreement shall automatically terminate this DPA, except for provisions that expressly survive termination, including those relating to confidentiality; security; data deletion; liability; governing law; dispute resolution; and audit records retained under applicable law.

In the event of any conflict between this DPA, the Agreement, any Order Form, any Subscription Agreement, or any other contractual document, the following order of precedence shall apply solely with respect to the Processing of Personal Data:

• Applicable Privacy Laws;
• This DPA;
• The Agreement;
• Applicable Order Form;
• Any other incorporated document.

FastHire may update this DPA from time to time to reflect changes in Applicable Privacy Laws; improve security practices; reflect operational changes; and incorporate new regulatory requirements.

Where material changes are made, FastHire will provide reasonable notice in accordance with the Agreement or applicable law. No amendment shall materially reduce the level of protection provided to Customer Personal Data without an appropriate legal basis or the Customer's agreement where required.

Unless otherwise required by Applicable Privacy Laws or expressly agreed in writing, this DPA shall be governed by the laws of India. The courts located in Ahmedabad, Gujarat, India shall have exclusive jurisdiction over disputes arising from or relating to this DPA, except where mandatory law requires otherwise.

This DPA forms part of the Agreement between the parties. Except as expressly modified by this DPA, all terms of the Agreement remain in full force and effect. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

A. Subject Matter of Processing — Provision of FastHire's AI-powered recruitment software and related services.

B. Nature of Processing — Collection; storage; organization; retrieval; analysis; resume parsing; candidate sourcing; candidate profile enrichment; candidate matching; candidate ranking; AI-assisted screening; interview scheduling; email synchronization; calendar synchronization; workflow automation; reporting; customer support; security monitoring; backup and recovery.

C. Purpose of Processing — To provide the Services requested by the Customer, including recruitment workflow automation, candidate management, AI-assisted recruitment, analytics, integrations, platform administration, and customer support.

D. Categories of Data Subjects — Candidates; job applicants; recruiters; hiring managers; human resources personnel; customer employees; Authorized Users; customer representatives; business contacts; website users.

E. Categories of Personal Data — Names; business contact information; email addresses; telephone numbers; professional information; employment history; resumes; education; skills; certifications; interview information; recruitment status; communications; technical information; authentication information; usage logs.

F. Duration of Processing — For the duration of the Agreement and any applicable retention period required by law or the Agreement.

FastHire maintains security measures appropriate to the risks associated with Processing Personal Data. These measures may include:

• Organizational Controls: information security policies; confidentiality obligations; security awareness training; vendor due diligence; incident response procedures; business continuity planning.
• Technical Controls: encryption of data in transit; encryption of data at rest where appropriate; role-based access controls; authentication controls; infrastructure monitoring; audit logging; network security controls; vulnerability management; secure software development practices; regular backups; disaster recovery capabilities; security monitoring and alerting.

FastHire may update these measures over time, provided that the overall level of security is not materially reduced.

FastHire may engage trusted Subprocessors to support the delivery of the Services. Categories of Subprocessors may include:

• Cloud Infrastructure Providers — Application hosting, storage, networking
• Artificial Intelligence Providers — AI-powered recruitment functionality
• Email Service Providers — Transactional emails and notifications
• Calendar Integration Providers — Interview scheduling and synchronization
• Authentication Providers — User authentication and identity management
• Analytics Providers — Product usage analytics and performance monitoring
• Payment Service Providers — Subscription billing and payment processing
• Customer Support Platforms — Customer communications and technical support
• Monitoring & Logging Providers — Platform reliability and security monitoring

FastHire shall maintain a current list of material Subprocessors and make it available to Customers upon request or through its Trust Center or website.

To provide AI-assisted recruitment functionality, FastHire may process Customer Data using trusted AI service providers. FastHire agrees that:

• Customer Data is processed only to provide requested AI functionality.
• Customer Data is not used by FastHire to train publicly available AI models.
• FastHire will use commercially reasonable efforts to utilize enterprise AI services or contractual arrangements that restrict Customer Data from being used for generalized model training where such options are available.
• AI-generated outputs are intended solely to assist Customers.
• Customers remain solely responsible for reviewing AI-generated outputs and making all employment and recruitment decisions.
• FastHire does not make automated hiring decisions on behalf of Customers.

This DPA forms part of the Agreement between the Customer and FastHire Manpower Solution and becomes effective upon the Customer's acceptance of the Agreement, execution of an Order Form, or use of the Services, unless the parties execute a separate written DPA.