Data processing agreement

1What this agreement is

This agreement is part of the terms of service between the company using HireMagic ("you") and ShareSign, Inc. ("HireMagic", "we"). It applies automatically, with no signature, whenever we handle personal data for you.

For candidates' data, you decide why and how it is used, and we handle it on your behalf. In the language of data protection law, you are the controller and we are your processor. Where you act for another company, such as a group company, you are its processor and we are your sub-processor, and you confirm that it has authorised this agreement.

"Data protection law" means every privacy law that applies to the data, including the GDPR, the UK GDPR, and the laws of other countries and US states where you hire. Terms such as "personal data" and "breach" have the meaning those laws give them. This agreement does not cover data we handle for our own purposes, such as your team's accounts and visits to our site. The privacy policy covers those.

2What we handle, and for how long

We handle candidates' data to run HireMagic for you: storing it, showing it to your team, sending emails and carrying out what you ask for in the product. Schedule 1 gives the details.

This continues for as long as you use HireMagic, until the data is deleted under section 10. Applications are deleted when the retention period you set ends, unless the candidate was hired, in which case the application stays with you until you remove it or your account closes.

3Your responsibilities

• having a lawful reason to collect and use candidates' data, and giving candidates the notices the law requires;
• choosing a retention period that suits the law where you hire, and asking only for information you may lawfully ask for;
• taking care with sensitive data. HireMagic does not ask for health, religion, ethnicity or similar data, but candidates may include it in a CV, and you decide what to do with it;
• answering candidates' requests about their data;
• the decisions you make about candidates. HireMagic does not score, rank or reject candidates by itself.

4Your instructions

We handle candidates' data only on your documented instructions. Those instructions are these terms and what you do in the product. If the law requires us to do something else, we will tell you first, unless that law forbids it.

If we think an instruction breaks data protection law, we will tell you and may hold off until you confirm or change it.

We do not sell candidates' data, or share it for advertising. We do not use it for our own purposes, or to train AI models. We do not combine it with data from other companies using HireMagic. In the terms of US state privacy laws, we act as your service provider, and we will tell you if we can no longer meet these duties.

5Confidentiality and security

Everyone who can reach candidates' data for us is bound by a duty of confidentiality, and has access only where their work needs it.

We keep the measures in Schedule 2 in place. We may improve or replace them, but will not reduce the overall level of protection.

6Suppliers

You authorise us to use the suppliers in Schedule 3. Each is bound by written terms that protect the data at least as well as this agreement, and we remain responsible to you for what they do.

We will email your account owners at least 30 days before a new supplier starts handling your candidates' data. You may object on reasonable data protection grounds through our contact form. If we cannot find a solution, you may end the affected service and we will refund what you have paid for the time left.

7Moving data between countries

Candidates' data is stored in the European Union, as Schedule 3 shows. Some suppliers, and ShareSign, Inc. itself, are based in the United States.

Where the law restricts moving personal data from the European Economic Area, the UK or Switzerland to a country without an adequacy decision, the following apply:

• From you to us: the European Commission's standard contractual clauses, Module Two (controller to processor), or Module Three where you are a processor, form part of this agreement. Clause 7 applies. Under clause 9(a) we use option 2, with the 30 days' notice in section 6. The optional wording in clause 11 does not apply. Under clauses 17 and 18, Irish law and the courts of Ireland apply. Schedules 1, 2 and 3 fill in the annexes.
• For the UK: the UK's International Data Transfer Addendum applies to those clauses, with the same details.
• For Switzerland: the same clauses apply, with the Swiss regulator and Swiss law in place of the EU's where the law requires.
• From us to suppliers: we rely on an adequacy decision or the same clauses.

If you hire in a country whose law sets other conditions for sending data abroad, you are responsible for meeting them with candidates, and we will give you the information you need. If a government asks us for your candidates' data, we will tell you unless the law forbids it, and will challenge a request we believe is unlawful.

8Helping you

If a candidate contacts us about their data, we will pass the request to you and will not answer it ourselves, unless the law requires us to. We will help you answer such requests, using the product where we can and otherwise on request.

We will also give you reasonable help with data protection impact assessments, and with talking to regulators.

9Breaches

We will tell your account owners without undue delay, and in any case within 48 hours, after we become aware of a breach affecting your candidates' data. We will say what happened, what data and how many people are affected as far as we know, and what we are doing, and will add detail as we learn it. Telling you is not an admission of fault. To report a security concern, use our contact form for security reports.

10When your account closes

Use our contact form to close your account. If you ask before it closes, we will give you a copy of your candidates' data in a common format. We then delete your candidates' data within 30 days, including CVs, unless the law requires us to keep it, in which case we keep it only for that purpose. Backup copies age out within a further 30 days and are not used in the meantime.

11Checking our work

On request, we will give you the information you need to show that we meet this agreement. You, or an independent auditor bound by confidentiality, may audit us on 30 days' notice, in working hours and without disrupting the service, at most once a year unless a regulator requires it or a breach gives good reason. You pay your own costs. Where a supplier's own reports cover the question, we may rely on them.

12Liability and order of documents

Each party's liability under this agreement is as set out in the terms of service. Nothing here limits what a candidate may claim directly under data protection law or the standard contractual clauses.

If documents conflict, the standard contractual clauses come first, then this agreement, then the terms of service. We may update this agreement by giving 30 days' notice, and will not reduce your protections without your agreement unless the law requires it.

If you need a signed copy with both parties' details filled in, use our contact form.

13Schedule 1: what is handled

• Who it is about: people who apply to you, or whom you add as candidates, and people named in their records, such as referees.
• What data: name, contact details, CV and anything in it, answers to your questions, source of the application, hiring steps, notes, interview times, feedback, offers, and emails sent through HireMagic.
• Sensitive data: not requested, but it may appear in a CV or an answer. Where it does, it receives the same protection as everything else, including the measures in Schedule 2.
• What we do with it: store, display, send, organise, scan for viruses and delete it, as the service requires.
• How often: continuously, while you use HireMagic.
• How long: the retention period you set, 12 months unless you change it, and as set out in sections 2 and 10.
• Parties: you, as set out in your account, and ShareSign, Inc., whose contact for this agreement is our contact form. The regulator for the standard contractual clauses is the one that supervises you under clause 13.

14Schedule 2: how the data is protected

• Data travels over encrypted connections, and our database and file suppliers encrypt it where it is stored.
• Every company's records are kept apart in the application, and every read and write is limited to the company of the signed-in person.
• Sign-in is run by a specialist supplier. Only people you add to your account can see your candidates.
• CV storage is private. A CV can be downloaded only by a signed-in member of the right company, through a link that lasts about a minute.
• Files are checked by their contents when they are uploaded. CVs are scanned for viruses, an infected CV is refused or deleted, and a CV that could not be scanned is marked so that your team knows before opening it.
• Expired applications are deleted automatically each day, with their CVs, following the period you set.
• Keys and passwords for our systems are held apart from the code, and access to them is limited.

15Schedule 3: suppliers

Vercel

Purpose: Hosting and delivery of the site and the app.Data: Requests, and application data in transit.Where: The application runs in the EU (Frankfurt), beside the database. Pages and files are delivered through Vercel's network, which has locations worldwide. Vercel is a United States company.

Neon

Purpose: Database.Data: Account, company, job, candidate, application, offer and email records.Where: EU (Frankfurt) for the primary database.

Cloudflare R2

Purpose: Storage for files.Data: CVs, company logos, and photos on careers pages.Where: European Union.

Amazon Web Services

Purpose: Virus scanning of CVs.Data: The contents of a CV, and nothing else: no name, company or candidate. The scanner keeps nothing after it answers..Where: EU (Frankfurt).

Clerk

Purpose: Sign-in and identity for HireMagic accounts.Data: Name, email address, sign-in credentials, sessions.Where: United States.

Resend

Purpose: Sending email, such as application receipts, interview invitations, offers and sign-in codes.Data: Recipient names and email addresses, and the text of each email.Where: United States; messages are delivered from the EU (Ireland).

Stripe

Purpose: Payments. HireMagic does not take payments yet. Stripe will be used once paid plans go on sale..Data: Billing details, and card data, which only Stripe holds.Where: United States, with EU entities.

If you choose to book interviews through TimeWiz, another product of ShareSign, Inc., the interview details go to TimeWiz, on the same terms as this agreement. This does not happen unless you turn it on.