Legal
Data Processing Addendum (DPA)
Last updated: Early access draft
This is placeholder text for early access. It has not been reviewed by counsel and will be replaced with final legal terms before general availability.
This DPA forms part of the Terms of Service between Aptelor Global Pvt. Ltd. ("Aptelor," "Processor") and the Employer customer ("Customer," "Controller") and applies where Aptelor processes Personal Data on the Customer's behalf.
1. Roles
For candidate data the Customer collects/manages via the Service, the Customer is the Controller and Aptelor is the Processor (or Service Provider under CCPA). For Aptelor's own operational data, Aptelor is a Controller (see Privacy Policy).
2. Processing details
- Subject matter: provision of the AI-assisted hiring Service.
- Duration: the term of the agreement.
- Nature/purpose: hosting, storage, and processing (including AI-assisted matching/screening/interview support) of candidate data to enable hiring.
- Data types: candidate identity/contact data, profile/résumé content, application/assessment/interview responses.
- Data subjects: the Customer's candidates and applicants.
3. Aptelor's obligations
Process Personal Data only on documented Customer instructions; ensure personnel are bound by confidentiality; implement appropriate technical/organizational security measures; assist the Customer with data-subject requests and with DPIAs/breach obligations; and delete or return Personal Data at the end of the agreement (subject to legal retention).
4. Sub-processors
The Customer authorizes Aptelor to engage sub-processors listed in the Privacy Policy (Clerk, Neon, Cloudflare R2, Resend, Anthropic/OpenAI, Vercel). Aptelor imposes data-protection terms on sub-processors and remains responsible for their performance. Aptelor will provide notice of new sub-processors and a chance to object.
5. International transfers
Where Personal Data is transferred internationally, the parties rely on appropriate safeguards (e.g. EU Standard Contractual Clauses / UK IDTA), incorporated by reference.
6. Security & breach
Aptelor maintains measures including encryption in transit, access controls, private file storage with signed URLs, and audit logging, and will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer data.
7. Audits
Aptelor will make available information reasonably necessary to demonstrate compliance and allow for audits, subject to reasonable notice and confidentiality obligations.
8. CCPA
Aptelor acts as a Service Provider, processes Personal Information only to provide the Service, and will not sell it or use it outside the direct business relationship.
9. Deletion/return
On termination, Aptelor will delete or return Customer Personal Data within 90 days, subject to legal retention requirements.
10. Contact
privacy@aptelor.com — Data Protection Officer / EU Representative (if applicable): 8448830798