Careira Recruiter Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Careira Terms of Service and applies where a recruiter, employer or other organisation using Careira (“Controller”) provides Careira Ltd (“Careira” or “Processor”) with personal data relating to candidates that the Controller has sourced independently of Careira.

For the purposes of this DPA, the terms personal data, processing, controller, processor and data subject have the meanings given to them under applicable data protection law.

1. Processing relationship

The Controller determines the purposes for which candidate personal data is processed. Careira processes that data on behalf of the Controller solely to provide the Careira service and in accordance with the Controller’s documented instructions.

The Controller’s use of Careira, including creating roles, uploading or importing candidates, requesting matching or analysis, managing candidates and requesting deletion or export, constitutes documented instructions to Careira.

Careira will notify the Controller if, in its reasonable opinion, an instruction infringes applicable data protection law.

2. Details of processing

Subject matter: Candidate data provided to Careira by the Controller for recruitment-related use of the Careira platform.

Duration: For the period during which the Controller uses Careira in relation to that candidate, unless the Controller instructs Careira to delete the data earlier.

Nature and purpose: Storage, parsing and structuring of candidate information; creation of candidate profiles; candidate-to-role matching and analysis; generation of match scores, recommendations and explanations; candidate search and resurfacing; and other processing necessary to provide the Careira recruitment service.

Data subjects: Candidates and prospective candidates whose information is supplied by the Controller.

Personal data: Information contained in candidate CVs and related recruitment records, which may include name, contact information, location, employment history, qualifications, skills, professional experience and other information supplied by the Controller.

Special-category personal data should not be provided to Careira unless the Controller has established an appropriate lawful basis and condition for processing it.

3. Controller responsibilities

The Controller is responsible for:

• ensuring that it has a lawful basis to collect, process and provide candidate personal data to Careira;
• providing candidates with any privacy information required by applicable data protection law, including where information was obtained indirectly;
• ensuring its instructions to Careira comply with applicable law; and
• responding to candidates exercising their data-protection rights, with assistance from Careira where required.

4. Careira obligations

Careira will:

• process candidate personal data only on the Controller’s documented instructions and only for the purpose of providing the Service, unless otherwise required by law;
• ensure that people authorised to process the data are subject to appropriate confidentiality obligations;
• maintain appropriate technical and organisational measures to protect candidate personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access;
• provide reasonable assistance to the Controller in responding to data-subject requests;
• provide reasonable assistance with the Controller’s obligations concerning security, personal-data breaches and data-protection impact assessments, taking account of the nature of the processing and information available to Careira;
• notify the Controller without undue delay after becoming aware of a personal-data breach affecting candidate personal data processed on the Controller’s behalf; and
• make available information reasonably necessary to demonstrate compliance with these obligations.

Careira will not sell Controller-supplied candidate personal data, use it for advertising, or use it for its own independent purposes.

5. AI processing

Careira uses artificial intelligence to parse and structure candidate information and to assess candidate relevance to roles.

Candidate data submitted through Careira is not used by Careira’s AI providers to train their general-purpose models. AI-generated candidate recommendations are decision-support outputs. Careira does not make autonomous hiring or rejection decisions on behalf of the Controller.

6. Sub-processors

The Controller gives Careira general authorisation to use sub-processors where necessary to provide the Service.

Careira’s current sub-processors are identified in its Privacy Policy.

Careira will ensure that sub-processors processing candidate personal data are subject to contractual data-protection obligations providing an appropriate level of protection. Careira remains responsible for the performance of its obligations where processing is carried out by its sub-processors.

Careira will provide reasonable notice of any material change to the sub-processors used to process candidate personal data and will allow the Controller to raise reasonable data-protection objections to the change.

7. International transfers

Where candidate personal data is transferred outside the United Kingdom, Careira will ensure that an appropriate transfer mechanism or other safeguard required by applicable data protection law is in place.

8. Deletion and return

At the Controller’s request, or when the relevant candidate data is no longer required to provide the Service, Careira will delete or return candidate personal data unless applicable law requires its retention.

Where data remains temporarily within secure backups, it will remain protected under this DPA and will not be restored or otherwise processed except as required for disaster recovery, legal compliance or security purposes.

9. Audit and compliance information

Careira will provide information reasonably necessary for the Controller to verify Careira’s compliance with this DPA.

Where that information is insufficient, the Controller may request an audit or inspection on reasonable notice. The parties will agree reasonable arrangements intended to minimise disruption, unnecessary access to information concerning other customers, and disproportionate cost.

10. Relationship with the Terms

This DPA forms part of the Careira Terms of Service. If this DPA conflicts with the Terms on the processing of Controller-supplied candidate personal data, this DPA takes precedence.

The governing law and jurisdiction provisions of the Terms also apply to this DPA.