LEGAL · CIIVSOFT LIMITED

This Data Processing Addendum (“DPA”) forms part of, and is incorporated by reference into, the Agreement between: (1) the Customer named in the applicable Order Form (“Controller” or “Company”); and (2) CiiVSOFT Limited, a company incorporated in England and Wales (Company No. 09061018) with registered office at HLB House, 68 High Street, Tarporley, Cheshire, United Kingdom, CW6 0AT (“Processor” or “CiiVSOFT”).

This DPA takes effect automatically for each Customer from the Effective Date of the Agreement between that Customer and CiiVSOFT, without requiring separate signature by either party, unless the parties expressly agree a bespoke version of this DPA in writing.

(A) The Controller and the Processor have entered into an Agreement for the provision of AI-powered resume and job matching services, recruitment process automation services and / or automated job application screening services.

(B) This DPA sets out the terms for processing personal data in connection with the services provided under the Agreement.

1.1 “GDPR” means the General Data Protection Regulation (EU) 2016/679, and, where applicable, the UK GDPR as defined in the Data Protection Act 2018.

1.2 “Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, and “Personal Data Breach” shall have the meanings given in the GDPR.

1.3 “Services” means the services provided by CiiVSOFT as described in the Order Form.

1.4 “Subprocessor” means any Processor engaged by CiiVSOFT to process Personal Data on behalf of the Controller.

2.1 CiiVSOFT shall process Personal Data solely on the documented instructions of the Controller and for the purpose of providing the Services as specified in the Order Form, in fulfilment of CiiVSOFT's contract with the Controller. CiiVSOFT does not process Personal Data on the basis of its own legitimate interest; the lawful basis for processing is a matter for the Controller, as data controller, to determine and document.

2.2 The types of Personal Data processed and categories of Data Subjects are limited to those necessary for the provision of the Services, as detailed in Annex 1.

3.1 Some of our Services include AI-assisted resume analysis and evaluation (“CiiVSOFT AI”). Where we process data using CiiVSOFT AI, we process data solely on behalf of and under the instructions of the Controller for the purposes of fulfilling a contract between CiiVSOFT and the Controller.

3.2 Where CiiVSOFT AI is used in the Services this includes output content (“Output”) generated by CiiVSOFT AI which provides fully transparent reasoning behind any recommendations or analysis which is made by CiiVSOFT AI. This Output is recorded and logged both in our systems and the Controller's systems.

3.3 For any Services where CiiVSOFT AI is used, the Controller's users and employees are required to make a human decision in order to confirm an outcome or decision, which includes but is not limited to, progressing with a candidate application, inviting a candidate to interview, rejecting a candidate, requesting candidates to undergo testing or assessment, extending an offer of employment to a candidate or hiring a candidate, together (“Outcomes”) which may impact an individual or Data Subject.

3.4 For the avoidance of doubt, CiiVSOFT and CiiVSOFT AI does not make any solely automated decisions that produce legal effects or similarly significant Outcomes or effects on individuals or Data Subjects. The Company, as data Controller, is responsible for providing information to their candidates and Data Subjects about such processing and for handling any requests related to automated decision-making.

3.5 CiiVSOFT offers an optional capability, disabled by default and enabled only at the Controller's election during onboarding, which moves evaluated candidates into a review stage that the Controller has created within its own ATS. This groups candidates for human review. It does not reject, remove or screen out any candidate, does not advance any candidate to an interview, assessment or offer stage, and does not reduce or replace the human decision required under clauses 3.3 and 3.4.

4.1 CiiVSOFT shall process Personal Data for the duration of the Agreement, unless otherwise agreed in writing.

CiiVSOFT shall:

5.1 Process Personal Data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required by law.

5.2 Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.3 Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as outlined in Annex 2.

5.4 Respect the conditions for engaging Subprocessors as set out in Clause 7.

5.5 Assist the Controller in responding to requests from Data Subjects exercising their rights under the GDPR.

5.6 Assist the Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and information available to CiiVSOFT.

5.7 At the choice of the Controller, delete or return all data to the Controller after the end of the provision of Services, and delete existing copies unless storage is required by law.

5.8 Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to the limitations in Clause 8.

The Controller shall:

6.1 Provide documented instructions to CiiVSOFT regarding the processing of Personal Data.

6.2 Comply with all applicable data protection laws in relation to its use of the Services and its processing of Personal Data.

6.3 Have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which it acquired Personal Data.

7.1 The Controller provides general authorisation for CiiVSOFT to engage Subprocessors, provided that: a) CiiVSOFT maintains an up-to-date list of Sub-processors and provides the Controller with 30 days' prior written notice of any intended changes. b) CiiVSOFT imposes data protection obligations on the Subprocessor that are no less onerous than those set out in this DPA. c) CiiVSOFT remains fully liable to the Controller for the performance of the Subprocessor's obligations.

7.2 If the Controller objects to a new Subprocessor, it shall notify CiiVSOFT in writing within 14 days of receiving notice. The parties shall discuss such concerns in good faith to achieve a commercially reasonable resolution.

7.3 CiiVSOFT will give notice of intended changes to its Subprocessors by email to the Customer contact recorded in the Order Form, and maintains a dated change record on the published Subprocessor list.

CiiVSOFT's current sub-processor list is available at ciivsoft.com/subprocessors.

8.1 CiiVSOFT shall assist the Controller in fulfilling its obligations to respond to Data Subjects' requests to exercise their rights under the GDPR, including rights of access, rectification, erasure, restriction of processing, data portability, objection, and automated decision-making.

8.2 CiiVSOFT shall promptly notify the Controller if it receives a request from a Data Subject under any data protection law in respect of Personal Data; and ensure that it does not respond to that request except on the documented instructions of the Controller or as required by applicable laws.

9.1 CiiVSOFT shall make available to the Controller information necessary to demonstrate compliance with this DPA.

9.2 The Controller may conduct audits or inspections of CiiVSOFT's data processing system, subject to the following conditions: a) Audits shall be conducted no more than once per year, unless required by law or in response to a Personal Data Breach. b) Audits shall be conducted at the Controller's expense and on reasonable prior notice of at least 30 days. c) Audits shall not unreasonably interfere with CiiVSOFT's business operations. d) The Controller shall comply with CiiVSOFT's security and confidentiality requirements during the audit.

10.1 CiiVSOFT may transfer and process Personal Data outside the United Kingdom and the European Economic Area (EEA) provided that: a) the transfer is to a country deemed to provide adequate protection by the UK Government or, where applicable, the European Commission; or b) appropriate safeguards are in place, such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses, as applicable.

10.2 CiiVSOFT shall ensure that any cross-border data transfers comply with relevant UK GDPR and, where applicable, EU GDPR requirements.

11.1 CiiVSOFT shall notify the Controller within 48 hours after becoming aware of a Personal Data Breach.

11.2 CiiVSOFT shall provide the Controller with sufficient information to allow the Controller to meet any obligations to report a Personal Data Breach.

11.3 CiiVSOFT shall cooperate with the Controller and take such reasonable commercial steps as are directed by the Controller to assist in the investigation, mitigation, and remediation of each Personal Data Breach.

12.1 CiiVSOFT's liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set out in the Terms of Service.

12.2 CiiVSOFT shall indemnify the Controller against any claims, demands, actions, or proceedings made or brought against the Controller by a Data Subject arising from CiiVSOFT's breach of this DPA, subject to the limitations set out in the Terms of Service.

13.1 This DPA shall terminate automatically upon termination or expiry of the Agreement.

14.1 This DPA shall be governed by and construed in accordance with the laws of England and Wales.

14.2 Any disputes arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

This DPA takes effect automatically, as set out above, and does not require separate execution. Where a Customer requires a countersigned version of this DPA for internal governance purposes, CiiVSOFT will provide one on request, in the same terms as set out here unless expressly varied in writing by both parties.

Nature and Purpose of Processing: CiiVSOFT will process Personal Data as necessary to perform the Services pursuant to the Agreement and as further instructed by the Controller.

Duration of Processing: CiiVSOFT will process Personal Data for the duration of the Agreement, unless otherwise agreed in writing.

Categories of Data Subjects:

• Job applicants, candidates, and potential employees of the Controller

• Employees of the Controller

Types of Personal Data:

• Identifiers. This includes candidate name, title, mailing address, email address, postal code, social media links, driving licence details, telephone number, marital status and dependents, photographs and other similar identifiers.

• Work History or Career Information. This includes CVs, resumes, cover letters, employer details, work history information, education, qualifications, salary and benefits information, training certifications, professional memberships, national insurance details, work permit or visa information.

• Responses to Job Application Questions. This includes responses submitted in text which are provided by candidates in response to questions which are asked as part of an application process for a job or career vacancy.

• Protected Classification Characteristics. This includes age, marital status and gender.

• Any other Personal Data submitted by or on behalf of the Controller or its users through the Services.

The above categories describe the Personal Data that may be contained within a candidate CV or job application before processing. CiiVSOFT does not retain or store this Personal Data in its systems: all such data is redacted immediately on ingestion, before any content reaches CiiVSOFT's AI processing pipeline, and original documents are discarded immediately after redaction. The only data CiiVSOFT retains following processing is: Job ID, Candidate ID and Application ID; job title; timestamps for each processing step; and the AI-generated evaluation output, none of which constitutes Personal Data. No Personal Data listed above is transferred to, or processed by, CiiVSOFT’s AI foundation model providers at any point.

CiiVSOFT shall implement and maintain appropriate technical and organisational security measures, including:

System Access Controls

CiiVSOFT operates a policy of restricting users from accessing information not needed for their roles through role-based user access and using “least privileged” principles.

CiiVSOFT uses AWS Identity Centre access control methodology within a complex and highly secure matrix of appropriate guardrailing and service control policies. Users are provided access to workload environments strictly according to need. These environments include development, QA, UAT and Production.

Production environment access is highly restricted, and is authorised for those involved in the management of live clients only. All system management, code releases and processing activities are automated, so it is not necessary to extend access to much of the production environment.

All accounts are MFA secured, using either a physical device or Authenticator App. Password schemes are in effect (12 characters minimum, lowercase, uppercase, and symbols). It is forbidden for users to share their login details.

Employees with access to external resources, such as software development version control and project management tools, follow a similar ruleset to AWS, using multi-factor authentication and a strong password.

Anomaly detection processes are in place within the environment, with automated remediation and sanctions where detections are made.

Data Access Controls

Database access is strictly for authorised CiiVSOFT employees who have an appropriate level of access within AWS Identity Centre. Unless authorised for administrator access, user accounts follow the least privilege best practice approach to permissions and are therefore limited in what they can and cannot do on the AWS platform.

All client related data is encrypted both in flight and at rest with KMS (Key Management Service) and is automatically rotated every thirty days. Access to these keys is tightly controlled and only certain roles have access. This piece of infrastructure can only be modified by users with administrator privileges.

Access to the database tables GUI can only be accessed through a locked down bastion instance, accessible only via VPN by specific individuals. All logs (including database access) are sent to a central log location. Databases are hosted within private subnets, with appropriate security group controls, only permitting internal APIs to connect.

Input Controls

Application logs record all data processed, e.g. data added, deleted and changed. All of this is sent to a central logging location.

Data Backups

Backups of the databases are taken every 2 hours. All backups are stored in an S3 bucket owned and managed by the Amazon RDS service. CiiVSOFT employees who have accounts in the AWS environment have the least privileges required to do their job; permissions such as deleting a database are not permitted for standard users and are only permitted for administrators. Deletion protection is enabled on all databases, meaning structured steps must be taken for a database to be deleted.

Database backups are encrypted using an AWS Customer Owned AES-256 KMS key, preventing the backup from being restorable unless the decryption key is available. This key is secured and access controlled.

Data Obfuscation

All data processing occurs entirely within a highly secure environment. CiiVSOFT's entire infrastructure operates within private VPCs (Virtual Private Clouds) and subnets, ensuring that data never transits the public internet. This isolation confines all communication between processing services and the database to a controlled and protected network.

CiiVSOFT employs encryption for data both in transit and at rest. As data moves between services within the environment it is encrypted using industry-standard protocols, and once stored it remains encrypted. Intra-service communication within the CiiVSOFT infrastructure is encrypted using private TLS certificates, and service data does not leave the private AWS network. Services identify and authenticate themselves to each other using asymmetric RSA-4096 keys, maintained within AWS Key Management Service, using a custom key for encryption. Database credentials are retrieved by services on demand from CiiVSOFT's secrets management service and are at no point visible in plain text.

CiiVSOFT's application does not include any front-end components or external endpoints that could be exposed to the internet. Without a front-end or public-facing API, there is no direct entry point for attackers to target.

Data Segregation

CiiVSOFT has implemented multi-tenancy data controls within its relational databases. Row Level Security is implemented, ensuring that processing can only ever see the data for that specific client process.

Data Sovereignty

CiiVSOFT takes the sovereignty of data seriously. We currently operate live infrastructure in Europe (Frankfurt), eu-central-1, and US East (N. Virginia), us-east-1. We retain the ability to stand up a Europe (London), eu-west-2, or other AWS regional, instance as required. Customers are positioned within the most appropriate region to ensure their data remains compliant with applicable geographic legislation.

This is the published, standing version of CiiVSOFT's Data Processing Addendum, incorporated by reference into the Agreement with each Customer from the Effective Date. Where a Customer's own due diligence process requires a countersigned or bespoke version, CiiVSOFT will provide one on request, on the same terms unless expressly varied in writing by both parties.