Data Processing Agreement (DPA)

This Data Processing Agreement forms part of the HireAce Terms & Conditions.

Processor: HIREACE LTD (England & Wales)

Registered Address: 28 Alexandra Terrace, Exmouth EX8 1BD

Controller: Customer using the HireAce platform

1. Purpose

This DPA governs the processing of personal data by HireAce on behalf of the Controller.

2. Definitions

  • Controller: Determines purpose and means of processing
  • Processor: Processes data on behalf of Controller
  • Personal Data: As defined under UK GDPR
  • Processing: Any operation on personal data

3. Scope of Processing

3.1 Subject Matter

Provision of the HireAce AI hiring platform.

3.2 Duration

During platform use plus applicable retention periods.

3.3 Nature and Purpose

  • Storage and organisation of candidate data
  • CV analysis
  • Interview transcription
  • AI scoring and insights

3.4 Categories of Data Subjects

  • Job candidates
  • User representatives (limited)

3.5 Types of Personal Data

  • Name
  • Email address
  • Phone number
  • CV and application data
  • Interview transcripts

4. Controller Obligations

  • Ensure lawful basis for processing
  • Provide privacy notices
  • Obtain required consents
  • Comply with data protection laws
  • Ensure data accuracy and legality

5. Processor Obligations

  • Process data only on instructions
  • Maintain confidentiality
  • Implement security measures
  • Assist with compliance obligations

HireAce will not use or sell personal data independently.

6. Security Measures

  • Access controls
  • Secure infrastructure
  • Encryption where appropriate
  • Monitoring and logging

7. Subprocessors

HireAce may use subprocessors (e.g., cloud providers) and remains responsible for their actions.

8. International Transfers

  • Data stored in the UK
  • Transfers outside UK protected by safeguards

9. Data Subject Rights

HireAce will assist with:

  • Access
  • Rectification
  • Erasure
  • Restriction

Requests received directly will be forwarded to the Controller.

10. Data Breaches

HireAce will notify the Controller without undue delay and assist in mitigation.

11. Data Retention and Deletion

  • Retained during active use
  • 30 days after termination
  • Then securely deleted

12. Audits

  • Reasonable audit rights allowed
  • Must not disrupt operations
  • Subject to confidentiality

13. Liability

Subject to limitations in the main Terms & Conditions.

14. Termination

This DPA ends when the main agreement terminates.

15. Governing Law

England & Wales jurisdiction applies.