Data Processing Agreement

For candidate personal data processed through HireOS, the agency is the controller and HireOS is the processor. HireOS processes candidate data only on the agency's documented instructions, which are given through the ordinary use of the product.

Subject matter: providing CV screening and the surrounding recruitment workflow.

Duration: for as long as the agency's workspace is active, subject to the retention window the agency configures.

Extracting text from CVs; sending that text and the job description to the agency's selected model provider; storing the resulting assessment; storing recruiter decisions, notes, drafted messages and interview arrangements.

Data subjects: candidates who apply to or are considered for the agency's roles.

• Identity and contact data: name, email address, telephone number, location
• Employment history, education, skills and other content of the CV
• Automated assessments: scores, requirement verdicts and supporting quotations
• Recruiter decisions, notes and drafted correspondence

HireOS uses the following sub-processors. We will give notice before adding a new one, and you may object.

• Language model providers engaged by HireOS to produce screenings, matches and drafts — the current list is available on request
• Hosting and database infrastructure providers

HireOS implements the following technical and organisational measures.

• Strict tenant isolation: every query is scoped by organisation at the data-access layer, not by application checks after the fact
• Encryption of service credentials at rest using AES-256-GCM authenticated encryption
• Passwords hashed; sessions expiring and revocable, and revoked across devices on password change
• Role-based access within a workspace, with owner and admin permissions for destructive and billing actions
• Append-only audit logging of deletions, exports and retention purges
• Rate limiting on processing endpoints

HireOS provides, in the product and without needing to contact support, a complete export of everything held about an individual candidate — including automated assessments — and a permanent erasure that removes the record and everything attached to it.

HireOS produces assessments to support a recruiter's decision. Candidates are never automatically rejected, no candidate is contacted by HireOS, and every score is traceable to a stated requirement and a quotation from the CV so a decision can be explained to the person it concerns.

The agency remains responsible for ensuring a human reviews outcomes before any decision with legal or similarly significant effect is made.

On termination, the agency may export its data for 30 days, after which HireOS deletes it. Candidates are deleted earlier where the agency's retention policy requires it.

HireOS will notify the agency without undue delay after becoming aware of a personal data breach affecting its workspace, with the information needed for the agency to meet its own notification obligations.