Data Processing Addendum

Roles and scope

The Customer is the controller of personal data it submits to the service, and Arcanext is its processor (or service provider). This DPA carries the same version number as the Terms; if they conflict on the processing of personal data, this DPA prevails.

Details of the processing

Data subjects: the Customer's users, and candidates whose data the Customer uploads. Personal data: user names, work email addresses, organization membership and sign-in metadata; candidate contact and professional details, résumé files and extracted text, embeddings, match scores, rankings and hiring-team notes.

Once the Customer's voice screening, candidate messaging or text interviews are switched on, the personal data also includes call recordings and transcripts, interview answers and their evaluations, the questions candidates ask during calls, messages and replies, records of the permissions candidates gave or refused, and keyed hashes of contact details candidates asked not to be used.

Nature and purpose: providing the closed pilot features, which are:

• Employer user accounts and organizations, through Clerk
• Jobs, job descriptions and interview questionnaires, including drafts generated with Azure OpenAI
• Candidate records and résumé files that employers upload, stored in private Azure Blob Storage
• Résumé parsing, embeddings, matching and ranking against the employer's job, using Azure OpenAI
• Billing in Razorpay test mode; no real payments are taken during the pilot

No candidate contact during the pilot

During the closed pilot, voice calling, candidate messaging and text interviews are switched off: Arcanext does not call, text or email candidates, and no candidate data is sent to Twilio, Deepgram or Cartesia or through Resend.

Once they are switched on, Arcanext places screening calls and sends screening invitations and messages on the Customer's behalf under the rules in the Privacy Notice at arcanext.com/privacy, including its calling hours, the weekend confirmation and the single invitation email.

Instructions

Arcanext processes personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the service, unless the law requires otherwise. Arcanext never sells candidate data, and never uses one customer's candidate data for another customer.

No model training

Arcanext does not use Customer data to train AI models.

Azure OpenAI does not use customer data to train models; prompts may be retained for up to 30 days for abuse monitoring.

Speech-to-text and text-to-speech requests to Deepgram opt out of Deepgram's Model Improvement Program.

Confidentiality

Arcanext ensures that the people it authorizes to process personal data are bound by confidentiality obligations.

Security measures

Data in transit is protected with TLS 1.2 or higher. Data is stored in Microsoft Azure in the Central US and East US 2 regions. Microsoft Azure documents AES-256 encryption at rest for the storage services used. Each customer's data is kept within its own organization, and access by the Customer's users is controlled by the roles the Customer assigns. Users sign in through Clerk with corporate email addresses. Error reports sent to Sentry have personal data scrubbed before sending.

Sub-processors

The Customer authorizes the sub-processors listed at arcanext.com/subprocessors. Arcanext imposes data protection obligations on each sub-processor and remains responsible for its performance.

Arcanext will give the Customer 30 days' prior notice before adding or replacing a sub-processor, and the Customer may object on reasonable data protection grounds within that period.

International transfers

Where personal data is transferred from the United Kingdom to a country without adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, applies and is incorporated by reference. Where personal data is transferred from the European Economic Area or Switzerland, the EU Standard Contractual Clauses (controller-to-processor or processor-to-processor module, as applicable) apply and are incorporated by reference.

Assistance and data subject requests

Arcanext assists the Customer, taking into account the nature of the processing, in responding to requests from data subjects and in meeting its obligations on security, breach notification and data protection impact assessments. A pre-filled data protection impact assessment for each job can be downloaded from the job's page.

Personal data breaches

Arcanext notifies the Customer of a personal data breach affecting Customer data without undue delay and within 72 hours of becoming aware of a confirmed personal data breach, and provides the information the Customer reasonably needs to meet its own notification duties.

Audits

Arcanext makes available the information necessary to demonstrate compliance with this DPA and allows audits by the Customer or an auditor it mandates, on these terms. Security documentation and compliance reports are available on written request. The Customer may conduct at most one remote audit per year, on at least 30 days' prior written notice, at the Customer's expense.

Retention and deletion

Customer data is kept while the customer's organization account exists, including after a subscription ends or a plan changes.

Apart from the candidate rules and requests below, Customer data is deleted only when the Customer deletes a job or when the Customer's organization account is deleted or closed.

When the Customer deletes a job, the transcripts, interview answers, candidate questions and recordings of that job's calls are deleted 30 days later, and a candidate with no other job in the Customer's organization becomes due for erasure at the same time.

When the Customer's organization account is deleted or closed, its workspace becomes unavailable at once, and every candidate in it becomes due for erasure 30 days later.

A candidate whose phone number or job is in one of these countries: United Kingdom, India, becomes due for erasure 180 days after the last of their jobs closed or was deleted, unless the Customer recorded that they joined its talent pool.

A deletion request a candidate makes with the delete-my-data link in Arcanext's emails and messages is due to be completed within 30 days.

Deletion is handled through erasure requests. An administrator of the customer's organization can record a request for a candidate, and by default a second administrator must authorize it. A request a candidate makes with a delete-my-data link is authorized automatically if no administrator authorizes it first, and the deletion rules above record and authorize their own requests. Requests are recorded at once and are carried out only while erasure is enabled for the service. Erasure removes the candidate's content from the application database and deletes their stored résumé files and call recordings, except files shared with other candidates or under a legal hold. It does not remove copies held in backups or by sub-processors, and some billing records keep a pseudonymous reference. Deleting an organization account makes its workspace unavailable at once.

When the data of a candidate with a United States phone number or a United States job is erased, a de-identified record of each such application is kept for four years, so that the employer can answer an audit of its use of AI in hiring. It holds no name or contact details. It holds random record references, references to the employer and the job, the job country and the candidate's phone country, how the candidate was sourced, the screening status, the hiring decision with the date it was recorded and a reference to the employer user who recorded it, the résumé match score and the interview score with the scorer, model and prompt versions used, the dates the application was added and erased, and the date the record is due for deletion.

Liability and governing law

Liability and governing law follow the Terms. This DPA is governed by the laws of India, with exclusive jurisdiction of the courts of Mumbai, Maharashtra.