Talent Master — Data Processing Agreement

This data processing agreement (the "DPA") is entered into between:

• the company that holds a Talent Master workspace and accepts this DPA online through a user with authority to bind it (the "Customer"), acting as controller; and
• GETPRO SAS, a French simplified joint-stock company registered with the Paris Trade and Companies Register under number 812 105 138, whose registered office is at 117 rue de Charenton, 75012 Paris, France, which publishes and operates Talent Master ("GETPRO"), acting as processor.

It forms part of the terms under which the Customer uses Talent Master (the "Agreement"). Where this DPA and the Agreement conflict on the protection of personal data, this DPA prevails.

"GDPR" means Regulation (EU) 2016/679. "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning the GDPR gives them. "Customer Personal Data" means the personal data GETPRO processes on the Customer's behalf through Talent Master, as described in Appendix 1. "Sub-processor" means a processor GETPRO engages to process Customer Personal Data. "Workspace" means the Customer's account in Talent Master and the data held in it.

2.1. For Customer Personal Data, the Customer is the controller and GETPRO is the processor. The Customer decides which roles to recruit for, which candidates to search for, keep, reject and contact, and what is sent to them. GETPRO processes Customer Personal Data only to provide Talent Master to the Customer.

2.2. GETPRO acts as a controller, not as a processor, for the data of the Customer's own users needed to manage their accounts, authentication, security and billing. That processing is described in GETPRO's privacy policy and falls outside this DPA.

2.3. Appendix 1 sets out the subject matter, nature and purpose of the processing, the categories of data and of data subjects, and its duration.

3.1. The Customer is responsible for the lawfulness of the processing it instructs, including its legal basis, for informing data subjects, and for the content of the messages sent in its name.

3.2. Talent Master adds to the first email each candidate receives a notice stating who is writing and why, where the profile was found, the use of artificial intelligence in shortlisting it, the candidate's rights, and a link through which the candidate can object to being contacted or have their data erased. The Customer cannot remove this notice. It remains responsible for the information it owes beyond it, including its own privacy policy.

3.3. The Customer must not use Talent Master to process special categories of personal data or data relating to criminal convictions, and must not set search or selection criteria based on a protected characteristic or its proxy, such as age, year of graduation, name, photograph or address. A requirement the role objectively needs, such as the place of work or a language used in the job, is not a protected characteristic where the law allows it (Article L1133-1 of the French Labour Code). Talent Master refuses such criteria when it detects them.

3.4. The Customer reviews each candidate the screening keeps before contacting them, and approves each sequence before it is sent. Talent Master sends no message to a candidate in the Customer's name without that approval. Messages that a candidate's own action triggers, such as the confirmation of an erasure request, fall outside this approval.

4.1. Instructions. GETPRO processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers outside the European Economic Area, unless EU or Member State law requires otherwise, in which case GETPRO informs the Customer of that legal requirement before processing, unless the law prohibits it. The Agreement, this DPA and the Customer's use and settings of Talent Master constitute the Customer's documented instructions. GETPRO informs the Customer without delay if, in its opinion, an instruction infringes data protection law.

4.2. Confidentiality. GETPRO ensures that the persons it authorises to process Customer Personal Data are bound by confidentiality and access it only as their work requires.

4.3. Security. GETPRO implements the technical and organisational measures described in Appendix 2, which take into account the state of the art, the cost of implementation and the risks of the processing, in accordance with Article 32 GDPR. GETPRO may update these measures provided the overall level of security is not reduced.

4.4. Data subjects' rights. GETPRO assists the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects. Talent Master provides the candidate with a link to object to being contacted and to request the erasure of their data. An erasure requested through Talent Master applies to the Workspace of the Customer that holds the candidate's data, and to no other customer's. GETPRO forwards to the Customer, without undue delay, any request it receives directly that concerns Customer Personal Data, and does not answer it unless the Customer instructs it to. GETPRO's contact for data protection is [email protected].

4.5. Assistance. Taking into account the nature of the processing and the information available to it, GETPRO assists the Customer in meeting its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation of the supervisory authority.

4.6. Personal data breaches. GETPRO notifies the Customer without undue delay, and no later than 48 hours after becoming aware of it, of any personal data breach affecting Customer Personal Data. The notification describes, as far as GETPRO knows them, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. GETPRO provides further information as it becomes available.

4.7. Records. GETPRO keeps a record of the processing it carries out on behalf of its customers, as Article 30(2) GDPR requires.

4.8. Use of data. GETPRO does not sell Customer Personal Data and does not use it for its own purposes. In particular, GETPRO does not use Customer Personal Data, including the Customer's decisions on candidates, to train or improve artificial intelligence models for other customers or for its own account, unless the Customer has given its specific written authorisation for that purpose, separately from this DPA.

5.1. Talent Master uses artificial intelligence models to search for profiles, to shortlist them against the Customer's criteria, giving a reason for each one, and to help draft messages. The output is a recommendation: the Customer decides which candidates to keep, reject and contact.

5.2. Talent Master records the screening's reasons and the Customer's decisions, so that the Customer can review them and a candidate rejected by the screening can be rescued.

5.3. Where Regulation (EU) 2024/1689 (the AI Act) applies to Talent Master as a high-risk AI system used in recruitment, GETPRO acts as its provider and the Customer as its deployer. GETPRO will provide the Customer with the instructions for use and the information the Customer needs to meet its own obligations as a deployer before those obligations apply.

6.1. The Customer gives GETPRO a general authorisation to engage sub-processors. The sub-processors in use on the date of this version are listed in Appendix 3.

6.2. GETPRO informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by updating the list and by email to the Workspace administrators. The Customer may object on reasonable grounds relating to data protection within that period. If GETPRO cannot accommodate the objection, the Customer may terminate the Agreement before the change takes effect.

6.3. GETPRO engages each sub-processor under contractual terms covering the processing it performs, and remains liable to the Customer for the performance of each sub-processor's obligations.

Customer Personal Data is hosted in the European Union. Some sub-processors process it outside the European Economic Area, as Appendix 3 states. For those transfers, GETPRO relies on the safeguards each sub-processor offers, such as its certification under the EU-US Data Privacy Framework or the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914.

GETPRO makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR. The Customer may carry out, at its own cost, an audit once a year, or after a personal data breach affecting its data, with 30 days' written notice, itself or through an independent auditor bound by confidentiality, in a way that does not disrupt the service or reveal other customers' data. GETPRO may answer an audit request first with written answers and documentation.

9.1. This DPA applies for as long as GETPRO processes Customer Personal Data.

9.2. When the Agreement ends, or earlier at the Customer's request, GETPRO deletes the Customer Personal Data held in the Workspace within 30 days. Before that, the Customer may ask GETPRO for an export of its candidate records in a common machine-readable format. Copies held in backups are deleted as those backups expire, and are not restored meanwhile except to recover the service. GETPRO keeps no Customer Personal Data after that, unless EU or Member State law requires it to.

10.1. Each party's liability under this DPA is governed by the Agreement, without prejudice to Article 82 GDPR.

10.2. GETPRO may update this DPA, in particular to reflect a change in the law or in its sub-processors. Each version is dated. The Customer is asked to accept a new version before its next search for candidates or sequence is launched; until then, the version it last accepted continues to apply.

10.3. This DPA is governed by French law. Any dispute relating to it falls within the exclusive jurisdiction of the courts of Paris, France.

Subject matter and purpose. Running the Customer's recruitment through Talent Master: collecting the brief for a role, searching for and shortlisting candidates, finding their contact details at the Customer's request, contacting them from the Customer's own mailbox, handling their replies, scheduling interviews in the Customer's calendar and, if the Customer enables it, recording and transcribing those interviews.

Nature of the processing. Collection from public professional sources and from the providers listed in Appendix 3, storage, structuring, analysis by artificial intelligence, enrichment of contact details, sending of emails from the Customer's mailbox through the access the Customer's user grants, synchronisation of replies and calendar events, scheduling, recording, erasure.

Data subjects. Candidates and potential candidates for the Customer's roles; people who correspond with the Customer about those roles through its connected mailbox.

Categories of personal data.

• Identity: first and last name.
• Professional profile: job titles, employers, work history, education, skills, languages, location (city and country), public profile links such as LinkedIn and GitHub, and public professional activity such as open-source contributions.
• Contact details: email address and, if the Customer requests it, telephone number.
• Recruitment data: the screening's reasons, the Customer's decisions and notes, the stage of each application.
• Communications: the emails sent to candidates and their replies.
• Interviews: booked meetings and, if the Customer enables recording, the recording and its transcript.
• Rights: the candidate's objection to being contacted and their erasure requests.

Special categories. None are intended. See section 3.3.

Sources. Public professional profiles and pages on the web, including professional networks and GitHub, reached through the search providers listed in Appendix 3; contact details found by the enrichment provider; what candidates send the Customer.

Location. Customer Personal Data is stored on Google Cloud in the European Union: the database in the Paris region (europe-west9), France. The sub-processors in Appendix 3 process the data they receive where that appendix states.

Duration. For the term of the Agreement, within the retention periods the Customer applies, then as described in section 9.

• Hosting. Application servers and the database run on Google Cloud in the Paris region (europe-west9), and files are stored on Google Cloud in the European Union. Data is encrypted at rest by the hosting provider.
• Encryption in transit. All traffic between users, candidates and Talent Master travels over TLS.
• Isolation between customers. Each Workspace's data is separated from other customers' by row-level security in the database, applied to every query.
• Access control. Users sign in with their Google or Microsoft account. Access within a Workspace is governed by per-user permissions. Access to production systems is limited to the GETPRO staff who need it to run the service. Acting inside a customer's Workspace through the application's staff console requires an explicit staff grant and is recorded.
• Mailbox and calendar access. Talent Master accesses a user's mailbox and calendar only through the OAuth access that user grants, which they can revoke at any time from their Google or Microsoft account.
• Data minimisation in AI processing. Candidates' names are removed from the profiles the screening model reads. The screening is not given protected characteristics as criteria.
• Erasure. An erased candidate's contact details and profile identifiers are kept only as one-way hashes, in the Customer's suppression list, so that the candidate is not sourced or contacted again by that Customer.
• Monitoring. Application logs, metrics and traces are collected and kept within GETPRO's own infrastructure on Google Cloud.
• Abuse prevention. Requests are rate-limited per user, per Workspace and per IP address.
• Personnel. Staff with access to Customer Personal Data are bound by confidentiality and access it only as their work requires.

Emails to candidates are sent from the Customer's own Gmail or Outlook mailbox. Google and Microsoft act there under the Customer's own agreement with them, not as GETPRO's sub-processors. Likewise, the data Talent Master returns to the conversation in the Customer's AI assistant is processed by that assistant's provider under the Customer's own agreement with it, not as GETPRO's sub-processor.