Data Processing Agreement
Last updated: October 30, 2026
Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between [ENTITY NAME] ("Processor", "TrueCandidate") and the Customer ("Controller"). It applies whenever TrueCandidate processes personal data on the Customer's behalf. A signed copy on the Customer's paper is available on request; the terms are the same.
1. Roles and scope
The Customer is the controller of candidate personal data processed through the Service, and TrueCandidate is the processor. TrueCandidate processes that data only on the Customer's documented instructions, which are: the Terms, this DPA, and the Customer's use of the Service's settings (retention period, research option, reviewer roles, erase requests).
2. Details of processing
| Subject matter | Remote recruiting interviews run through the Service |
| Duration | For the life of the Customer account, and for each interview until the end of the Customer's retention period (7–90 days) or earlier erasure |
| Nature and purpose | Recording the interview; collecting browser, timing and on-device gaze signals; showing plain-language observations to the interviewer; storing boards, interviewer-run checks and reviewer decisions; producing the evidence pack |
| Data subjects | Candidates; the Customer's interviewers and reviewers |
| Categories of data | Video and audio recording; browser signals (tab focus, paste length, display count, device names); answer timing; eye and head movement summary numbers; board contents; consent record (text version, time, hashed IP, browser); candidate email (encrypted); reviewer decisions and audit log |
| Special categories | None intended. Eye and head movement is processed as summary numbers on the candidate's device; face geometry is not stored. The Customer must not instruct processing of special-category data |
| Automated decisions | None. The Service produces no score and makes no decision about any data subject |
3. Processor obligations
TrueCandidate will:
- Process personal data only on the Customer's instructions, and inform the Customer if an instruction appears to infringe data protection law.
- Ensure that staff with access are bound by confidentiality and limited to what support requires. Access to a Customer's data by TrueCandidate staff is logged in the same audit log the Customer sees.
- Implement the technical and organisational measures in Annex 1.
- Engage sub-processors only as set out in section 5.
- Assist the Customer with data-subject requests, by providing the candidate page after each interview (access, re-review, research withdrawal) and by acting on erase requests within 72 hours.
- Assist with data-protection impact assessments and prior consultation, by providing the Security overview, the rules documentation and this DPA.
- Notify the Customer of a personal-data breach affecting its data without undue delay and within 72 hours of becoming aware, with the information needed for the Customer's own notifications.
- On termination, delete all Customer personal data within 30 days unless law requires retention, and confirm deletion on request. Candidate recordings are in any case deleted on the retention schedule.
- Make available the information needed to demonstrate compliance, and allow audits by the Customer or an auditor it mandates, on 30 days' notice, no more than once a year unless a breach has occurred, at the Customer's cost.
4. Customer obligations
The Customer is responsible for the lawfulness of the processing, including obtaining valid consent through the Service's consent screen, giving any notices required by local hiring law, responding to data-subject requests, and setting an appropriate retention period.
5. Sub-processors
The Customer authorises the sub-processors listed at /subprocessors. TrueCandidate will give at least 30 days' notice by email before adding or replacing one; the Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection and, failing that, the Customer may terminate the affected service with a pro-rata refund. TrueCandidate remains liable for its sub-processors.
6. International transfers
Processing takes place in the United States. Where the Customer transfers personal data from the EEA, UK or Switzerland, the parties rely on the EU Standard Contractual Clauses (Module 2, controller to processor), the UK International Data Transfer Addendum and the Swiss addendum, which are incorporated by reference with the Customer as data exporter and TrueCandidate as data importer, and with the details in section 2 and Annex 1 as the required annexes. TrueCandidate will provide a signed copy on request.
7. Liability
Liability under this DPA is subject to the limits in the Terms of Service.
8. Precedence
If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.
Annex 1 — Technical and organisational measures
- Encryption. TLS 1.2+ in transit; encryption at rest for the database and recording storage; candidate email encrypted with a separate application-level key (AES-256-GCM).
- Access control. Organization-scoped data access on every request; role-based permissions for interviewers, reviewers and administrators; super-administrator access limited to named staff and logged.
- Recording storage. Private object storage with per-tenant prefixes; playback and download only via signed URLs valid for 15 minutes; every view and export written to an audit log with user, time and origin.
- Telemetry integrity. Events from the candidate's browser are signed with a per-session token and verified server-side; rate limits and clock-skew checks reject injected or replayed data.
- On-device processing. Face tracking runs in the candidate's browser from self-hosted models; no face images or third-party calls leave the browser.
- Retention and deletion. Automated nightly deletion at the Customer-set retention period; erase on demand; disputes freeze deletion.
- Secrets. Stored in the hosting provider's secret manager; not in code or images.
- Monitoring. Error monitoring and health checks; recording and job failures alert the operator.
- Backups. Database point-in-time recovery through the database provider; backups encrypted; recordings are not backed up beyond the retention period.
- Personnel. Confidentiality obligations; least-privilege access; access reviews when staff change.