Legal

Data Processing Agreement

Effective: 2026-05-19 · Version 1.0

1. Parties + scope

This DPA forms part of the Master Subscription Agreement (or Pilot Agreement) between Customer (the data controller) and TalentOS (the data processor), governing the processing of Personal Data by TalentOS on Customer's behalf in connection with the TalentOS recruitment platform.

2. Definitions + applicable data-protection regimes

Terms not defined here have the meaning given in the relevant data-protection law applicable to Customer's data subjects. Customer is responsible for identifying which regime(s) apply to its operations. This DPA is drafted to be compatible with:

GDPR (EU Regulation 2016/679) + UK GDPR + Data Protection Act 2018
NDPR (Nigeria Data Protection Regulation 2019) + Nigeria Data Protection Act 2023
CCPA/CPRA (California Consumer Privacy Act + Privacy Rights Act)
POPIA (South Africa Protection of Personal Information Act, 2013)
LGPD (Brazil Lei Geral de Proteção de Dados, Law No. 13,709/2018)
PIPEDA (Canada Personal Information Protection and Electronic Documents Act)
Privacy Act 1988 (Australia) + Notifiable Data Breaches scheme
PDPA (Singapore Personal Data Protection Act 2012)
Data Protection Act 2019 (Kenya)

“Personal Data,” “Processing,” “Data Subject,” “Controller,” and “Sub-processor” have the meanings given in whichever regime applies to Customer's data subjects. References to specific Articles (e.g. GDPR Art. 28) apply mutatis mutandis where local-law equivalents exist.

3. Nature + purpose of processing

Purpose: to provide the TalentOS recruitment platform, including candidate sourcing, screening, pipeline management, interview scheduling, offer drafting, and analytics
Categories of data subjects: Customer's employees, recruiters, hiring managers, candidates, applicants, and agency partners
Categories of personal data: identification (name, email, phone), employment history, education, skills, interview notes, salary expectations, candidate-supplied documents (CVs, portfolios), and operational telemetry (IP address, user agent)
Duration: for the term of the underlying agreement, plus any audit-retention obligations agreed in writing

4. TalentOS obligations as processor

Process Personal Data only on documented instructions from Customer, as provided through the platform's documented interfaces (API, web UI, configuration)
Ensure all personnel authorised to process Personal Data are under confidentiality obligations
Implement appropriate technical + organisational measures (Section 7)
Assist Customer in responding to Data Subject requests by providing the export + delete endpoints documented at /account
Assist Customer with breach notification (Section 9), DPIAs, and prior consultations with supervisory authorities
Make available all information necessary to demonstrate compliance with Article 28 GDPR / NDPR equivalents, including permitting audits on reasonable notice (Section 10)

5. Sub-processors

Customer authorises the use of the following sub-processors, each of which processes a defined subset of Personal Data:

Sub-processor	Purpose	Location
Anthropic PBC	Generative AI inference	US
Vercel Inc.	Hosting + edge middleware	EU (fra1) + US (iad1)
Upstash Inc.	KV / Redis storage	EU + US
Resend Inc.	Transactional email	US (when active)
Functional Software Inc. (Sentry)	Error + performance monitoring	US (when active)

TalentOS will provide Customer at least 30 days' notice before adding or replacing a sub-processor. Customer may object on reasonable grounds; the parties will negotiate a remedy in good faith.

6. International transfers

Where Personal Data is transferred across borders, TalentOS implements appropriate safeguards as required by the source jurisdiction:

EU → outside EEA: European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914) + Transfer Impact Assessment where required by Schrems II
UK → outside UK: UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs
Nigeria → outside Nigeria: NDPR Art. 2.11 compliant transfer (consent, adequacy, or contractual safeguards)
South Africa → outside SA: POPIA s.72 compliant transfer (consent, adequacy, similar law, or BCRs)
Other jurisdictions: equivalent safeguards approved by the source jurisdiction's supervisory authority

On request, TalentOS will execute jurisdiction-specific transfer addenda (e.g. EU SCCs, UK IDTA) as a schedule to this DPA. The Customer's data controller obligations under their home jurisdiction remain with the Customer.

7. Security measures

TalentOS implements the following technical + organisational measures:

Encryption: TLS 1.3 in transit; encryption at rest on all storage backends (Vercel KV, Vercel Blob)
Access control: role-based access (RBAC) with per-tenant isolation enforced at every read + write
Authentication: scrypt-hashed passwords; 14-day session tokens; rate-limited login + password-reset
Audit trail: append-only, tenant-scoped, immutable. Exportable on demand (CSV with token + cost data)
Backups: Upstash provides multi-region replication; full snapshots per their published SLA
Vulnerability management: automated dependency scanning; security disclosures via security@talentosglobal.co
Incident response: documented runbook; Sentry-driven alerting (when configured)
Compliance posture: SOC 2 Type 1 readiness in flight; Type 2 follows. Vendor reviews + policy docs in progress with Vanta/Drata.

8. Data Subject rights

TalentOS supports Customer's compliance with Data Subject rights via:

Right to access — admin/CHRO export endpoint at /account
Right to erasure — admin tenant-delete endpoint at /account with typed confirmation
Right to correction — direct edit through platform UI / API
Right to data portability — JSON export (machine-readable, schema-versioned)
Right to object / restrict processing — configurable per feature

TalentOS will respond to Customer-forwarded Data Subject requests within 5 business days where engineering support is required, materially assisting Customer to meet its 30-day NDPR / 1-month GDPR obligation.

9. Breach notification

TalentOS will notify Customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data breach affecting Customer's tenant. Notification will include (where available): nature of the breach, categories + approx. number of Data Subjects affected, likely consequences, and measures taken or proposed.

10. Audits

Customer may audit TalentOS's processing once per twelve-month period on reasonable written notice (no fewer than 30 days), during normal business hours, subject to TalentOS's reasonable confidentiality + security requirements. SOC 2 reports (when available) will be made available under NDA in lieu of bespoke audits.

11. Return + deletion on termination

Within 30 days of termination of the underlying agreement, TalentOS will (at Customer's option) return all Customer Personal Data in machine-readable form OR delete it. Audit log entries may be retained for regulatory compliance for up to 7 years, anonymised where possible.

12. Order of precedence

In case of conflict, this DPA prevails over the Terms of Service. Where Customer-supplied DPA terms are signed by both parties (e.g. customer's standard DPA), those terms prevail to the extent of any conflict.

13. Governing law

This DPA is governed by the laws of England and Wales, consistent with the underlying Master Subscription Agreement / Pilot Memorandum. Choice of law does not displace mandatory local data-protection law applicable to Customer's data subjects — Customer's regulator-facing obligations under NDPR, GDPR, CCPA, POPIA, LGPD, etc. remain with Customer and are unaffected by this choice.

14. Contact

Privacy queries: privacy@talentosglobal.co
Security disclosure: security@talentosglobal.co
Legal / contracts: legal@talentosglobal.co

← Terms of service Pilot agreement →