Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the HiredIn Master Subscription Agreement, Order Form, or other written agreement governing Customer's use of the Services (collectively, the "Agreement") entered into by and between the customer identified in the Agreement ("Customer") and 1000991777 ONTARIO CORP. o/a HiredIn ("HiredIn" or "Company"). By executing or otherwise accepting this DPA in accordance with Section 11, Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws, in the name and on behalf of its Affiliates, if any. This DPA is incorporated into and forms part of the Agreement. Terms not defined in this DPA have the meanings given in the Agreement.

1. Definitions

• 1.1 "Affiliate" means an entity of which a party directly or indirectly owns fifty percent (50%) or more of the stock or other equity interest...
• 1.2 "Authorized Sub-Processor" means a third-party who has a need to know or otherwise access Customer's Personal Data to enable Company to perform its obligations under this DPA or the Agreement...
• 1.3 "Company Account Data" means personal data that relates to Company's relationship with Customer, including the names or contact information of individuals authorized by Customer to access Customer's account...
• 1.4 "Company Usage Data" means Service usage data collected and processed by Company in connection with the provision of the Services...
• 1.5 "Data Exporter" means Customer.
• 1.6 "Data Importer" means Company.
• 1.7 "Data Protection Laws" means all privacy, data protection, and data security laws applicable to the processing of Personal Data under the Agreement...
• 1.8 "EU SCCs" means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021...
• 1.9 "ex-EEA Transfer" means the transfer of Personal Data, which is processed in accordance with the GDPR, from the Data Exporter to the Data Importer outside the EEA...
• 1.10 "ex-UK Transfer" means the transfer of Personal Data covered by Chapter V of the UK GDPR...
• 1.11 "Services" means the HiredIn recruitment technology platform and related products and services described in the Agreement...

2. Relationship of the Parties; Processing of Data

2.1 The parties acknowledge and agree that with regard to the processing of Personal Data, Customer may act either as a controller or processor and, except as expressly set forth in this DPA or the Agreement, Company is a processor. Customer shall, in its use of the Services, at all times process Personal Data, and provide instructions for the processing of Personal Data, in compliance with Data Protection Laws.

2.2 Company shall not process Personal Data (i) for purposes other than those set forth in the Agreement and/or Exhibit A, (ii) in a manner inconsistent with the terms and conditions set forth in this DPA or any other documented instructions provided by Customer, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by Supervisory Authority...

2.4 During the term of the Agreement, Customer may export Customer's Personal Data using available functionality or request a reasonable export in a generally available format. Following expiration or termination of the Services, at Customer's choice, Company shall return or delete Customer's Personal Data...

2.5 United States State Privacy Laws. Except with respect to Company Account Data, Company Usage Data, and the direct-relationship data described in Section 9, to the extent the CCPA or another applicable comprehensive United States state privacy law applies, Customer is the business or controller and Company is the service provider, contractor, or processor for Customer's Personal Data...

2.6 AI-Assisted Features and Automated Processing. To the extent Customer enables an AI-assisted feature, Customer instructs Company to process Customer's Personal Data as necessary to provide that feature, which may include resume parsing, job-post creation assistance, candidate search, matching or ranking, screening insights or summaries, interview transcription or summarization, and mock-interview preparation. Company will not use Customer's Personal Data, including Personal Data relating to Candidates, to train or fine-tune a general-purpose or cross-customer artificial intelligence or machine-learning model without Customer's express written authorization.

3. Confidentiality

3.1 Company shall ensure that any person it authorizes to process Personal Data has agreed to protect Personal Data in accordance with Company's confidentiality obligations in the Agreement. Customer agrees that Company may disclose Personal Data to its advisers, auditors or other third parties as reasonably required in connection with the performance of its obligations under this DPA, the Agreement, or the provision of Services to Customer.

4. Authorized Sub-Processors

4.1 Customer acknowledges and agrees that Company may (1) engage its Affiliates as well as the Authorized Sub-Processors on the List to access and process Personal Data in connection with the Services and (2) from time to time engage additional third parties for the purpose of providing the Services, including without limitation the processing of Personal Data.

4.2 Company will maintain its current list of Authorized Sub-Processors (the "List"), including their functions, in the subprocessor section of HiredIn's Privacy Policy, on another HiredIn webpage or Trust Center designated for that purpose...

5. Security of Personal Data

5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Company shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing Personal Data.

6. Transfers of Personal Data

6.1 The parties agree that Company may process or transfer Personal Data outside the EEA, the UK, or Switzerland as necessary to provide the Services, including in Canada, the United States, and other jurisdictions where Company or its Authorized Sub-Processors operate...

7. Rights of Data Subjects

7.1 Company shall, to the extent permitted by law, notify Customer upon receipt of a request by a Data Subject to exercise the Data Subject's right of: access, rectification, erasure, data portability, restriction or cessation of processing, withdrawal of consent to processing, and/or objection to being subject to processing that constitutes automated decision-making...

8. Actions and Access Requests; Audits

8.1 Company shall, taking into account the nature of the processing and the information available to Company, provide Customer with reasonable cooperation and assistance where necessary for Customer to comply with its obligations under the GDPR to conduct a data protection impact assessment...

8.6 After becoming aware of a Personal Data Breach affecting Customer's Personal Data, Company shall notify Customer without undue delay through Customer's designated administrative or security contact and take commercially reasonable steps within Company's control to contain, investigate, mitigate, and remediate the Personal Data Breach...

9. Company's Role as a Controller

The parties acknowledge and agree that Company is an independent controller, and not a joint controller with Customer, for Company Account Data, Company Usage Data, and Personal Data that Company collects directly from an individual for HiredIn's own website, marketing, candidate account or profile, career-preparation tools, or other direct-to-individual services, in each case only to the extent Company determines the purposes and means of that processing...

10. Conflict

In the event of any conflict or inconsistency among the following documents, the order of precedence will be: (1) the applicable terms in the Standard Contractual Clauses; (2) the terms of this DPA; (3) the Agreement; and (4) the Company's privacy policy.