Data processing agreement

Roles

The customer is the controller of its candidates’ data. AuraHR is the processor and handles that data only for the customer and on its instructions. The basis for the processing is the Terms of service and this agreement.

What is processed

• purpose: publishing vacancies, receiving applications, screening CVs, running and assessing interviews, and showing the results to the customer;
• data subjects: people who apply to the customer or whom the customer invites;
• data: name, email and reference number; the CV and its text; audio and video recordings of interviews and their transcripts; if the customer turns them on, still screenshots of the shared screen, webcam photos and each time the candidate leaves the interview tab; AI assessments and the customer’s notes; technical data about the device check and connection;
• duration: for as long as the customer uses the service, and until the data is deleted as "Return and deletion" says.

Instructions

AuraHR processes the data only as the Terms, this agreement, the customer’s settings in the product and its written instructions say. If AuraHR believes an instruction breaks the law, it tells the customer and may wait for clarification. AuraHR does not use the data for its own purposes, except as "AI improvement" says.

The customer’s duties

The customer makes sure it has a lawful basis for the processing, informs its candidates, keeps the written rules the law requires for audio and video recording, and turns on only the monitoring it needs.

Confidentiality

Everyone at AuraHR who can access the data is bound by a duty of confidentiality that continues after their work ends.

Security

AuraHR keeps the measures described on the Security page, including encrypted connections, encrypted storage of recordings and backups, separation of each customer’s data, limited staff access and an audit log, and does not weaken them while the agreement lasts.

AuraHR records the operations performed on the data, including access, changes, disclosure and deletion.

Security

Other processors

By accepting the Terms, the customer agrees in writing to the providers on the Subprocessors page. AuraHR tells the customer by email at least 30 days before adding or replacing one. If the customer objects on reasonable grounds and the parties cannot settle it, the customer may end the agreement before the change takes effect, and fees prepaid for the remaining period are refunded.

AuraHR binds each provider to duties no weaker than those in this agreement and answers for what the provider does.

Subprocessors

Transfers abroad

The data is stored in the European Union. Where a provider processes data in another country, the Subprocessors page names that country. By accepting the Terms the customer authorises those transfers. They take place only on a basis that Article 37 of the Law allows, AuraHR takes the measures needed to protect the data, and a provider may pass the data on only for the same purpose and with the same protection.

Requests from candidates

If a candidate sends AuraHR a request about their data, AuraHR passes it to the customer within 2 working days and helps the customer answer within the legal deadline. On the customer’s instruction AuraHR gives access to, corrects, blocks or deletes a candidate’s data.

Incidents

AuraHR tells the customer about any incident affecting the customer’s data immediately after learning of it. The notice says what is known about the incident, the data and people affected and the steps taken, so that the customer can notify the Personal Data Protection Service within 72 hours where the law requires it.

Return and deletion

While the agreement lasts, a candidate’s data is deleted automatically 24 months after the candidate’s last activity, and within minutes when the customer deletes the vacancy.

When the agreement ends, AuraHR stops processing, hands all of the customer’s data over to the customer without delay and then deletes its own copies, unless the law of Georgia requires it to keep them. Backup copies expire on their normal cycle and are not restored for use.

If the parties are in dispute about the processing, AuraHR stops processing at once and hands the data over to the customer.

AI improvement

Where a candidate has separately and voluntarily agreed, AuraHR may use that candidate’s interview to improve its own speech recognition and assessment systems. AuraHR is the controller for that use and stops when the candidate withdraws consent.

Records

AuraHR keeps the record of processing that Article 28 of the Law requires of a processor and gives it to the Personal Data Protection Service on request.

Information and audits

AuraHR gives the customer the information needed to show that this agreement is kept. Where that is not enough, the customer may audit once a year, on 30 days’ notice, during working hours and without access to other customers’ data.

Liability and law

The liability limit, governing law and court in the Terms of service apply to this agreement.