Data processing agreement

2. Our commitments

• We process personal data only on your documented instructions: these terms and the way you set up your jobs in the product. We tell you if we think an instruction breaks data protection law.
• Everyone at AnswerReel who can access personal data is bound by confidentiality.
• We apply the security measures in Annex II and keep them up to date.
• You give general authorization for the subprocessors in Annex III. We email you at least 14 days before adding or replacing one; if you object on reasonable grounds and we can't resolve it, you may end the affected service and get a refund of prepaid fees for it. We remain responsible for our subprocessors; section 3 says where their terms fall short of what this agreement requires.
• We help you answer candidates' requests (the product lets them delete their own answers) and, where reasonable, with impact assessments and consultations.
• We notify you of a personal data breach affecting your data without undue delay, and in any case within 48 hours of becoming aware of it, with the information you need to meet your own duties.
• When you delete your organization, we delete your data within 24 hours, apart from the minimal records described in our privacy policy and copies in backups, which expire within 30 days.
• We give you the information needed to show compliance with this agreement and allow reasonable audits, at your cost, once a year with 30 days' notice.

3. International transfers

Data is stored with providers in the United States, except where section 5 says otherwise: Cloudflare doesn't guarantee the location we ask for, and Stripe handles billing data in other countries too. Our team may access the service from Hong Kong or mainland China. Where the GDPR applies to a transfer, the Standard Contractual Clauses adopted by the European Commission are incorporated into this agreement: Module Two (controller to processor) where you are the controller, and Module Three (processor to processor) where you process the data for someone else, such as an agency screening for an employer client. You are the data exporter and we are the data importer, with these choices for both modules:

• Clause 7 (docking clause) applies.
• Clause 9: option 2, general written authorization, with the 14-day notice above.
• Clause 11: the optional language does not apply.
• Clause 13: the supervisory authority is the one competent for you under that clause.
• Clauses 17 and 18: Irish law and the courts of Ireland.
• Annexes I, II and III: sections 1, 4 and 5 of this agreement.

Where the UK GDPR applies, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those clauses, with the parties and annexes above, and either party may end it as section 19 of the Addendum allows.

Where the Swiss Federal Act on Data Protection (FADP) applies to a transfer, the same Clauses also apply under that Act, with these changes for that transfer: references to the GDPR also cover the FADP, the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority, and data subjects in Switzerland can bring claims where they habitually live. Where the GDPR applies as well, its protections and the role of EU supervisory authorities are unchanged.

Clause 9 requires written contracts with subprocessors that impose substantially the same data protection obligations as these Clauses. We rely on each provider's standard data processing terms, listed in section 5, and haven't negotiated changes to them. That leaves four gaps:

• Deepgram has no signed data processing agreement with us yet.
• The Gmail account that receives our privacy and support email has no data processing agreement.
• Tencent Cloud's terms don't cover data under the Swiss FADP.
• Clause 9(e) requires that, if AnswerReel ceases to exist, you can have a subprocessor delete or return your data. We haven't negotiated this with any provider, and Mux's terms exclude rights for anyone but Mux and us.

If you need a signed copy, with both parties' details completed for the Clauses and the UK Addendum, email privacy@answerreel.com.

4. Security measures (Annex II)

• All traffic is encrypted in transit with TLS.
• Permissions are checked on our servers for every request, and the database enforces each organization's boundary as a second line of defense.
• Interview, share and delete links use random codes of at least 128 bits; those codes are masked in our logs and error reports, and those pages load no third-party scripts.
• Recordings and files are only available through signed links that expire after 15 minutes.
• The scoring model receives only the question, its criteria and the words of the answer. We don't send it video, audio, or the name and email address the candidate entered. Audio goes only to the transcription provider.
• Data is deleted automatically at the end of its retention period, and on request within 24 hours. Deletions are logged separately from the database so they are reapplied if a backup is ever restored.
• Databases are backed up daily, including to a separate provider; backups are kept for up to 30 days.
• Our staff do not view candidate answers except to answer a customer's support request with the customer's agreement, and each access is recorded in an audit log.
• Owner-only controls for billing, API keys, deletion and audit logs; deletions, exports and shares are recorded in an audit log.

5. Subprocessors (Annex III)

6. Transfer impact assessment

United States

The data stored in the United States is candidates' interview content and contact details, and your users' account details. Our providers there are subject to US surveillance laws, including FISA section 702. The safeguards: encryption in transit, strict access controls, data minimization (we don't send the names or email addresses candidates enter to AI providers), short retention, and the redress mechanism created by Executive Order 14086, which applies to transfers relying on the Data Privacy Framework and is relevant to SCC transfers as well.

Hong Kong and mainland China

Our team works remotely from Hong Kong and mainland China. Candidate data is not stored there. It is viewed only to answer a support request the customer agrees to, and each such access is recorded in an audit log. Hong Kong has its own data protection law, the Personal Data (Privacy) Ordinance. We are not aware of any request from a public authority for customer data, and we would tell the affected customer of any such request unless the law prohibits it.

Questions about this agreement go to privacy@answerreel.com.