Data Processing Addendum
[LAWYER REVIEW] This DPA is a working draft for B2B pilots. It must be completed with the legal entity, governing law, transfer mechanism and signature block before it is signed.
1. Roles and scope
For candidate data submitted through a cohort or licence, the business customer is the controller and [LEGAL ENTITY] is the processor. This DPA covers the account data, offer content, generated sites and support data processed to provide the service. It does not cover data the customer collects independently.
2. Instructions and purpose
We process personal data only on documented instructions from the customer, to provide the service, secure it and comply with law. We do not sell the data, use it for advertising, or use it to train our own models.
3. Subprocessors
The current list is on the Privacy Policy (Hetzner, Cloudflare, GitHub, Infisical and the email processor). We give notice before adding a subprocessor that processes candidate data and give the customer a chance to object. The customer may subscribe to subprocessor-change notices at hello@interviewchallenger.com.
4. Security measures
- Encryption in transit (TLS) and access-controlled secrets outside the repository.
- Role-limited access, audit logging and least-privilege deployment credentials.
- EU hosting for the application and database; encrypted backups with limited access.
- Incident response and notification without undue delay after confirmation.
5. Breach notification
We notify the customer without undue delay after becoming aware of a personal-data breach affecting its data, with the known facts, likely impact and remediation. The customer is responsible for its own supervisory-authority and data-subject notifications.
6. Assistance and rights
We assist with data-subject requests, impact assessments and prior consultations, taking into account the nature of the processing. Requests that concern a customer’s candidates are forwarded to the customer unless the law requires otherwise.
7. Deletion and return
On termination, we delete or return the customer’s personal data at its choice, except where law requires retention. Backups are deleted on their normal cycle (currently 30 days) and are not restored except for disaster recovery.
8. Audits
We answer reasonable security questionnaires and provide the current security page. An on-site audit requires reasonable notice, a confidentiality agreement and a scope agreed in advance.
9. International transfers
Where a subprocessor processes data outside the EU/EEA, we rely on the European Commission’s standard contractual clauses or an equivalent mechanism. The transfer mechanism must be confirmed in the [LAWYER REVIEW].
10. Contact
DPA questions and signatures: hello@interviewchallenger.com.