Privacy Policy - RecruitMateAI

1. Background

This data processing agreement ("DPA") supplements the RobX Technologies Ltd ("RecruitMate AI" or "RecruitMate") Terms of Service distributed to the Customer, as updated from time to time between you and RecruitMate AI, or other agreement between you and RecruitMate AI governing your use of the Platform.

This DPA is an agreement between you and the entity you represent ("Company", "you" or "your") and RobX Technologies Ltd ("RecruitMate AI", "we", "our" or "us").

This DPA does not apply to any processing of personal data in connection with RecruitMate AI's exercise of its rights under Section 3.15 of the Terms of Service.

In the event of any conflict between the remaining provisions of the Terms of Service and this DPA, this DPA shall prevail.

2. Definitions

Unless otherwise set out below, each capitalised term in this DPA shall have the meaning set out in the Terms of Service and the following capitalised terms used in this DPA shall be defined as follows:

"Adequate Jurisdiction" means the UK, EEA, or a country, territory, specified sector or international organisation which ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data, as set out in:

the Data Protection Act 2018 ("DPA 2018") or regulations made by the UK Secretary of State under the DPA 2018; and
with respect to data subjects located in the EEA, a decision of the European Commission;

"Company Personal Data" means any personal data processed by RecruitMate AI on behalf of the Company in connection with the provision of the RecruitMate AI Platform.

"Data Protection Laws" means any laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK and the EEA and applicable to RecruitMate AI's processing of Company Personal Data, including the EU GDPR, the UK GDPR and the DPA 2018.

"GDPR" means Regulation (EU) 2016/679 (the "EU GDPR") or, where applicable, the "UK GDPR" as defined in section 3 of the Data Protection Act 2018.

3. Instructions for Data Processing

RecruitMate AI shall process Company Personal Data only:

for the purpose of providing the RecruitMate AI Platform; and
on documented instructions from the Company,

unless other processing is required by applicable law in the EEA or the UK to which RecruitMate AI is subject, in which case RecruitMate AI shall inform the Company of that legal requirement before processing the Company Personal Data, unless the law prohibits this on important grounds of public interest.

4. Company Warranties and Undertakings

The Company represents and warrants that:

it has provided all applicable notices to data subjects and, to the extent required, obtained consent from data subjects in each case as required for the lawful processing of the Company Personal Data in accordance with the Terms of Service, including this DPA; and
taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the security measures are appropriate to ensure the security of the Company Personal Data.

5. Confidentiality

RecruitMate AI shall ensure that:

access to the Company Personal Data is limited to those employees or other personnel who have a business need to have access to such the Company Personal Data; and
any employees or other personnel have agreed in writing to protect the confidentiality and security of the Company Personal Data and do not process such Company Personal Data other than in accordance with this DPA.

6. Sub-processors

The parties agree that the Company gives RecruitMate AI general authorisation to engage Sub-processors from an agreed list.

RecruitMate AI shall:

enter into a written contract with each Sub-processor that contains terms that are substantially the same as those set out in this DPA; and
remain liable to the Company for the Sub-processor's processing of Company Personal Data.

7. International Transfers

RecruitMate AI shall not transfer the Company Personal Data outside the UK or EEA other than:

to Sub-processors appointed in accordance with paragraph 6;
in accordance with documented instructions from the Company; or
in order to fulfil a specific requirement under applicable law in the EEA or the UK to which RecruitMate AI is subject.

8. Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, RecruitMate AI shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

Technical and Organisational Measures

RobX Technologies Ltd employs a combination of policies, procedures, guidelines and technical and physical controls to protect the personal data it processes from accidental loss and unauthorised access, disclosure or destruction:

Governance and Policies: Documented security measures and regular policy reviews
Access Controls: Limited administrative access, strong password requirements, authentication and authorisation
Encryption: Data encryption at rest and in transit, secure portable device encryption
Breach Response: Cyber Security Incident Response Plan that is regularly tested and updated
Anti-virus and Anti-malware: Regular penetration testing, vulnerability scanning, and event log monitoring
Backup and Recovery: Documented disaster recovery plan with regular testing
Staff Training: Regular security training and background checks for personnel

9. Personal Data Breaches

If RecruitMate AI becomes aware of a personal data breach, RecruitMate AI shall:

notify the Company of the personal data breach without undue delay;
investigate the personal data breach and provide such reasonable assistance to the Company as required;
take steps to remedy any non-compliance with this DPA.

10. Data Subject Rights

RecruitMate AI shall notify the Company if it receives a request from a data subject to exercise their rights under Data Protection Laws in respect of the Company Personal Data and shall not respond to the data subject other than to notify them that the Company acts as the controller of their personal data.

The Company shall have sole responsibility for responding to and giving effect to any Data Subject Requests. RecruitMate AI shall assist the Company by providing requested personal data and implementing data modifications as instructed.

11. Data Retention and Deletion

RecruitMate AI shall, following the date of termination or expiry of the Terms of Service retain the Company Personal Data for ninety (90) days (the "Retention Period"). Upon expiry of the Retention Period, RecruitMate AI shall delete all copies of Company Personal Data, other than any Company Personal Data that RecruitMate AI is required to retain under applicable law.

Details of Processing

Categories of data subjects	Personnel of Company (Authorised Users), External Stakeholders, Customers of the Company
Categories of personal data	Name and business contact details of Authorised Users; any personal data included by Company and Authorised Users in User Content, namely Full name, Age, Contact information and Address
Frequency of transfer	On-going
Nature of processing	Compute, store and the Services described in the Terms of Services and initiated by the Company and Authorised Users
Purpose of processing	The provision of the Services to the Company and Authorised Users
Duration of processing	The Term of the Subscription

Contact Information

For any questions regarding this Data Processing Agreement or your personal data, please contact:

RobX Technologies Ltd
Email: support@recruitmateai.com