Data Processing Agreement

Roles

This agreement applies where you (the customer) act as controller of candidate personal data and FTM Ventures OÜ acts as processor, and forms part of the Terms of Service. Where our terms and this agreement conflict on data protection, this agreement wins.

Subject matter

Processing: storage, text extraction, AI evaluation, ranking, scheduling and, where you enable it, sending candidate emails.

Categories of data subject: job applicants and your own team members.

Categories of data: identification and contact details, employment and education history, application content, evaluation output, and interview times.

Duration: for as long as your account is open, unless you delete the data sooner.

Our obligations

We process candidate data only on your documented instructions, which for these purposes are the actions you take in the product.

Everyone with access is bound by confidentiality.

We apply the technical and organisational measures described in our Privacy Policy, including encryption in transit and at rest, private CV storage with signed access, and organisation-level access separation.

We assist you, as far as we reasonably can, with data subject requests, security incidents, and impact assessments.

We notify you without undue delay after becoming aware of a personal data breach affecting your data.

On termination we delete your candidate data, except where EU or Estonian law requires us to keep something.

Sub-processors

We use: Supabase (database, auth, storage — EU), Vercel (hosting — EU), Anthropic (CV evaluation), and, when you enable the relevant feature, Microsoft or Google (calendar) and our email provider.

You give general authorisation for these. We will give notice before adding a new sub-processor, and you may object on reasonable data protection grounds.

Transfers and audits

Personal data is stored in the EU. Where a sub-processor requires a transfer outside the EEA, it is covered by the European Commission's Standard Contractual Clauses.

On reasonable notice, and no more than once a year unless an incident warrants it, we will provide the information needed to demonstrate compliance with this agreement.