Data Processing Agreement
Parties and scope
This agreement governs the processing of personal data by FTM Ventures OÜ (registry code 17592430, Toomkivi 5-8, Kiili, 75401, Estonia; the processor) on behalf of the Customer (the controller) in connection with the Relevnt service. The Customer is identified in the acceptance record created when its authorised representative accepted this agreement while creating the company workspace.
It forms part of the Terms of Service. Where the Terms and this agreement conflict on a matter of data protection, this agreement prevails.
Contact for data protection matters: hello@relevnt.eu, +372 533 41 671, or by post to FTM Ventures OÜ, Toomkivi 5-8, Kiili, 75401, Estonia.
1. Roles
The Customer is the controller of candidate personal data and of the content its own users create in the service (notes, messages, evaluation requests). FTM Ventures OÜ is the processor of all of it. The Customer decides which roles to advertise, which candidates to consider, and what happens to each application. FTM Ventures OÜ provides the tooling and does not make those decisions.
FTM Ventures OÜ is a separate controller, outside this agreement, for two narrow things: the account records it needs to run the service (a user's name, work email and authentication data) and its own billing and accounting records. That processing is governed by the Privacy Policy.
The Customer determines the purposes and means of the processing and warrants that it has a lawful basis for the candidate data it puts into the service, including under Article 9 GDPR where special category data is involved. The Customer is responsible for giving candidates the information required by Articles 13 and 14, including that AI is used to assist screening. The Customer must not upload criminal conviction data (Article 10). The Customer may at any time instruct the processor under clause 2, export or delete data under clause 9, and audit under clause 10.
2. Instructions
FTM Ventures OÜ processes candidate personal data only on the Customer's documented instructions. For these purposes the Customer's instructions are: this agreement and the Terms of Service; the actions the Customer's users take in the product (creating a role, uploading a CV, running an evaluation, sending a message, deleting a record); and any further written instruction the Customer gives to hello@relevnt.eu, which FTM Ventures OÜ may charge for if it requires work outside the normal operation of the service.
FTM Ventures OÜ will not process candidate personal data for any purpose of its own. In particular it will not use candidate data to train or fine-tune machine learning models, its own or anyone else's, and will not sell or share candidate data with anyone other than the sub-processors listed in Annex 3. It may process candidate data as strictly necessary to operate, secure and troubleshoot the service, including investigating a fault the Customer has reported.
Where EU or Estonian law requires FTM Ventures OÜ to process candidate personal data other than on the Customer's instructions, it will inform the Customer of that requirement before processing, unless the law prohibits it from doing so.
If FTM Ventures OÜ considers that an instruction infringes the GDPR or other EU or Member State data protection law, it will inform the Customer without delay and may suspend that instruction until the matter is resolved.
3. Subject matter and duration
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex 1. Processing continues for as long as the Customer's account is open, and ends as set out in clause 9.
4. Confidentiality
Everyone authorised by FTM Ventures OÜ to process candidate personal data is bound by a duty of confidentiality that survives the end of their engagement. Access is limited to the people who need it to operate and support the service.
5. Security
FTM Ventures OÜ implements the technical and organisational measures set out in Annex 2, which are appropriate to the risk under Article 32 GDPR, and reviews them as described there. It may change those measures provided the level of protection is not reduced, and will update Annex 2 when it does.
6. Sub-processors
The Customer gives general authorisation for FTM Ventures OÜ to engage the sub-processors listed in Annex 3.
FTM Ventures OÜ will give the Customer at least 30 days' notice by email before adding or replacing a sub-processor, except where a replacement must be made sooner to address a security risk, in which case notice is given as soon as practicable. The Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected part of the service without penalty and receive a refund of any prepaid, unused fees.
FTM Ventures OÜ engages each sub-processor under a written contract imposing data protection obligations that meet the requirements of Article 28(3), and remains fully liable to the Customer for a sub-processor's performance of those obligations. Those contracts are the sub-processors' own data processing terms; FTM Ventures OÜ will make them available to the Customer on request.
7. International transfers
Candidate personal data is stored in the European Union. It is processed outside the EEA only as set out in Annex 3, which states the location and the transfer basis for each sub-processor.
Every transfer outside the EEA is covered by the European Commission's Standard Contractual Clauses or another mechanism valid under Chapter V GDPR. The transfer that currently relies on Standard Contractual Clauses in the ordinary operation of the service is the transfer to Anthropic for CV evaluation.
8. Assistance
Data subject rights. Where a candidate exercises a right under Chapter III GDPR, FTM Ventures OÜ will, taking into account the nature of the processing, assist the Customer with appropriate technical and organisational measures. In practice the Customer can access, export, correct and delete candidate data directly in the product. If a candidate contacts FTM Ventures OÜ directly, it will not respond substantively but will forward the request to the Customer without undue delay.
Personal data breach. FTM Ventures OÜ will notify the Customer without undue delay, and in any event within 72 hours, of confirming a personal data breach affecting the Customer's data. "Confirming" means establishing that a breach has in fact occurred, not merely receiving a report that one may have. The notification will describe, so far as known, the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken. FTM Ventures OÜ will assist the Customer with its obligations under Articles 33 and 34, but will not notify a supervisory authority or any data subject on the Customer's behalf unless asked to.
Impact assessments. FTM Ventures OÜ will assist the Customer with data protection impact assessments and prior consultations under Articles 35 and 36, taking into account the information available to it. A pre-filled assessment covering this service is published at /legal/dpia for the Customer to adopt and complete.
9. Deletion and return
On termination of the Customer's account, or at any earlier point on written request, the Customer may choose whether FTM Ventures OÜ deletes or returns the candidate personal data. The Customer can export its data from the product at any time while the account is open. Where no choice is made, FTM Ventures OÜ will delete the data. Deletion from live systems, including access records referring to the deleted records, happens within 30 days of termination.
FTM Ventures OÜ retains no candidate personal data after that. Its own account and accounting records, including the acceptance record for this agreement, are kept for seven years as required by the Estonian Accounting Act; those records are held by FTM Ventures OÜ as controller under clause 1 and do not contain candidate personal data.
10. Audit
FTM Ventures OÜ will make available to the Customer the information necessary to demonstrate compliance with Article 28 and this agreement. In the first instance that means a written description of its technical and organisational measures, answers to a reasonable security questionnaire, and any audit reports or certifications its sub-processors publish.
Where that is genuinely insufficient to demonstrate compliance, the Customer may audit, or appoint an independent auditor to audit, the systems under FTM Ventures OÜ's own control, on 30 days' written notice, no more than once in any 12-month period unless a personal data breach or a supervisory authority requires otherwise. Audits take place during business hours, must not unreasonably disrupt the service, and the auditor must be bound by confidentiality. The Customer bears the cost unless the audit reveals a material breach of this agreement.
FTM Ventures OÜ cannot grant access to the systems of Supabase, Vercel, Anthropic or Resend; for those it will pass on the information and reports those providers make available.
11. AI evaluation
The service uses a large language model, supplied by Anthropic, to read candidate CVs and produce a written assessment and a score against the requirements the Customer has set.
The evaluation is a recommendation. It does not accept, reject, rank into a final order, or otherwise decide anything about a candidate. Every decision is taken by a person on the Customer's side. The Customer is therefore responsible for ensuring that its use of the service does not amount to a decision based solely on automated processing within the meaning of Article 22 GDPR, and for telling candidates that AI is used in its screening.
Under Anthropic's commercial terms, data submitted through its API is not used to train Anthropic's models. The service records which user opened each CV and who wrote each note, verdict and message, so the Customer can evidence human involvement.
FTM Ventures OÜ makes no representation that an evaluation is accurate, complete or free from bias, and the Customer must not use it as the sole basis for a decision that produces legal effects for a candidate or similarly significantly affects them.
12. Liability
Each party's liability under this agreement is subject to the limitations and exclusions in the Terms of Service. Nothing in this agreement limits either party's liability to a data subject or to a supervisory authority.
13. Term
This agreement takes effect when the Customer accepts it and continues until the Customer's account is closed and clause 9 has been performed. Clauses 4, 6, 7, 9, 10 and 12 survive termination.
14. Governing law
Estonian law. Disputes go to Harju County Court, without prejudice to a data subject's or supervisory authority's own rights.
Annex 1: Details of processing
Subject matter: provision of the Relevnt CV screening and applicant tracking service.
Duration: for the term of the Customer's account, plus the deletion period in clause 9.
Nature of the processing: collection, storage, text extraction, AI evaluation, scoring, sorting and filtering, note-taking, sending email to candidates, scheduling interviews, export and deletion.
Purpose: enabling the Customer to assess job applicants for roles it is recruiting for.
Categories of data subject: job applicants; the Customer's own users, to the extent they appear in content processed on the Customer's behalf.
Types of personal data: name, email address, telephone number, postal or city location, employment history, education, skills and languages, the content of a CV, cover letter or application form, any other information a candidate chooses to include, the evaluation output and score, notes written by the Customer's users, messages sent through the service, and interview times.
Special categories: not requested by the service. A candidate may nevertheless disclose special category data (health, disability, trade union membership, religion, a photograph revealing racial or ethnic origin) unprompted in a CV. The Customer instructs FTM Ventures OÜ to store and process such data as part of the application, and remains responsible for having a lawful basis under Article 9 for doing so.
Restricted data: the service is not intended for criminal conviction data under Article 10. The Customer must not upload it.
Annex 2: Technical and organisational measures
Access control. Every user authenticates against Supabase Auth. Data is partitioned by organisation and enforced at the database level by row level security, so one customer's queries cannot reach another customer's rows. Joining an existing organisation requires an invite code held by that organisation, which is rotated automatically every 30 days.
Encryption. TLS for all traffic in transit. Encryption at rest for the database and for stored files. CV files are held in a private bucket and served only through short-lived signed URLs.
Secrets. API keys and service credentials are held as environment variables in the hosting platform, never in the source repository.
Separation of environments. Development and testing are carried out against synthetic data. Production candidate data is not copied into test environments, except where strictly necessary to investigate a fault the Customer has reported.
Records of access. The service records which user opened each CV and who wrote each note, verdict and message. These records are deleted together with the candidate records they refer to under clause 9.
Patching. Dependencies are kept current and security updates are applied promptly.
Incident response. A written procedure covers detection, assessment, containment and notification of security incidents, including the notification in clause 8.
Personnel. Access to production data is limited to those who need it, under a confidentiality obligation.
Deletion. Deleting a candidate in the product removes the database record and the stored file. Retention rules set by the Customer in the product delete candidates automatically after the chosen period.
Review. These measures are reviewed, and their effectiveness assessed, at least annually and after any material change to the service, as required by Article 32(1)(d).
Annex 3: Sub-processors
Supabase: database, authentication, CV file storage. EU, no transfer.
Vercel: application hosting. EU region; US company, Standard Contractual Clauses.
Anthropic: AI evaluation of CVs. Processing in the US, Standard Contractual Clauses.
Resend: sending email to candidates and users. EU, no transfer.
Google or Microsoft: calendar invitations, only when a user connects their calendar. The invitation goes through the user's own calendar account, per the Customer's own agreement with that provider.
Google or Microsoft: calendar integration, only if the Customer enables it. EU / US, Standard Contractual Clauses.
Acceptance
This agreement is entered into electronically, which Article 28(9) GDPR expressly permits. The Customer is identified by, and this agreement is evidenced by, the record created when its authorised representative accepted it: the Customer's legal name and registry code, the name and email of the person accepting, the date and time, the SHA-256 fingerprint of this text, and the network address the acceptance came from.
That record, and the exact text accepted, is available to the Customer at any time in the product under Settings.