JustHire Data Processing Agreement

1. Parties, scope and order of precedence

1.1 This Data Processing Agreement (“DPA”) is between Veritas Crescent LLC, doing business as JustHire, a Delaware limited liability company with its principal office at 8 The Green, Suite D, Dover, Delaware 19901, United States (“JustHire”), and the customer that has agreed to JustHire’s Terms of Service or a signed order form (“Customer”).

1.2 This DPA forms part of the agreement between JustHire and Customer for the JustHire service (the “Agreement”). It applies worldwide, whenever JustHire processes Customer Personal Data on Customer’s behalf, including data imported from an applicant tracking system such as Greenhouse Recruiting.

1.3 If this DPA conflicts with the Agreement, this DPA prevails on data protection matters. If this DPA conflicts with the Standard Contractual Clauses or the UK Addendum, those prevail.

1.4 Customer accepts this DPA by accepting the Agreement, and no separate signature is needed. Customers who want a signed copy can download a pre-signed PDF at justhire.ai/dpa], or request a countersigned copy from support@justhire.ai.

2. Definitions

Terms not defined here have the meaning given in Data Protection Laws.

• Customer Personal Data: personal data that JustHire processes on Customer’s behalf under the Agreement, including candidate data imported from Customer’s applicant tracking system.
• Data Protection Laws: all laws that apply to the processing of Customer Personal Data, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, US federal and state privacy laws (including the California Consumer Privacy Act (CCPA)), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents, Brazil’s General Data Protection Law (LGPD), Australia’s Privacy Act 1988, Singapore’s Personal Data Protection Act, and Japan’s Act on the Protection of Personal Information, in each case as amended or replaced.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Standard Contractual Clauses (SCCs): the clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• Sub-processor: any third party JustHire engages to process Customer Personal Data.
• controller, processor, data subject, personal data, processing: as defined in the GDPR.

3. Roles and instructions

3.1 Customer is the controller of Customer Personal Data and JustHire is its processor. Where Customer is itself a processor for another controller, JustHire is Customer’s sub-processor.

3.2 JustHire processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA and Customer’s use and configuration of the service (including connecting an applicant tracking system, importing jobs and candidates, and choosing actions such as Follow-up or Reject) are Customer’s complete instructions. The subject matter, nature, purpose and categories of data are set out in Annex I.

3.3 JustHire will tell Customer promptly if it believes an instruction breaks Data Protection Laws, unless the law prohibits this.

3.4 Customer is responsible for having a lawful basis for the processing, for giving candidates any notices the law requires, and for the accuracy of data it provides. JustHire gives candidates a plain-language AI notice and records their consent before the interview begins; section 4.9 sets out how JustHire supports Customer’s other AI-in-hiring obligations.

3.5 JustHire makes no hiring decisions. Recruiters and hiring managers make every decision; JustHire does not advance, reject or hire candidates automatically.

3.6 Customer will not send JustHire special categories of personal data (such as health, religion or sexual orientation) or criminal records data, except voluntary demographic self-identification collected through JustHire for bias monitoring as described in Annex I.

4. JustHire’s obligations

4.1 Confidentiality. JustHire ensures that everyone authorised to process Customer Personal Data is bound by confidentiality. All employees and contractors sign confidentiality agreements before starting, complete background checks where legally permitted, and receive security and privacy training at onboarding and annually.

4.2 Limited access. JustHire staff access Customer Personal Data only when needed to provide the service or support, or to meet a Customer request. Access is limited to authorised staff and logged.

4.3 Data minimisation. From a connected applicant tracking system, JustHire reads only what an assessment needs: job ID, name and post content; application ID, status and stage; and candidate ID, first and last name and email address. JustHire does not read résumés, attachments, notes or sources.

4.4 AI processing. JustHire’s AI evaluates only the content of transcribed interview answers and test results. It does not analyse faces, facial expressions, voice, tone, accent, appearance or background, and does not use or infer protected characteristics.

4.5 No model training. JustHire never uses Customer Personal Data to train AI models. Only interview answer content is sent to AI model providers, under contracts that prohibit training on it and retaining it. Candidate names and contact details are removed before anything is sent.

4.6 California. Where the CCPA applies, JustHire acts as Customer’s service provider. JustHire will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than providing the service, or outside its direct business relationship with Customer; or (c) combine it with personal data JustHire receives from other sources, except as the CCPA permits. JustHire will comply with the CCPA, provide the same level of privacy protection it requires, and notify Customer if it can no longer meet its obligations. Customer may then take reasonable steps to stop and remedy unauthorised use. JustHire certifies that it understands and will comply with these restrictions.

4.7 Assistance. Taking into account the nature of the processing, JustHire will reasonably help Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities.

4.8 EU AI Act. JustHire treats its assessment service as a high-risk AI system used in recruitment. As provider, JustHire will give Customer, as deployer, the information it reasonably needs to meet its own obligations, including instructions for use, a description of the system’s purpose, capabilities and limits, guidance on human oversight, and relevant logs. JustHire’s conformity assessment and technical documentation are in progress, targeted for completion in Q2 2027.

4.9 Other AI-in-hiring laws. JustHire will reasonably help Customer meet laws that regulate AI in employment decisions where Customer uses the service, including New York City Local Law 144, the Illinois Artificial Intelligence Video Interview Act, the Illinois Human Rights Act as amended for AI in employment, and the Colorado Artificial Intelligence Act. This includes providing its annual independent bias audit summary, candidate notice wording, a description of how the system works, and information for Customer’s impact assessments.

4.10 Aggregated and de-identified data. JustHire may create aggregated or de-identified data from Customer Personal Data only to monitor for bias and adverse impact, and to maintain the security and performance of the service. Such data will not identify Customer, any candidate or any user. JustHire will take reasonable measures to prevent re-identification, will not attempt to re-identify anyone, and will contractually require any recipient to do the same. De-identified data is never used to train AI models.

5. Sub-processors

5.1 Customer gives general authorisation for JustHire to engage Sub-processors. The current Sub-processors are listed in Annex III.

5.2 JustHire publishes its current Sub-processors at justhire.ai/subprocessors, where Customer can subscribe to change notifications. JustHire will notify subscribers and Customer’s account administrator by email at least 30 days before a new Sub-processor processes Customer Personal Data.

5.3 Customer may object on reasonable data protection grounds within that 30-day period by writing to carolina@justhire.ai. The parties will discuss the objection in good faith. If JustHire cannot offer a reasonable alternative, Customer may terminate the affected part of the service and receive a pro-rata refund of prepaid fees for it.

5.4 JustHire reviews each Sub-processor’s security before use and annually, and imposes data protection obligations on each one that are no less protective than this DPA. JustHire remains liable to Customer for its Sub-processors’ performance of those obligations.

6. Security measures

6.1 JustHire implements and maintains the technical and organisational measures in Annex II, appropriate to the risk of the processing, as required by Article 32 GDPR.

6.2 JustHire may update these measures over time, provided the overall level of protection is not reduced.

7. Personal Data Breach

7.1 JustHire will notify Customer without undue delay, and in any case within 72 hours, after confirming a Personal Data Breach affecting Customer Personal Data.

7.2 The notice will describe, as far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Where information is not yet available, JustHire will provide it in phases and give regular updates until the breach is resolved.

7.3 JustHire will take reasonable steps to contain and remedy the breach, and will give Customer the information it needs to meet its own regulatory and data subject notification duties, such as the GDPR 72-hour requirement.

7.4 JustHire’s notification is not an admission of fault or liability.

8. Data subject requests

8.1 If JustHire receives a request from a data subject about Customer Personal Data (for example, access, correction, deletion or objection), JustHire will promptly tell Customer. Customer authorises JustHire in advance to act on verified requests to delete a candidate’s data, and to confirm receipt of any request. JustHire will direct other requests to Customer, unless Customer authorises JustHire to respond or the law requires otherwise.

8.2 JustHire will help Customer respond to data subject requests. Where Customer asks JustHire to delete a candidate’s data, JustHire verifies the request and completes it within 30 days, deleting all of the candidate’s information, including interview recordings.

8.3 Candidates may request reasonable accommodations, or an alternative assessment reviewed by a person without AI scoring, through support@justhire.ai.

9. International transfers

9.1 JustHire hosts Customer Personal Data on Amazon Web Services in the United States (us-east-1). JustHire and its Sub-processors may process Customer Personal Data outside the country where Customer is located, subject to this section.

9.2 EU and EEA. For transfers of Customer Personal Data from the EU or EEA to a country without an adequacy decision, the SCCs are incorporated into this DPA as follows:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorisation), with the notice period in section 5.2.
• Clause 11: the optional language does not apply.
• Clause 17: Option 1, the law of Ireland. Clause 18: the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

9.3 United Kingdom. For transfers from the UK, the UK Addendum applies, completed with the information in this DPA and its Annexes. Either party may end the UK Addendum as allowed by its Section 19.

9.4 Switzerland. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and “member state” including Switzerland.

9.5 Data Privacy Framework. If JustHire certifies to the EU-US Data Privacy Framework, its UK Extension or the Swiss-US framework, JustHire may rely on that certification instead of the SCCs.

9.6 Government access requests. If a government or law enforcement authority asks JustHire for Customer Personal Data, JustHire will:

• direct the authority to request the data from Customer;
• notify Customer promptly before disclosing anything, unless the law prohibits it;
• if notice is prohibited, use reasonable efforts to have the prohibition lifted;
• challenge any request it reasonably considers unlawful or overbroad; and
• disclose only the minimum data legally required.

As of the effective date, JustHire has not received any such request. JustHire will publish the number of requests received each year in a transparency note on its website.

9.7 Transfer impact assessment. JustHire has assessed the laws and practices of the United States that apply to its processing, taking into account the safeguards in this DPA and Annex II, and will provide a summary on request.

9.8 Other countries. Where the Data Protection Laws of any other country require a specific safeguard for transfers of Customer Personal Data out of that country, JustHire will provide the safeguard those laws require. This includes, where applicable, the standard contractual clauses issued by Brazil’s National Data Protection Authority (ANPD) for transfers from Brazil. For countries that do not prescribe a mechanism, JustHire’s obligations in this DPA and Annex II provide comparable protection to the law of the country of origin.

9.9 Onward transfers. JustHire will only transfer Customer Personal Data to a Sub-processor in another country under a written agreement that provides the same level of protection as this section.

10. Retention, deletion and return

10.1 By default, JustHire automatically deletes imported candidate data, interview recordings and assessment results 90 days after import. Customer may set a longer retention period, up to 12 months, in its account settings. Customer is responsible for exporting any records it must keep under its own legal obligations, such as US employment record-keeping rules, before they are deleted. JustHire will email Customer’s account administrator at least 14 days before scheduled deletion.

10.2 Customer may ask JustHire to delete Customer Personal Data sooner at any time, and JustHire will do so within 30 days.

10.3 When Customer disconnects an applicant tracking system, JustHire deletes the stored access credentials immediately. Data already imported stays subject to the 90-day retention period.

10.4 On termination of the Agreement, Customer may request an export of its assessment results and candidate data. JustHire will then delete all remaining Customer Personal Data within 30 days, unless the law requires JustHire to keep it.

10.5 Backups age out on a rolling basis within the retention period, so deleted data is removed from backups automatically. JustHire will certify deletion in writing on request.

11. Audits and information

11.1 JustHire will make available the information Customer reasonably needs to demonstrate compliance with this DPA, including its security questionnaire, information security policies, and the executive summary of its most recent independent penetration test (under NDA).

11.2 Once available, JustHire will provide its SOC 2 Type II report and ISO 27001 certificate on request. Both are expected in Q1 2027.

11.3 If that information is not enough to meet a legal requirement, or a supervisory authority requires it, Customer may conduct an audit, no more than once in any 12 months unless following a Personal Data Breach. Customer must give at least 30 days’ written notice, the audit must take place during business hours with minimal disruption, and any third-party auditor must be bound by confidentiality. Each party bears its own costs.

12. Liability, term and general

12.1 Liability. Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except that JustHire’s total liability for breaches of this DPA or Data Protection Laws is capped at: the greater of 2× the fees paid or payable by Customer in the 12 months before the claim, or US$100K. This separate cap is in addition to, not part of, the general cap in the Agreement. Nothing in this DPA limits either party’s liability to data subjects under the SCCs.

12.2 This DPA lasts as long as JustHire processes Customer Personal Data, and survives termination of the Agreement until that processing ends.

12.3 JustHire may update this DPA to reflect changes in Data Protection Laws or its service, provided the changes do not reduce the protection of Customer Personal Data. JustHire will give notice of material changes.

12.4 This DPA is governed by the law that governs the Agreement in the State of Delaware, except where the SCCs or UK Addendum require otherwise.

12.5 EU and UK representatives. As a US company offering services to organisations in the EU and UK, JustHire may need to appoint a representative under Article 27 of the EU GDPR and UK GDPR.

Contact for data protection questions: support@justhire.ai

Annex I: Details of processing

Annex II: Technical and organisational measures

Annex III: Sub-processors

Annex IV: SCC and UK Addendum details