Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Agreement between you (“Customer”) and FoundOne s.r.o. (“FoundOne”) and governs how FoundOne processes personal data on your behalf, as Article 28 of the GDPR requires. You accept it by accepting the Terms of Service; no signature is needed.

1. Definitions

Terms defined in the GDPR (controller, processor, personal data, processing, personal data breach, data subject, supervisory authority) have the same meaning here. Other capitalised terms have the meaning given in the Terms of Service. “Customer Personal Data” means personal data in Customer Content that FoundOne processes on your behalf. “Sub-processor” means a third party FoundOne engages to process Customer Personal Data. “SCCs” means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914.

2. Roles

2.1 You are the controller of Customer Personal Data and FoundOne is your processor. If you act as a processor for your Client, FoundOne is your sub-processor; you confirm that your Client has authorised you to engage FoundOne and that your instructions reflect the Client’s.

2.2 Clients who see, copy or download Customer Personal Data through the client portal receive it from you. Their further use of it is not processing on FoundOne’s behalf, and this DPA does not cover it.

2.3 Each party complies with the data protection law that applies to it. FoundOne is the controller for account, billing and usage data under its Privacy Policy; this DPA does not cover that data.

3. Your instructions

3.1 FoundOne processes Customer Personal Data only on your documented instructions. Your complete instructions are: the Agreement; your use and configuration of the Service, including the actions of your Authorized Users; and this DPA. They include processing to provide, secure, support and maintain the Service and to fix errors. Further instructions require our written agreement and may carry fees.

3.2 FoundOne may process Customer Personal Data outside your instructions where EU or Member State law requires it; we then tell you first, unless that law prohibits it. We tell you if, in our opinion, an instruction infringes data protection law. We are not obliged to check your instructions legally.

4. Your responsibilities

4.1 Lawful basis and consent. You are solely responsible for the lawfulness of Customer Personal Data. In particular, before any person is added to the Service you must have their consent as Section 7.4 of the Terms of Service requires, covering storage in the Service, processing with AI Features and presentation to your Clients. You are responsible for being able to demonstrate each consent (Article 7(1) GDPR).

4.2 Notices. You give data subjects the information Articles 13 and 14 GDPR require, including that you use FoundOne as a processor, that AI Features may process their data outside the EEA, and which Clients you may present them to.

4.3 Accuracy, retention and withdrawal. You keep Customer Personal Data accurate, renew or delete it when a consent period ends, and delete it without undue delay when a person withdraws consent or asks for erasure. When a consent period ends, FoundOne warns you but does not delete or hide the data; only some AI Features, such as Find, leave it out until you renew. Keeping it, and showing it to Clients, until you act is processing on your instructions. The Consent Confirmation and its reminders are tools to help you; they do not shift these duties to FoundOne.

4.4 Data the Service is not designed for. The Service is not designed for special categories of personal data (Article 9 GDPR), data on criminal convictions (Article 10 GDPR) or data of children. Do not record such data deliberately. If a CV or file you upload contains it, you remain responsible for it and must make sure the measures in Annex II are sufficient for it.

4.5 Decisions about people and AI. You do not use the Service, including AI Features, to make decisions about a person based solely on automated processing (Article 22 GDPR). You choose and approve the criteria used in Find and are responsible for them being lawful. As the deployer of AI Features under the AI Act, you are responsible for human oversight, informing the people concerned and any data protection impact assessment your use requires (Article 35 GDPR); FoundOne assists as Section 10 describes.

5. Confidentiality

FoundOne gives access to Customer Personal Data only to staff and contractors who need it to perform the Agreement and who are bound by confidentiality. We look into a Workspace only to fix a problem you report, to keep the Service secure, to handle a complaint under Section 7.11 of the Terms of Service, or when the law requires it.

6. Security

6.1 FoundOne implements the technical and organisational measures in Annex II (Article 32 GDPR). We may update them, provided the overall level of protection does not decrease materially.

6.2 You are responsible for securing your accounts, managing your Authorized Users, their roles and portal access, and for exports, PDFs and copies you take out of the Service.

7. Sub-processors

7.1 You give FoundOne general authorisation to engage Sub-processors. The current list is in Annex III and at foundone.io/legal/subprocessors.

7.2 We notify you of a new Sub-processor at least 14 days before it starts processing Customer Personal Data, by email to Workspace admins or by updating the list. You may object on reasonable data protection grounds within those 14 days. If we cannot address your objection, your sole remedy is to terminate the Agreement with effect before the change, and we refund prepaid fees for the unused period.

7.3 We impose on each Sub-processor data protection obligations equivalent in substance to this DPA, and remain responsible to you for its performance as Article 28(4) GDPR requires, subject to Section 14.

8. Requests from data subjects

8.1 The Service lets you find, export, correct and delete a person’s data, including a per-person export for access requests. Use these tools first.

8.2 If a data subject contacts us about Customer Personal Data, we refer them to you and may tell them that you are the controller. We do not respond on the substance unless you instruct us or the law requires it. Where the tools are not enough, we assist you with reasonable measures, taking into account the nature of the processing. Assistance beyond the tools may be charged at our standard rates.

9. Personal data breaches

9.1 FoundOne notifies you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the data and data subjects concerned, its likely consequences, and the measures taken or proposed. We provide further information as it becomes available.

9.2 You are responsible for notifying supervisory authorities and data subjects where required. Our notice or assistance is not an admission of fault or liability.

10. Impact assessments

FoundOne provides the information reasonably available to it to help you carry out data protection impact assessments and prior consultations (Articles 35 and 36 GDPR). Assistance beyond providing existing documentation may be charged.

11. Deletion and return

11.1 During the Agreement you can export and delete Customer Personal Data at any time. For 30 days after the Agreement ends, you may ask us to export it.

11.2 After that, FoundOne deletes Customer Personal Data from its active systems within 60 days. Copies in backups and logs are deleted as they rotate out of their retention cycles, within a further 30 days, and stay protected under this DPA until then. This does not apply where EU or Member State law requires storage. On request, we confirm deletion in writing.

12. Audits

12.1 On request, FoundOne provides the information necessary to demonstrate compliance with Article 28 GDPR: this DPA, Annex II, and the security certifications or reports of our Sub-processors where available.

12.2 If that information is insufficient, or a supervisory authority requires it, you may audit our compliance with this DPA no more than once every 12 months, with 30 days’ written notice, during business hours, through an independent auditor bound to confidentiality who is not our competitor. The audit must be limited to what is necessary, must not disrupt the Service or give access to other customers’ data, and is at your cost. We may charge reasonable fees for our time.

13. Transfers outside the EEA

FoundOne stores Customer Personal Data in the EU. Sub-processors may process it outside the European Economic Area as Annex III shows, in particular when AI Features are used. Each such transfer is based on an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or on the SCCs, Module 3 (processor to processor), with supplementary measures where needed.

14. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service, and counts towards the same overall cap. You compensate FoundOne under Section 16 of the Terms of Service for claims and fines that result from a missing lawful basis or consent, missing notices, or your instructions. This does not limit any party’s liability to data subjects under Article 82 GDPR.

15. Term and precedence

This DPA applies for as long as FoundOne processes Customer Personal Data. If it conflicts with the Terms of Service on the processing of personal data, this DPA prevails. Its governing law and courts are those of the Terms of Service.

Annex I — Description of the processing

Annex II — Technical and organisational measures

• Location. Workspaces, files and the account directory are stored in Cloudflare’s EU jurisdiction.
• Separation. Each Workspace has its own database, separate from every other Workspace.
• Encryption. All connections use TLS. Our infrastructure provider encrypts databases and file storage at rest.
• Access for customers. Passwordless sign-in (single-use email links, Google, Microsoft); sessions expire; roles within the Workspace (admin, manager, recruiter) checked on the server for every change.
• Client portal. Guests see only what is shared with them. Anonymised profiles are prepared on the server and never leave it with names.
• Files. Uploaded files are checked by type and size, stored privately and served only to signed-in members. Files waiting to be read are deleted within one day.
• AI minimisation. Find sends the model only the professional details needed for a check, without names, contact details, links, ages, birth dates, photos, team notes or phrases about family, health, origin or religion. Criteria that point at protected characteristics are left out, and people whose consent has ended are not sent. Every answer must quote text that Find verifies word for word. Each run’s log records the model, the prompt version and a hash of the text read, and every change of an answer with who, when and why.
• Abuse protection. Rate limits and daily caps on sign-in, email, AI, Find checks and uploads; bot check on sign-in; a strict content security policy.
• Records. Change history per Workspace; who confirmed each person’s consent and when.
• Availability and recovery. Point-in-time recovery of each Workspace database for 30 days, offered by our infrastructure provider.
• Staff access. Production access only for named staff who need it.
• Secure development. Changes go through review and automated tests.
• People and vendors. Confidentiality obligations for staff and contractors; data processing agreements with every Sub-processor.
• Incidents. A documented process to investigate breaches and notify customers (Section 9).

Annex III — Sub-processors