Data processing addendum

What this is

This addendum is part of our terms of service. It applies when Vettika ("we") processes personal data for you, the customer, and a data protection law applies to that processing. "Controller", "processor", "personal data" and "data subject" have the meanings they have in that law.

If this addendum and the terms disagree about personal data, this addendum wins.

Roles

For interview data, you are the controller and we are the processor. If you hire on behalf of a client, such as an agency does, you may be a processor for that client, and we act as your subprocessor. You confirm you have your client's authority to use us.

For account data, such as your team's sign-in details and billing records, we are the controller. Our privacy policy covers that data and this addendum doesn't.

The processing

This is what we process for you:

• Subject matter: running first-round interviews and producing reports.
• Duration: from when you start using the service until the data is deleted under this addendum.
• Nature and purpose: collecting, transcribing, storing, scoring and showing interview data, and sending interview emails, so you can assess candidates.
• Data subjects: candidates, and anyone a candidate mentions in their answers.
• Personal data: name, email address, what the candidate says or types, the time they gave consent, and the score and quotes in the report.
• Voice: processed live to make text. We keep the transcript, not a recording. We don't collect video.
• Special categories: we don't ask for these. A candidate may mention them in an answer, and your questions shouldn't invite it.

Your instructions

We process personal data only on your documented instructions. These terms, this addendum and how you set up and use your workspace are your instructions.

If the law requires us to process data in another way, we'll tell you first unless that law forbids it. If we think an instruction breaks data protection law, we'll tell you.

Your responsibilities

You're responsible for your instructions being lawful, for having a legal basis for the processing, and for giving candidates the notices the law requires. Our candidate notice can help, but it doesn't replace your own.

Confidentiality

Everyone we authorize to process personal data must keep it confidential. That duty comes from a contract or from the law. We give access only to people who need it to run the service.

Security measures

We keep technical and organizational measures in place that suit the risk. No system is perfectly secure, and we may change these measures as long as the protection isn't reduced.

• Each workspace's data is kept apart in the database, with row-level rules that limit it to that workspace.
• The app requires sign-in, and a person's role limits what they can do.
• Candidates reach their interview through a private link with a secret token.
• An audit log records workspace actions.
• Rate limits slow down abuse.
• Marketing analytics never run on candidate pages.
• Vercel says it encrypts data at rest with AES-256 and uses HTTPS/TLS 1.3 in transit.
• Neon says it encrypts customer data at rest with AES-256 and requires SSL/TLS for all connections.
• Resend says it encrypts data at rest with AES-256 and uses HTTPS/TLS in transit.

Subprocessors

You allow us to use the subprocessors on our subprocessors page. We put written terms in place with each one that protect personal data, and we remain responsible for their work.

Before a new subprocessor starts handling personal data, we'll update that page and tell you by email. If you have a reasonable data protection objection, tell us. We'll try to find a fix. If we can't, you can stop using the service and ask for a refund of your unspent balance.

Helping you

We'll give you reasonable help, taking into account what we do and the information we have, with:

• Requests from candidates to see, correct or delete their data. If a candidate contacts us directly, we pass the request to you and don't answer it ourselves unless you tell us to or the law requires it.
• Data protection impact assessments and talks with regulators.
• Your security duties under data protection law.

Personal data breaches

If we become aware of a personal data breach affecting your data, we'll tell you without undue delay. We'll share what we know, and more as we learn it, so you can meet your own duties.

Deletion

Interview data stays until you ask us to delete it. Ask at any time, and when you stop using the service, ask us to delete the rest. If you want a copy first, say so and we'll help you get one.

We can keep data only where the law requires it, and only for as long as it requires.

Audits

We'll give you the information you reasonably need to show that we meet this addendum, and answer reasonable written questions.

If that isn't enough, or a regulator requires it, we'll allow an audit, including an inspection, by you or an auditor you choose. Audits need reasonable notice, take place in normal working hours, and are at your cost. Auditors must keep what they see confidential, and audits can't expose other customers' data.

Transfers

Personal data is processed in the United States and in the other locations shown on our subprocessors page. We don't offer data residency in the EU.

If you are subject to a law that restricts these transfers, tell us before you send us that data. Where the law requires a transfer tool, such as the EU standard contractual clauses or the UK addendum, we'll put one in place with you.

Contact

Data protection questions: support@vettika.com.

Sources

• Vercel: Security and compliance measures
• Neon: Security overview
• Resend: Security