Nexus Data processing agreement

Last Updated: 31st July 2026, version number 1.0

This Data Processing Agreement ("Agreement") is between Datalive Limited T/A Allsorter, a limited liability company having its registered office at Westmoreland House, Westmoreland Park, Ranelagh, Dublin 6, Dublin, Ireland (“Allsorter” or “Service Provider”) and the Customer, each a “Party” and together the “Parties”.

For good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree as follows:

RECITALS

A. The Customer has engaged Allsorter to Process the Relevant Personal Data (as defined below) under the terms of a Master Subscription Agreement dated and executed by the Parties (the “MSA”) for the provision of a recruitment workflow orchestration platform (the “Services”). This DPA shall form part of the MSA.

B. Customer will use the Services under the terms of the MSA for the purpose of managing its recruitment workflows and related activities.

C. This Agreement sets out the obligations of the Parties with respect to the Processing of the Relevant Personal Data.

1. Definitions and Interpretation

1.1 In this Agreement, unless the context otherwise requires:

“Affiliate” means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control," for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

“Agreement” means this data processing agreement.

"Commercial Confidential Data" means any information disclosed by the Disclosing Party to the Receiving Party that is not Personal Data but is proprietary or commercially sensitive in nature, the unauthorised disclosure of which could reasonably be expected to result in commercial, competitive or financial harm to the Disclosing Party or any third party to whom the Disclosing Party owes a duty of confidence.

“Commercial Confidential Data Breach” means any accidental, unauthorised or unlawful access to, disclosure of, alteration, loss, destruction or compromise of Commercial Confidential Data.

“Controller” has the meaning given to it in the Data Protection Laws.

“Customer” means the customer named above and its Affiliates.

“Data Protection Authority” means a Supervisory Authority, as that term is defined in the Data Protection Laws.

“Data Protection Impact Assessment” means a data protection impact assessment, as described in Article 35 of the GDPR.

“Data Protection Laws” means all applicable legislation relating to data protection and privacy, including the EU GDPR and related applicable data protection and privacy laws of the EEA member states, the UK GDPR and related applicable data protection laws of the United Kingdom, and/or the related applicable data protection laws of the United States, as the case may be, each as amended, repealed, consolidated or replaced from time to time, and any applicable guidance, rules, requirements and directions issued by a data protection authority in respect of such legislation.

“Data Subject” has the meaning given to it in the Data Protection Laws.

“EEA” means the European Economic Area.

“EU GDPR” means Regulation (EU) 2016/679, as amended, consolidated or replaced from time to time.

“GDPR” means the EU GDPR or the UK GDPR, whichever is relevant.

“Personal Data” has the meaning given to it in the Data Protection Laws.

“Personal Data Breach” has the meaning given to it in the Data Protection Laws.

“Personnel” means any current, former or prospective employee, consultant, temporary contractor, agency worker, intern, other non-permanent employee, contractor, secondee or other personnel.

“Process”, “Processing” or “Processed” each have the meanings given to them in the Data Protection Laws.

“Processor” has the meaning given to it in the Data Protection Laws.

“Relevant Personal Data” means the categories of Personal Data that are set out in Schedule 1 and that are Processed under, or in connection with the provision of the Services.

“Subprocessor” means any party engaged by Service Provider to Process Relevant Personal Data. An up-to-date list of approved Subprocessors is maintained by the Service Provider and set out in Schedule 1.

“Term” has the meaning given to "Subscription Term" in the MSA.

“UK GDPR” means the United Kingdom General Data Protection Regulation, which is the EU GDPR as incorporated into UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and amended by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

2. Subject Matter and Scope

2.1 This Agreement applies only to the Processing of Relevant Personal Data.

2.2 The purpose of this Agreement is to help ensure adequate protection of Relevant Personal Data as may be processed by Service Provider while providing Services under the MSA. To the extent that there is any conflict between this Agreement and the MSA in relation to that purpose, this Agreement shall govern.

3. Obligations of Service Provider

3.1 With respect to the Processing of Relevant Personal Data, Service Provider shall, and shall procure that each of its Personnel, agents and Subprocessors shall, comply with Data Protection Laws, to the extent applicable; and only Process Relevant Personal Data on behalf of and in accordance with Customer’s prior written instructions (including as set out in this Agreement and the MSA) and for no other purpose.

3.2 The Service Provider shall implement appropriate technical and organisational measures (detailed in Schedule 2) to protect the Relevant Personal Data, in accordance with applicable Data Protection Laws. The Service Provider shall ensure that such technical and organisational measures are appropriate to the particular risks that are presented by its Processing activities, in particular to protect the Relevant Personal Data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access. The Service Provider shall perform internal inspections on a regular basis, to confirm that it is complying with its obligations under this Agreement and, where appropriate, the Service Provider shall amend its Processing activities to satisfy its obligations under this Agreement.

3.3 Where the Processing of Relevant Personal Data involves a transfer by the Service Provider from the European Economic Area to a recipient in a third country that is not subject to an adequacy decision under applicable Data Protection Laws, the Service Provider shall ensure that the transfer is subject to an appropriate transfer mechanism under Chapter V of the EU GDPR. Where the applicable transfer mechanism is the Standard Contractual Clauses, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 shall apply in the appropriate module. With respect to transfers to OpenAI Inc. in the United States, the Service Provider confirms that:

(a) such transfers are governed by the Standard Contractual Clauses referred to above, as incorporated into the agreement between the Service Provider and OpenAI;

(b) a Transfer Impact Assessment has been conducted in respect of such transfers and the Service Provider shall make a summary of such assessment available to the Customer upon request;

(c) the Service Provider shall review and update the Transfer Impact Assessment at least annually, or promptly upon any material change in the legal framework applicable to such transfers; and

(d) the Service Provider shall promptly notify the Customer if it becomes aware of any change in circumstances that would affect the adequacy of the transfer mechanism in place.

3.4 The Parties hereby acknowledge and agree that the Customer is a Controller and the Service Provider is a Processor with respect to the Processing of the Relevant Personal Data. In addition to, and notwithstanding, any other right or obligation arising under this Agreement or the MSA, the Service Provider shall, in relation to such Processing:

(a) comply with the express instructions or directions of the Customer given from time to time in connection with the Processing of the Relevant Personal Data, and the requirements of any Data Protection Laws; and

(b) only Process the Relevant Personal Data strictly and solely: (i) to the extent necessary in connection with this Agreement, in particular as described in Schedule 1 below; and (ii) in accordance with the documented instructions received from the Customer from time to time. If at any point, the Service Provider becomes legally unable to comply with the Customer's instructions regarding the Processing of the Relevant Personal Data (whether as a result of a change in applicable law, or a change in the Customer's instructions), the Service Provider shall promptly:

(i) notify the Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and

(ii) cease all Processing of the affected Relevant Personal Data (other than merely storing and maintaining the security of the affected Relevant Personal Data) until such time as the Customer issues new instructions with which the Service Provider is able to comply.

3.5 In addition, the Service Provider, and where applicable the Service Provider’s representative, shall, in relation to the Processing of the Relevant Personal Data:

(a) (i) create; (ii) keep up to date for the duration of the Processing; and (iii) maintain for seven (7) years thereafter; complete and accurate records in writing (including in electronic form) of its Processing activities, as listed in Schedule 1, in relation to the Relevant Personal Data, and disclose such records to the Customer, or any Data Protection Authority, promptly upon demand;

(b) (i) ensure the Relevant Personal Data are kept confidential; (ii) take all reasonable steps to ensure the reliability and trustworthiness of the Service Provider’s Personnel and any Subprocessors; and (iii) ensure that all relevant Service Provider Personnel, and any relevant Subprocessors, have committed themselves to ensuring the confidentiality of all the Relevant Personal Data that they Process;

(c) ensure that in each instance in which it engages a Subprocessor to Process any Relevant Personal Data, it shall: (i) only appoint such Subprocessor in accordance with the process outlined in clause 3.6; (ii) keep the Customer informed of any change to the role or status of the Subprocessor; and (iii) enter into a binding written agreement with the Subprocessor that imposes on the Subprocessor the same obligations that apply to the Service Provider under this Agreement with respect to the Processing of the Relevant Personal Data;

(d) at the Customer’s request and expense, promptly provide the Customer with all reasonable technical and organisational assistance necessary to respond appropriately to requests from Data Subjects to exercise their rights;

(e) at the Customer’s request and expense, promptly provide the Customer with all reasonable assistance necessary to enable the Customer to: (i) notify relevant breaches of the GDPR and/or any domestic Data Protection Laws to the relevant Data Protection Authority and/or affected Data Subjects; (ii) conduct Data Protection Impact Assessments; and (iii) obtain any necessary authorisations from the Data Protection Authority, to the extent such breaches did not occur as a result of any error, omission or negligence on behalf of Service Provider or its Personnel;

(f) permanently and securely delete (or, at the election of the Customer, return) all Relevant Personal Data in the possession or control of Service Provider or any of its Subprocessors, within thirty (30) days after the end of the Term, unless applicable Data Protection Laws require otherwise and procure that its Subprocessors shall do likewise;

(g) at the Customer’s request and expense, and to the extent Service Provider can do so taking into account the nature and extent of the Processing and the Relevant Personal Data stored by Service Provider, Service Provider shall (i) promptly provide the Customer with all information reasonably necessary to enable the Customer to demonstrate compliance with its obligations pursuant to Data Protection Laws; and (ii) allow for and contribute to audits, including inspections, conducted by the Customer or an auditor appointed by the Customer, provided that: (i) the Customer shall give the Service Provider not less than thirty (30) days' prior written notice of any audit, except where a suspected Personal Data Breach requires shorter notice, in which case reasonable notice shall be given; (ii) audits shall be conducted no more than once per calendar year, unless a confirmed Personal Data Breach or material breach of this Agreement has occurred in that year; (iii) any third-party auditor appointed by the Customer shall enter into a confidentiality agreement with the Service Provider on reasonable terms before commencing the audit; and (iv) audits shall be conducted during normal business hours and in a manner that minimises disruption to the Service Provider's operations. If the scope of a requested audit is addressed in an ISO 27001 or similar audit report performed by a qualified third-party auditor within the previous twelve (12) months, and the Service Provider's data protection contact certifies in writing that there are no known material changes in the controls audited, the Customer may accept those reports in lieu of requesting an audit of the controls covered by the report;

(h) notify the Customer promptly, and in any event within twenty-four (24) hours, of: (i) becoming aware of a confirmed Personal Data Breach affecting the Relevant Personal Data; (ii) becoming aware of any material breach of this Clause 3; or (iii) receipt of any correspondence or communication from any Data Subject, the Data Protection Authority or third party regarding the Processing of the Relevant Personal Data; and

(i) notify the Customer promptly, and in any event within forty-eight (48) hours, of becoming aware of any Commercial Confidential Data Breach or incident.

3.6 The Customer acknowledges and confirms its prior general consent to sub-contracting of the data processing by Allsorter to its vetted Subprocessors. An up-to-date list of approved Subprocessors is set out in Schedule 1 and may be updated by Service Provider from time to time. Service Provider shall notify Customer in advance of any intended addition or replacement of a Subprocessor, thereby giving Customer a reasonable opportunity to object to such change on reasonable data protection grounds. Customer must submit any objection in writing without undue delay after receiving notice and must set out reasonable data protection grounds for its objection. If Customer objects on reasonable data protection grounds, the Parties shall discuss in good faith a commercially reasonable resolution. Any Subprocessors utilised by the Service Provider shall be bound by data protection terms that are no less protective than the obligations set out in this Agreement, including standard contractual clauses where required under applicable Data Protection Laws. As between the Customer and the Service Provider, the Service Provider shall remain fully liable for all acts or omissions of any Subprocessor appointed by it.

3.7 Service Provider shall indemnify and hold harmless the Customer from and against any and all third-party claims, suits, demands and actions, and resulting damages, awards, direct losses, costs and expenses (including reasonable legal and professional fees) incurred by the Customer that directly result from a material breach by the Service Provider of its obligations under this Agreement and/or applicable Data Protection Laws. Service Provider’s liability under this clause 3.7 shall be on a comparative fault basis for the portion of those damages directly attributable to its breach, and shall in all cases be subject to the limitations of liability set out in the MSA.

3.8 If any third party makes a claim against the Customer, or notifies an intention to make a claim against the Customer, arising out of a matter for which the Service Provider may be obliged to indemnify the Customer under clause 3.7, the Customer shall: (i) give written notice of the claim to the Service Provider as soon as reasonably practicable; (ii) not make any admission of liability in relation to the claim without the prior written consent of the Service Provider (not to be unreasonably withheld); (iii) at the Service Provider’s request and expense, allow the Service Provider to conduct the defence of the claim, including any settlement, provided that the Service Provider shall not settle any claim in a manner that admits liability on behalf of the Customer without the Customer’s prior written consent; and (iv) at the Service Provider’s expense, co-operate and assist to a reasonable extent with the Service Provider’s defence of the claim.

3.9 Service Provider shall not use Relevant Personal Data submitted to or generated through the Services to train, fine-tune or otherwise improve any AI model, or to build, improve or commercialise any candidate database, analytics product or unrelated product or service for Service Provider’s own independent purposes, except: (a) to the extent strictly necessary to provide the Services to Customer in accordance with Customer’s documented instructions, the MSA, any applicable AI Addendum and this Agreement; or (b) with Customer’s prior written consent. This clause does not restrict Service Provider’s collection and use of data that has been irreversibly anonymised in accordance with Data Protection Laws, including anonymised statistical data relating to outcomes, usage and operation of the Services, which shall no longer be considered Relevant Personal Data under Data Protection Laws.

4. Obligations of Customer

4.1 The Customer represents and warrants that: (i) it has a valid legal basis under applicable Data Protection Laws for all Processing of Relevant Personal Data under or in connection with this Agreement, including where required, obtaining any necessary consents and providing any necessary notices to Data Subjects; (ii) all data processing instructions given to the Service Provider comply with applicable Data Protection Laws; (iii) it shall have sole responsibility for the accuracy, quality and legality of the Relevant Personal Data and the means by which it acquired the Relevant Personal Data; and (iv) it shall not, by act or omission, cause the Service Provider to violate applicable Data Protection Laws as a result of the Service Provider Processing the Relevant Personal Data in accordance with this Agreement.

5. Termination

5.1 This Agreement shall terminate automatically upon the termination or expiry of the MSA. Notwithstanding termination of this Agreement, nor any other provision of this Agreement or the MSA, the Service Provider’s obligations under Clause 3 shall continue in full force and effect for the duration of the period in which the Service Provider Processes any Relevant Personal Data.

5.2 Termination of this Agreement shall be governed by the termination provisions of the MSA. For the avoidance of doubt, the Customer’s right to terminate the MSA for material breach in accordance with the MSA shall extend to a material breach of this Agreement by the Service Provider.

6. General

6.1 This Agreement shall be governed by, and construed in accordance with, the laws of the Republic of Ireland and each Party irrevocably submits to the exclusive jurisdiction of the courts of the Republic of Ireland.

6.2 Service Provider may propose variations to this Agreement which it reasonably considers necessary to address requirements of any Data Protection Laws. The parties shall discuss and negotiate in good faith with a view to agreeing and implementing those or alternative variations designed to address the requirements identified as soon as reasonably practicable. Customer shall not unreasonably withhold or delay agreement to any consequential variations proposed by Service Provider to comply with Data Protection Laws.

Schedule 1: Data Processing Activities

Data Subjects

The Relevant Personal Data concern the following categories of Data Subjects:

Potential job candidates, applicants and sourced candidates whose resumes/CVs, profiles or related candidate information are Processed through the Services;
Customer personnel, recruiters, hiring managers, reviewers and other Customer-authorised users of the Services.

Categories of Relevant Personal Data

The following Relevant Personal Data may be Processed by Service Provider:

Information in a standard curriculum vitae/resume or candidate profile, including name, address and other contact information including personal telephone numbers and email addresses, social media profile links, educational history, employment history, degree(s) and other qualifications, languages, skills, projects, publications and similar candidate-provided or sourced candidate information;
Age/date of birth;
Nationality and citizenship;
Government-issued identification information, passport or visa information;
Job title and role / function;
Salary and compensation data, including non-salary benefits, bonuses and incentives and other financial information;
To the extent permitted or required by applicable law marital status, and family situation;
Work and/or personal references;
Customer personnel and authorised user information, including names, business contact details, login credentials, calendar events, social media profile links, access permissions, session identifiers, audit logs and related operational metadata; and
User prompts, chat messages, voice inputs, workflow instructions, workflow configurations, task history, system responses and AI-assisted outputs generated through the Services, to the extent such information contains Personal Data.

Special Categories of Data

It is not anticipated that any categories of Sensitive or Special Category Personal Data will be Processed by Service Provider. The Services are not designed to identify, extract, infer, highlight, score, rank, filter, make recommendations based on, or otherwise make usable any Sensitive or Special Category Personal Data. Where such data appears in resumes/CVs, candidate profiles, ATS fields, chat messages, workflow instructions or other Customer-provided materials, it may be incidentally processed only to the extent included by Customer or otherwise present in the materials processed through the Services. Customer is responsible for ensuring that it does not submit Sensitive or Special Category Personal Data to the Services unless permitted by applicable law and necessary for Customer’s lawful use of the Services. To the extent Sensitive or Special Category Personal Data is included in the Services, Customer may delete such data through the functionality made available in the Services.

Data Processing Purposes

The Purposes for which the Relevant Personal Data are Processed are as follows:

Provision, operation, maintenance and support of the Services;
Identity verification, account authentication, access management, device access and account administration;
Enabling access to services on multiple devices and transfer of accounts to new devices;
Enabling users to find other users on the Services;
Enabling Customer to upload, import, parse, format, review, edit, export and otherwise process resumes/CVs, candidate profiles and related recruitment information;
Enabling Customer to create, run, manage, monitor and repeat recruitment workflows, including through chat-based or natural language instructions, workflow automation, AI-assisted analysis, bulk actions, candidate processing steps, task execution and connected recruitment tools within the Services;
Recording chat messages, workflow steps, task history, system responses, user instructions and related operational metadata for the purpose of providing, securing, auditing and troubleshooting the Services;
Monitoring, detecting and deterring unauthorised or fraudulent use of, or abuse of, theServices;
Providing customer support and responding to inquiries;
Providing users with information regarding the Services, including feature updates and important service notices;
Notifying users of any other important information regarding the Services;
Aggregating anonymised statistical data regarding the Services, including for the purpose of improving and/or optimising the Services; and
Complying with applicable laws or legal obligations.

Record of Categories of Processing Activities

A written record of these Processing Activities will be maintained:

The name and the contact information of Customer on whose behalf it acts,
List of Subprocessors used,
The categories of Processing carried out on behalf of Customer,
Where applicable, transfers of Personal Data to a non-EEA country, including identification of that third country,
A general description of technical and organisational security measures implemented.

Processing Locations and Encryption

Connecting to Allsorter

Allsorter uses AWS Cognito for identity services.

Data Location

Allsorter partners with AWS for all core platform infrastructure and all data resides in the Europe region of AWS.

Encryption

All Customer Data is encrypted in transit using TLS 1.3 and at rest using AES-256.

Third-Party Subprocessors

Personal data retention

The uploaded, saved and/or enriched candidate profiles shall be retained as per the instructions of the Customer at the time of the Agreement, with the retention period measured from the date it is imported into the Allsorter system. In case of no specific instructions, the Service Provider shall retain this data in the system for ninety (90) days from the date it was uploaded into the system or a sourced candidate profile was saved and/or enriched, with the data being deleted on the Saturday immediately following this date in the next automated deletion job. Chat messages, workflow records, task history, system responses, user instructions, access permissions, session identifiers, audit logs, account activity records and related operational metadata generated through the Services shall be retained for the duration of the Subscription Term, unless otherwise agreed in writing, and shall thereafter be deleted in accordance with clause 3.5(f) of this Agreement.

Schedule 2: Technical and Organisational Security Measures

These describe the technical and organisational measures taken by Allsorter to ensure an appropriate level of security of Personal Data, taking into account its role as a Data Processor.

(A) Controls to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services

Technical and organisational measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services:

The Customer retains the original copy of any uploaded resume/CV or candidate profile, and the Service Provider accesses a copy for processing. The Customer's personnel can reformat, edit and export processed candidate information. Chat messages, workflow instructions and AI-assisted outputs are processed through the Services and retained in accordance with the retention periods set out in Schedule 1. In this flow, the Customer retains control over the original Personal Data and the Service Provider acts solely as Processor in accordance with Customer's instructions.

Appropriate measures are taken to protect Personal Data against accidental or unlawful destruction, accidental loss, unauthorised access, alteration, transfer or processing outside the scope of data processing activities described in the data processing agreement (“DPA”). The measures are described in their respective sections below.
These measures take into consideration the Service Provider’s role as a data processor, evaluation of potential risks and the sensitive nature of Personal Data.
The measures ensure an adequate level of resilience of the data processing systems and centres.
Allsorter employs a “data privacy and protection by design and default” approach.

(B) Control of physical access to premises and data processing centres

Technical and organisational measures to control physical access to premises and facilities, particularly to identify permitted Personnel at entry:

The core platform architecture is provided by AWS and the data stored in AWS data centres in the Republic of Ireland. AWS uses state-of-the-art security-in-depth to restrict access.

The Allsorter staff primarily works remotely, and the head office has all the requisite physical security measures in place:

Locked doors on all entrances / exits (e.g., electronic locks; physical locks; etc.)
Presence of Personnel at the front desk during business hours
Visitor logs
Access control systems (e.g., access card security; etc.)
CCTV systems
Intruder alarm systems
Fire alarms

(C) Control to ensure anonymisation and encryption of Personal Data

Technical and organisational security measures designed to ensure anonymisation and encryption of Personal Data:

State-of-the art encryption applied to all personal data ‘in transit’
State-of-the art encryption applied to all personally identifiable information ‘at rest’
Secure anonymisation or deletion of Personal Data that are no longer required for lawful Processing purposes
Access to Personal Data is controlled as per the measures outlined in section (E) below
Data retention timespans are outlined in section (J) below

(D) Control of access to IT systems (data processing systems)

Technical and organisational security measures designed to ensure that users with access to the relevant IT systems are identified and authenticated:

IT security systems requiring individual users to log in using unique usernames
IT security systems requiring the use of strong / complex passwords
IT security systems requiring the use of multi-factor authentication
Additional system log-in requirements for particular applications
Automatic locking of IT terminals and devices after periods of non-use, with passwords required to ‘wake’ the terminal or device
Regular audits of security procedures: Allsorter has been certified against the ISO27001 standard by a UKAS-accredited certification body. It has also been certified against the Cyber Essentials Plus standard.
Annual mandatory training for all employees regarding access to IT systems and information security, with records of completion maintained and available for audit

(E) Control of access to Personal Data

Technical and organisational security measures designed to ensure that users with access to the Relevant Personal Data are identified and authenticated:

Personal Data is not accessed by Service Provider’s Personnel unless they are expressly requested by the Customer to help them troubleshoot an issue.

‘Read’ rights for systems containing Personal Data restricted to specified Personnel roles
‘Edit’ rights for systems containing Personal Data restricted to specified Personnel roles or profiles
Logging of all attempts to access systems containing Personal Data
System settings to ensure that only Personal Data necessary for each specific instance of processing is processed
State-of-the art encryption on drives and media containing Personal Data
Annual mandatory training for all employees regarding data privacy and data protection obligations, with records of completion maintained and available for audit
Access by Service Provider personnel to Personal Data is removed upon termination of contractual relationship or a change in job status that results in the personnel no longer requiring access to Personal Data
Segregation of environments with personal data (Allsorter system)

(F) Control of disclosure of Personal Data

Technical and organisational measures to transport, transmit and communicate or store data on data media and for subsequent checking:

Restrictions on transfer rights for systems containing Personal Data
Secure data networks (e.g., encrypted VPNs, VPCs)
Logging of all transfers of data across the network
TLS encryption for all internet access portals
Enforced encryption of all drives that are used to take data off the network (Policy exists for encryption, check-in and check-out of data; however, data is not transported on removable or physical media)

(G) Control of input mechanisms

Technical and organisational security measures to permit the recording and later analysis of information about when input to data systems (e.g., editing, adding, deleting, etc.) occurred and who was responsible for such input:

Logging who inputs and exports resumes/CVs containing Personal Data
‘Edit’ rights for systems containing Personal Data restricted to specified Personnel roles
Binding agreements in writing with all employees who Process Personal Data, imposing strict confidentiality obligations
Regular reviews of compliance with the relevant agreements

(H) Control of workflows between Processors and Sub-Processors

Technical and organisational measures to segregate the responsibilities between Processors and Sub-Processors Processing the Relevant Personal Data:

Binding agreements in writing governing the appointment and responsibilities of Sub-Processors with access to the Relevant Personal Data
Working only with the Sub-Processors capable of appropriately protecting the privacy, confidentiality and security of Personal Data
Regular reviews and assessments of compliance with the relevant agreements

(I) Control mechanisms to ensure availability and access to the Relevant Personal Data in the event of a physical or technical incident

Technical and organisational measures in place to ensure the physical and electronic availability and accessibility of the Relevant Personal Data:

Documented incident response procedures that are periodically reviewed
Documented business continuity plans and disaster recovery procedures
Secure backup procedures in place, with full backups run regularly
Disaster Recovery and Business Continuity Plans tested at least annually, with results documented and made available to the Customer upon request
All physical, power and security requirements to store Personal Data are managed by AWS
- Uninterruptible power supplies at backup facilities
- Physical security of backup facilities (e.g., secure premises; security Personnel; etc.).
- Security alarm systems at backup facilities
- Electronic security of backup facilities (e.g., firewalls; antivirus software; etc.)
- Environmental controls at backup facilities (e.g., cooling; humidity controls; etc.)
- Fire protection at backup facilities (e.g., sprinkler systems; fireproof doors; etc.)
Training for employees regarding backups and disaster recover

(J) Control mechanisms for Personal Data retention

Data retention is enabled only for ninety (90) days from the date the Personal Data is input to the system (or a sourced candidate profile was saved and/or enriched), with the data being deleted on the Saturday immediately following this date in the next automated deletion job. A shorter data retention span may be agreed between Allsorter and the Customer. Chat messages, workflow records, task history, system responses, user instructions, access permissions, session identifiers, audit logs, account activity records and related operational metadata generated through the Services shall be retained for the duration of the Subscription Term, unless otherwise agreed in writing, and shall thereafter be deleted in accordance with clause 3.5(f) of this Agreement.

(K) Control mechanisms to ensure separation of the Relevant Personal Data from other data

Technical and organisational measures to ensure that the Relevant Personal Data are stored and processed separately from other data:

Logical separation of live or production data from backup data and development or test data
Logical separation of storage containing Relevant Personal Data from systems containing other data
Separation of Personnel with access to Production Personal Data from other Personnel
Training for employees regarding data separation

(L) Control mechanisms to test, assess and evaluate technical measures for IT Security

Technical and organisational measures to ensure that the IT environments are secure:

Use of firewalls/ACLs to control traffic
End-point security (antivirus, firewalls, encryption, secure device policies, automatic security updates)
Least privilege access model applied, with user access given on a need-to-know basis and based on business needs
Periodic access review meetings
Periodic IT security meetings
Periodic penetration tests, both internal and external, with risks mitigated
Periodic vulnerability scans, both internal and external, with vulnerabilities mitigated
Security and governance programme with policies communicated to staff on onboarding and each time they are reviewed, assessed and evaluated
Periodic reviews of the effectiveness of the security and governance programme and adjustments as needed

(M) Certification

Allsorter has been certified against the ISO27001 standard by a UKAS-accredited certification body. It has also been certified against the Cyber Essentials Plus standard.

Contact for data protection inquiries

dataprotection@allsorter.com

Datalive Ltd.

NexusUCD

Belfield Innovation Park

Dublin 4, Dublin, Ireland

___________________________________________________________________________

Data Processing Addendum for NexusSourcing

1. Scope and Order of Precedence

1.1 This Data Processing Addendum for NexusSourcing (“NexusSourcing Addendum”) is appended to and incorporated into the Data Processing Agreement between Datalive Limited T/A Allsorter (“Allsorter” or “Service Provider”) and Customer (the “DPA”). This NexusSourcing Addendum applies only where Customer purchases, enables, accesses or uses NexusSourcing.

1.2 Capitalised terms not defined in this NexusSourcing Addendum shall have the meanings given to them in the DPA or the MSA, as applicable.

1.3 In the event of any conflict or inconsistency between this NexusSourcing Addendum and the DPA, this NexusSourcing Addendum shall prevail solely in respect of NexusSourcing and the Processing of Relevant Personal Data in connection with NexusSourcing. In all other respects, the DPA shall continue to apply.

1.4 This NexusSourcing Addendum shall remain in effect for as long as Customer uses NexusSourcing or Allsorter Processes any Relevant Personal Data in connection with NexusSourcing.

2. Definitions

“Customer Recruitment Activity” means any activity undertaken by Customer in connection with NexusSourcing, including determining search criteria, conducting candidate searches, reviewing candidate profiles, saving or shortlisting candidates, enriching candidate profiles, deciding whether to contact a candidate, configuring outreach workflows, sending or approving candidate communications, conducting voice, video, web-based or conversational screening, assessing candidate suitability, progressing or rejecting candidates, and making recruitment or hiring decisions.

“Customer Recruitment Workflow Data” means Personal Data generated or added after a candidate profile is saved or Customer otherwise initiates Customer Recruitment Activity, including candidate notes, shortlist status, outreach records, screening records, candidate responses, voice or video screening recordings, transcripts, conversational screening outputs, rankings, recommendations, summaries, analyses, explanations, workflow outputs and other related candidate information generated through Customer’s use of the Services.

“NexusSourcing” means the sourcing feature made available by Allsorter as part of the Services, through which Customer may search for, access, view, save, enrich, shortlist and/or contact potential job candidates using third-party sourcing tools, databases and APIs integrated with the Services.

“Outreach Features” means any NexusSourcing functionality that enables Customer to contact potential candidates, including by email, SMS, phone, voicemail, WhatsApp, LinkedIn, other social media messaging, automated follow-up, automated scheduling, or other electronic communication channel.

“Saved Candidate Data” means Sourcing Provider Candidate Data that Customer elects to save or otherwise incorporate into the Services or Customer’s recruitment workflow, excluding candidate contact details unless and until Customer separately enriches, imports, adds or otherwise makes those contact details available in the Services.

“Sourcing Provider” means the third-party sourcing provider, database provider, enrichment provider, outreach tools provider, screening tools provider or API provider made available through NexusSourcing from time to time.

“Sourcing Provider Candidate Data” means Personal Data relating to potential job candidates that is collected, compiled, maintained, made available or provided by a Sourcing Provider through NexusSourcing, including names, contact details, general location, social media profile links, employment history, education history, skills, projects, publications and other candidate profile information.

3. Roles of the Parties

3.1 The Parties acknowledge and agree that Sourcing Provider Candidate Data is not Customer Personal Data or Customer Data merely because it is displayed, accessed or made available through NexusSourcing.

3.2 The applicable Sourcing Provider acts as an independent Controller of the Sourcing Provider Candidate Data in respect of its collection, compilation, maintenance, storage, updating, suppression, deletion and provision of such data through its own database, systems and APIs. Allsorter does not determine the purposes or means by which the Sourcing Provider collects, compiles, maintains or makes available the Sourcing Provider Candidate Data.

3.3 Customer acts as Controller in respect of Customer Recruitment Activity and Customer’s use of Sourcing Provider Candidate Data, including Customer’s decisions regarding search criteria, candidate selection, saving, enrichment, shortlisting, outreach, screening, ranking, progression, rejection, and hiring decisions.

3.4 Allsorter acts as Processor on behalf of Customer when Processing Saved Candidate Data, Customer Recruitment Workflow Data and when facilitating Customer Recruitment Activity through NexusSourcing, except to the extent Allsorter Processes Personal Data for its own limited business purposes permitted under the DPA, the MSA, or Data Protection Laws.

3.5 Allsorter does not act as Controller of the Sourcing Provider’s underlying candidate database solely because NexusSourcing is provided under Allsorter branding, through an Allsorter interface, or as part of the Services.

3.6 Customer acknowledges that, once Customer saves, shortlists, enriches, exports, contacts, or otherwise uses Sourcing Provider Candidate Data for Customer Recruitment Activity, Customer is responsible for ensuring that such Processing complies with applicable Data Protection Laws.

4. Permitted Purposes

4.1 Customer shall use NexusSourcing and Sourcing Provider Candidate Data only for legitimate recruitment purposes, namely to identify potential job candidates, assess their potential suitability for roles, make initial contact with such candidates, and manage Customer’s recruitment workflow.

4.2 Customer shall not use NexusSourcing or Sourcing Provider Candidate Data for:

(a) regulated background checks, credit checks, tenancy checks, insurance checks, financial risk assessments, right-to-work verification, criminal record checks, or any purpose that requires use of a consumer reporting agency, background check provider, or equivalent regulated screening provider, including any purpose regulated under the Fair Credit Reporting Act or equivalent laws. For clarity, this does not restrict Customer from using NexusSourcing for candidate sourcing, matching, ranking, shortlisting, outreach, screening, or assessing apparent fit against job requirements;

(b) any unlawful discriminatory, unfair, deceptive, intrusive or harassing purpose;

(d) creating, training, improving or commercialising any competing database, model, product or service;

(e) selling, reselling, licensing, disclosing or otherwise making Sourcing Provider Candidate Data available to any third party, except as expressly permitted under the MSA, the DPA, this NexusSourcing Addendum or Customer’s documented instructions.

4.3 NexusSourcing is not designed to identify, infer, assess, score, rank or make recommendations based on special category data or sensitive personal information.

5. Customer Responsibilities

5.1 Customer is solely responsible for:

(a) determining whether and how to use NexusSourcing;

(b) determining the search criteria and candidate selection criteria used by its users;

(d) determining the content, timing, channel and recipients of any candidate outreach;

(e) providing all privacy notices required for Customer Recruitment Activity;

(f) establishing and documenting a valid legal basis for Customer’s Processing of Saved Candidate Data and Customer Recruitment Activity;

(g) complying with all applicable recruitment, employment, equality, anti-discrimination, data protection, marketing, telecommunications, AI, consumer protection and other applicable laws;

(h) ensuring that users use NexusSourcing only in accordance with the DPA, this NexusSourcing Addendum, the MSA, the Help Centre, and applicable law.

5.2 Customer shall ensure that any privacy notice used in connection with NexusSourcing accurately describes Customer’s Processing of candidate Personal Data, including Customer’s use of sourcing, enrichment, outreach, voice, video, web-based or conversational screening, ranking or AI-assisted recruitment tools where applicable.

5.3 Customer shall not use the Outreach Features unless Customer has satisfied all applicable legal requirements for the relevant communication channel and jurisdiction, including any applicable consent, opt-out, unsubscribe, suppression, calling, texting, messaging, email marketing, anti-spam and telecommunications requirements.

5.4 Customer shall not contact, or instruct Allsorter to contact, any candidate who has opted out, withdrawn consent, objected to Processing, requested deletion or suppression, or otherwise indicated that they do not wish to be contacted, where Customer is aware or should reasonably be aware of such preference.

5.5 Customer shall not rely solely on any AI-generated, automated, algorithmic or ranked output generated through NexusSourcing to make recruitment, hiring, rejection, advancement or other decisions that produce legal or similarly significant effects concerning a candidate. Customer shall maintain meaningful human oversight over all such decisions.

5.6 Customer is responsible for independently reviewing the accuracy, relevance, completeness and suitability of any candidate profile, enrichment result, ranking, recommendation, score, analysis, summary or other output made available through NexusSourcing before using it in Customer Recruitment Activity.

6. Allsorter Responsibilities

6.1 Allsorter shall Process Saved Candidate Data and Customer Recruitment Workflow Data only:

(a) to provide NexusSourcing and the Services;

(b) in accordance with the DPA, this NexusSourcing Addendum, the MSA and Customer’s documented instructions;

(d) as otherwise permitted by Data Protection Laws.

6.2 Allsorter shall implement appropriate technical and organisational measures designed to protect Saved Candidate Data and Customer Recruitment Workflow Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, as described in the DPA.

6.3 Allsorter shall use commercially reasonable efforts to configure and operate the NexusSourcing integration in accordance with the applicable Sourcing Provider’s API documentation and mandatory compliance workflows made available to Allsorter.

6.4 Allsorter shall not knowingly disable, remove or materially alter any mandatory privacy, opt-out, suppression, notice or compliance workflow made available by a Sourcing Provider where doing so would reasonably be expected to cause Customer’s use of NexusSourcing to breach applicable Data Protection Laws.

6.5 Allsorter shall not use Sourcing Provider Candidate Data, Saved Candidate Data or Customer Recruitment Workflow Data to train, fine-tune or otherwise improve any AI model, or to build, improve or commercialise any candidate database, analytics product or unrelated product or service for Allsorter’s own independent purposes, except: (a) to the extent strictly necessary to provide NexusSourcing and the Services in accordance with Customer’s documented instructions, the MSA, any applicable AI Addendum, the DPA and this NexusSourcing Addendum; or (b) with Customer’s prior written consent. This clause does not restrict Allsorter’s use of data that has been irreversibly anonymised in accordance with Data Protection Laws.

6.6 Allsorter does not warrant or represent that Sourcing Provider Candidate Data is accurate, complete, up to date, suitable for Customer’s intended purpose, or lawfully usable by Customer in every jurisdiction or for every recruitment activity. Customer remains responsible for verifying the suitability and lawfulness of its use of NexusSourcing and Sourcing Provider Candidate Data.

6.7 Allsorter shall not be responsible for the Sourcing Provider’s collection, compilation, maintenance, storage, suppression, deletion or provision of the Sourcing Provider’s underlying candidate database, except to the extent caused by Allsorter’s breach of this NexusSourcing Addendum, the DPA or the MSA.

7. Data Subject Requests and Candidate Complaints

7.1 The Parties acknowledge that data subject requests may relate to different Processing activities and shall be handled according to the nature of the request.

7.2 Requests relating to the underlying Sourcing Provider Candidate Data, including requests to delete, suppress, correct or restrict a candidate profile in the Sourcing Provider’s database, shall be referred to the relevant Sourcing Provider where Allsorter is technically able to do so and where permitted by applicable law.

7.3 Requests relating to Customer Recruitment Activity, including Customer outreach records, Customer notes, Customer shortlists, Customer screening activity, Customer recruitment decisions, Customer interview activity, or Personal Data saved into Customer’s workflow, shall be Customer’s responsibility as Controller. Allsorter shall provide reasonable assistance in accordance with the DPA.

7.4 Where Allsorter receives a request, objection, complaint, inquiry or communication from a Data Subject, regulator or other third party relating to NexusSourcing, Allsorter shall, to the extent required by the DPA and permitted by law, notify Customer or the relevant Sourcing Provider, as applicable, taking into account the apparent subject matter of the request.

7.5 Customer shall promptly notify Allsorter of any data subject request, complaint, regulatory inquiry or other communication relating to NexusSourcing where Allsorter’s assistance is required to respond to it.

8. Retention and Deletion

8.1 Before Customer saves, shortlists, enriches or exports a candidate profile, Sourcing Provider Candidate Data displayed through NexusSourcing may be processed transiently through the Services for the purpose of displaying search results and enabling Customer to determine whether to take further action.

8.2 Where Customer saves, shortlists, enriches or exports a candidate profile, the resulting Saved Candidate Data will be processed in accordance with the technical and organisational measures set out in Schedule 2 of the DPA. The Sourcing Provider’s own technical and organisational measures apply to its underlying candidate database and systems.

8.3 Where Customer enriches a candidate profile, enrichment results may be cached temporarily and the enriched contact details may be written to Allsorter’s systems as Saved Candidate Data.

8.4 Where Customer saves or shortlists a candidate profile, the saved candidate profile and related data may be stored in Allsorter’s systems as Saved Candidate Data and Processed in accordance with the DPA and Customer’s documented instructions.

8.5 Unless otherwise agreed in writing, Saved Candidate Data shall be retained and deleted in accordance with the retention period set out in Schedule 1 of the DPA or the applicable Order Form. Customer may request a shorter retention period where supported by the Services.

8.6 Deletion of Saved Candidate Data from Allsorter’s systems shall not, by itself, delete or suppress the corresponding candidate profile from the Sourcing Provider’s underlying database. Requests relating to deletion or suppression from the Sourcing Provider’s underlying database must be directed to the relevant Sourcing Provider, which Allsorter may facilitate where supported by the Services and permitted by applicable law.

9. Outreach Features

9.1 Outreach Features may be made available only in the jurisdictions, regions or territories supported by Allsorter from time to time. Allsorter may disable or restrict Outreach Features by jurisdiction, customer, user, channel, campaign type or use case where Allsorter reasonably considers this necessary to reduce legal, regulatory, security, deliverability or platform risk.

9.2 Customer shall ensure that all outreach content is lawful, accurate, fair, non-discriminatory, non-misleading, and compliant with applicable law and Customer’s own policies.

9.3 Customer is responsible for ensuring that any email domain, messaging account, telephone number, social media account, WhatsApp account, LinkedIn account, job board account or other communication channel used in connection with NexusSourcing is lawfully configured and used.

9.4 Where Outreach Features are configured to send communications from Customer’s domain or account, Customer is responsible for the lawful use of that domain or account and for all candidate-facing communications sent using it, except to the extent a breach is caused by Allsorter’s failure to follow Customer’s documented instructions or by Allsorter’s breach of the DPA or this NexusSourcing Addendum.

10. Third-Party Job Board and Platform Credentials

10.1 Where Customer connects third-party job boards, social networks, applicant tracking systems, CRM systems, ATS systems, messaging platforms or other third-party services to NexusSourcing, Customer is responsible for ensuring that:

(a) Customer has the right to connect and use such accounts and credentials;

(b) Customer’s use complies with the applicable third-party terms, policies and permissions;

(c) Customer does not instruct Allsorter to access or use any third-party service in breach of applicable law or contract.

10.2 Allsorter shall not be responsible for any suspension, restriction, loss of access, claim, penalty or other consequence arising from Customer’s breach of third-party platform terms, except to the extent caused by Allsorter’s breach of the DPA, this NexusSourcing Addendum or the MSA.

11. AI, Matching, Ranking and Screening

11.1 Where NexusSourcing includes AI-assisted matching, ranking, screening, scoring, summarisation, candidate analysis, recommendation, voice, video, web-based or conversational screening functionality, such functionality is intended to support Customer’s recruitment workflow and shall not replace Customer’s independent judgment or human decision-making.

11.2 Customer shall ensure that its use of any AI-assisted functionality complies with applicable AI, employment, equality, anti-discrimination, data protection and recruitment laws.

11.3 Customer shall complete any legally required impact assessment, bias audit, transparency notice, candidate notice, consent process, human oversight process, accommodation process or alternative assessment process required for Customer’s use of NexusSourcing.

12. International Transfers

12.1 Customer acknowledges that NexusSourcing may involve Sourcing Providers and subprocessors located outside the EEA, the United Kingdom or other jurisdictions in which Customer or Data Subjects are located.

12.2 To the extent Allsorter transfers Relevant Personal Data to a Sourcing Provider or other subprocessor outside the EEA, the United Kingdom or an adequacy-approved jurisdiction, Allsorter shall implement an appropriate transfer mechanism as required by Data Protection Laws.

12.3 To the extent Sourcing Provider Candidate Data is provided by a Sourcing Provider as an independent Controller, the Sourcing Provider is responsible for implementing any transfer mechanism required for its disclosure of such data, and Customer is responsible for implementing any transfer mechanism required for Customer’s subsequent use or onward transfer of such data.

13. Subprocessors and Sourcing Providers

13.1 Customer acknowledges and authorises Allsorter to use subprocessor(s) listed in clause 15 of this NexusSourcing Addendum as a Sourcing Provider and subprocessor for the purposes of providing NexusSourcing.

13.2 Allsorter may replace, remove or add Sourcing Providers from time to time in accordance with the subprocessor provisions of the DPA.

13.3 Customer acknowledges that availability, functionality, data coverage, enrichment availability, search results, communication channels and other NexusSourcing features may depend on the applicable Sourcing Provider and may vary by jurisdiction, candidate, role, data source or third-party platform.

14. Suspension or Restriction

14.1 Allsorter may suspend or restrict Customer’s access to NexusSourcing, including access through any individual account, where Allsorter reasonably believes that:

(a) Customer or a User is using NexusSourcing unlawfully or in breach of the DPA, this NexusSourcing Addendum, the MSA or the Help Centre;

(b) continued access creates a material legal, regulatory, security, deliverability or reputational risk;

(d) Customer’s use may violate applicable outreach, telecommunications, anti-spam, employment, equality, data protection or AI laws.

14.2 Allsorter shall, where reasonably practicable and legally permitted, notify Customer of the reason for the suspension or restriction and work with Customer in good faith to restore access once the relevant risk has been remediated.

15. Additional Third-Party Subprocessors / Sourcing Providers

Customer acknowledges and authorises Allsorter to use the following additional subprocessors for the purposes of providing NexusSourcing:

16. No Expansion of Allsorter Liability

16.1 Nothing in this NexusSourcing Addendum expands Allsorter’s liability beyond the liability position set out in the DPA and MSA.

16.2 Allsorter shall not be liable for any claim, loss, damage, penalty, fine, cost or expense arising from:

(a) the Sourcing Provider’s collection, compilation, maintenance, storage, suppression, deletion or provision of its underlying candidate database;

(b) Customer’s search criteria, candidate selection, outreach, screening, ranking, rejection, hiring or other recruitment decisions;

(c) Customer’s failure to provide required privacy notices, obtain required consents, honour opt-outs, or comply with applicable recruitment, employment, equality, AI, telecommunications, anti-spam or data protection laws;

(d) Customer’s use of Sourcing Provider Candidate Data outside the permitted purposes; and

(e) Customer’s breach of third-party platform terms or job board terms;

16.3 Clause 16.2 shall not apply to the extent the relevant claim, loss, damage, penalty, fine, cost or expense is caused by Allsorter’s breach of the DPA, this NexusSourcing Addendum or the MSA.

___________________________________________________________________________

Data Processing Addendum for Hiring Manager Portal

1. Scope and Order of Precedence

1.1 This Data Processing Addendum for Hiring Manager Portal (“Hiring Manager Portal Addendum”) is appended to and incorporated into the Data Processing Agreement between Datalive Limited T/A Allsorter (“Allsorter” or “Service Provider”) and Customer (the “DPA”). This Hiring Manager Portal Addendum applies only where Customer purchases, enables, accesses or uses the Hiring Manager Portal.

1.2 Capitalised terms not defined in this Hiring Manager Portal Addendum shall have the meanings given to them in the DPA or the MSA, as applicable.

1.3 In the event of any conflict or inconsistency between this Hiring Manager Portal Addendum and the DPA, this Hiring Manager Portal Addendum shall prevail solely in respect of the Hiring Manager Portal and the Processing of Relevant Personal Data in connection with the Hiring Manager Portal. In all other respects, the DPA shall continue to apply.

1.4 This Hiring Manager Portal Addendum shall remain in effect for as long as Customer uses the Hiring Manager Portal or Allsorter Processes any Relevant Personal Data in connection with the Hiring Manager Portal.

2. Definitions

“Hiring Manager Portal” means the feature made available by Allsorter as part of the Services that enables Customer to create a portal through which hiring managers or other Customer-authorised reviewers may review candidate profiles, compare candidates against job requirements, provide feedback, shortlist candidates, reject candidates, request interviews, and use AI-assisted functionality to analyse or query candidate information.

“Portal Data” means Relevant Personal Data Processed in connection with the Hiring Manager Portal, including candidate resumes/CVs, candidate profiles, job titles, job descriptions, hiring manager and reviewer names, email addresses, portal access information, reviewer interactions, feedback, shortlist/rejection/interview request decisions, AI-assisted comparison outputs, analysis outputs, access logs and related operational metadata

“Portal Output” means any score, summary, comparison, ranking, analysis, recommendation, explanation, response, pros and cons list, strengths and gaps analysis, or other output generated through the Hiring Manager Portal.

3. Roles of the Parties

3.1 The Parties acknowledge and agree that, in respect of the Hiring Manager Portal, Customer remains the Controller and Allsorter remains the Processor of Portal Data in accordance with the DPA.

3.2 Customer’s creation and use of a Hiring Manager Portal, including selecting candidates, adding job descriptions, inviting hiring managers or other reviewers, configuring access, reviewing Portal Output, and deciding what action to take in respect of a candidate, forms part of Customer’s documented instructions to Allsorter.

3.3 Allsorter shall Process Portal Data only to provide the Hiring Manager Portal and the Services, in accordance with the DPA, this Hiring Manager Portal Addendum, the MSA and Customer’s documented instructions.

4. Permitted Purpose

4.1 The Hiring Manager Portal may be used only for legitimate recruitment workflow support, including enabling Customer-authorised reviewers to review candidate profiles, compare candidates against job requirements, provide feedback, shortlist or reject candidates, request interviews, and analyse candidate information.

4.2 Portal Output is intended to support Customer’s recruitment review process and shall not replace Customer’s independent judgment or human decision-making.

5. Customer Responsibilities

5.1 Customer is solely responsible for:

(a) determining whether and how to use the Hiring Manager Portal;

(b) selecting the candidates, job descriptions and job requirements submitted to the Hiring Manager Portal;

(d) ensuring that all invited reviewers are authorised to receive and review the Portal Data;

(e) ensuring that reviewer access is limited to what is necessary for Customer’s recruitment purposes;

(f) reviewing the accuracy, relevance, completeness and fairness of Portal Output before using it;

(g) providing any notices and obtaining any consents required by applicable law;

(h) complying with applicable recruitment, employment, equality, anti-discrimination, data protection, AI and other applicable laws.

5.2 Customer shall not rely solely on Portal Output to make hiring, rejection, advancement, interview, eligibility or other decisions that produce legal or similarly significant effects concerning a candidate. Customer shall maintain meaningful human oversight over all such decisions.

5.3 Customer shall ensure that Hiring Manager Portal access links, access codes and login details are shared only with authorised recipients and are protected against unauthorised access, disclosure or onward sharing.

5.4 Customer shall promptly notify Allsorter if access to a Hiring Manager Portal should be revoked, restricted or amended.

6. Allsorter Responsibilities

6.1 Allsorter shall Process Portal Data in accordance with the DPA, this Hiring Manager Portal Addendum, the MSA and Customer’s documented instructions.

6.2 Allsorter shall implement appropriate technical and organisational measures designed to protect Portal Data, as described in Schedule 2 of the DPA.

6.3 Allsorter shall not use Portal Data to train, fine-tune or otherwise improve any AI model, or to build, improve or commercialise any candidate database, analytics product or unrelated product or service for Allsorter’s own independent purposes, except: (a) to the extent strictly necessary to provide the Hiring Manager Portal and the Services in accordance with Customer’s documented instructions, the MSA, any applicable AI Addendum, the DPA and this Hiring Manager Portal Addendum; or (b) with Customer’s prior written consent. This clause does not restrict Allsorter’s use of data that has been irreversibly anonymised in accordance with Data Protection Laws.

6.4 Allsorter does not warrant or represent that Portal Output is complete, error-free, conclusive, or sufficient for any recruitment, hiring, rejection, advancement, eligibility or interview decision.

7. Access, Sharing and Revocation

7.1 Customer acknowledges that creating a Hiring Manager Portal may make Portal Data available to the reviewers invited by Customer.

7.2 Allsorter shall provide functionality to enable access to the Hiring Manager Portal through access controls determined by Allsorter from time to time.

7.3 Customer is responsible for the acts and omissions of any person to whom Customer grants, sends or permits access to the Hiring Manager Portal.

7.4 Allsorter may suspend or restrict access to a Hiring Manager Portal, including access through any individual account or access link, where Allsorter reasonably believes that continued access creates a legal, regulatory, security, confidentiality or data protection risk.

8. Retention and Deletion

8.1 Portal Data and Portal Output shall be retained for seven (7) days from the date the Hiring Manager Portal is created and deleted thereafter, unless otherwise agreed in writing. The underlying candidate profile data will be retained in accordance with the data retention period specified in Schedule 1.

8.2 Customer may request a shorter retention period where supported by the Services.

8.3 Deletion of the underlying candidate profile from the Services may result in deletion or unavailability of related Portal Data and Portal Output.

9. No Expansion of Allsorter Liability

9.1 Nothing in this Hiring Manager Portal Addendum expands Allsorter’s liability beyond the liability position set out in the DPA and MSA.

9.2 Allsorter shall not be liable for any claim, loss, damage, penalty, fine, cost or expense arising from:

(a) Customer’s decision to use the Hiring Manager Portal for a particular candidate, role, reviewer, jurisdiction or recruitment process;

(b) Customer’s selection of reviewers or sharing of access links, access codes or login details;

(d) Customer’s failure to provide required privacy notices, obtain required consents, or comply with applicable recruitment, employment, equality, AI or data protection laws;

(e) Customer’s recruitment, hiring, rejection, advancement, interview, eligibility or other candidate-related decisions.

9.3 Clause 9.2 shall not apply to the extent the relevant claim, loss, damage, penalty, fine, cost or expense is caused by Allsorter’s breach of the DPA, this Hiring Manager Portal Addendum or the MSA.

Nexus Data Processing Agreement