REQeV Data Processing Addendum

This Data Processing Addendum (“DPA”) is between ECDG, Inc., a California corporation, doing business as REQeV (“REQeV”, “we”, “us” or “our”), and the customer that has entered into the Master Subscription Agreement or another written agreement with REQeV for the Services (the “Agreement”) (“Customer” or “you”).

This DPA forms part of the Agreement and applies whenever REQeV processes Customer Personal Data on Customer’s behalf. It is incorporated automatically, and no separate signature is required. Customers that need a countersigned copy may request one from support@reqev.com.

Capitalized terms not defined in this DPA have the meanings given in the Agreement. If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Customer Personal Data. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses control.

1. Definitions

“Applicable Data Protection Law” means all laws that apply to the processing of Customer Personal Data under the Agreement. These include, as applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as incorporated into UK law and the UK Data Protection Act 2018 (“UK GDPR”), the revised Swiss Federal Act on Data Protection of 25 September 2020 (“FADP”), the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (“CCPA”), and other U.S. state comprehensive privacy laws (“US State Privacy Laws”).

“Controller,” “processor,” “data subject,” “personal data,” “processing” and “supervisory authority” have the meanings given in the GDPR. The terms “business,” “service provider,” “contractor,” “consumer,” “sell,” “share,” “business purpose” and “personal information” have the meanings given in the CCPA. References to “controller” and “processor” include the equivalent terms under other Applicable Data Protection Law, such as “business” and “service provider.”

“Customer Personal Data” means personal data within Customer Data that REQeV processes on Customer’s behalf in providing the Services.

“Restricted Transfer” means a transfer of Customer Personal Data from the European Economic Area (“EEA”), the United Kingdom or Switzerland to a country that has not been recognized as providing an adequate level of protection for personal data.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by REQeV or its Subprocessors. Unsuccessful attempts that do not compromise the security of Customer Personal Data, such as blocked login attempts, port scans or denial of service attacks, are not Security Incidents.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.

“Subprocessor” means any third party engaged by REQeV to process Customer Personal Data.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as updated from time to time.

2. Roles and Scope

2.1 Customer as controller. For Customer Personal Data, Customer is the controller (or, under the CCPA, the business), and REQeV is the processor (or service provider). Where Customer acts as a processor on behalf of its own client, such as a recruiting firm acting for a hiring company, REQeV is Customer’s subprocessor, and Customer is responsible for obtaining any authorizations its client requires.

2.2 REQeV as controller. This DPA does not apply to personal data that REQeV processes as a controller, such as data about visitors to reqev.com, marketing contacts, account and billing information, and Usage Data. That processing is described in our Privacy Policy.

2.3 Details of processing. The subject matter, duration, nature and purpose of processing, and the types of personal data and categories of data subjects, are described in Annex I.

2.4 Customer responsibilities. Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis for processing and providing all notices and obtaining all consents required by Applicable Data Protection Law. Customer is responsible for the accuracy and quality of Customer Personal Data and for how it was obtained. Customer will not instruct REQeV to process Customer Personal Data in violation of Applicable Data Protection Law.

3. Processing Instructions

3.1 Documented instructions. REQeV will process Customer Personal Data only on Customer’s documented instructions, unless required to do otherwise by applicable law. If the law requires other processing, REQeV will inform Customer before processing unless the law prohibits it.

3.2 What counts as instructions. Customer instructs REQeV to process Customer Personal Data to (a) provide, maintain, secure and support the Services under the Agreement, (b) carry out processing initiated by Authorized Users through the Services, including through Third-Party Integrations Customer enables, and (c) comply with other reasonable written instructions from Customer that are consistent with the Agreement. The Agreement and this DPA are Customer’s complete instructions at the time of signing, and additional instructions require the parties’ written agreement.

3.3 Unlawful instructions. REQeV will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. REQeV is not required to perform a legal assessment of Customer’s instructions and may suspend processing of the relevant instruction until Customer confirms or modifies it.

4. Confidentiality

REQeV will ensure that its personnel and contractors authorized to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality. REQeV will limit access to Customer Personal Data to personnel who need it to provide the Services.

5. Security

5.1 Security measures. REQeV will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. These measures are described in Annex II and our Security and Privacy at REQeV.

5.2 Updates. REQeV may update its security measures from time to time, provided the updates do not materially decrease the overall security of the Services during Customer’s Subscription Term.

5.3 Customer security. Customer is responsible for its own secure use of the Services, including protecting account credentials, configuring user permissions appropriately, and securing any systems it connects to the Services.

6. Subprocessors

6.1 General authorization. Customer grants REQeV general authorization to engage Subprocessors to process Customer Personal Data. REQeV’s current Subprocessors are listed at Subprocessors, which Customer confirms it has reviewed and approves.

6.2 Subprocessor obligations. REQeV will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, to the extent appropriate to the service the Subprocessor provides. REQeV remains responsible to Customer for its Subprocessors’ performance of those obligations.

6.3 Notice of changes. REQeV will notify Customer of any new Subprocessor at least 30 days before it begins processing Customer Personal Data. REQeV will provide notice by updating the Subprocessors page and emailing Customer’s account administrator and anyone at Customer who has subscribed to updates as described on that page.

6.4 Right to object. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing support@reqev.com within the 30-day notice period. The parties will discuss the concern in good faith, and REQeV may offer a reasonable alternative, such as changing the configuration of the Services to avoid the new Subprocessor processing Customer Personal Data.

6.5 Termination on objection. If the parties cannot resolve an objection within 30 days after Customer raises it, Customer may terminate the affected part of the Services by written notice. REQeV will refund any prepaid fees for the terminated Services covering the period after termination. This is Customer’s sole remedy for an objection to a Subprocessor.

6.6 Emergency replacement. If REQeV must replace a Subprocessor urgently for reasons outside its control, such as a Subprocessor’s sudden failure or a security concern, REQeV will notify Customer as soon as practicable, and Customer’s objection rights under this Section will apply from the date of that notice.

7. Data Subject Requests

7.1 Assistance. Taking into account the nature of the processing, REQeV will provide reasonable assistance to Customer, through appropriate technical and organizational measures, to respond to requests from data subjects or consumers to exercise their rights, such as rights of access, correction, deletion, portability, restriction, objection and opting out.

7.2 Self-service tools. The Services include functionality that lets Customer search for, export, correct and delete Customer Personal Data. Customer will use these tools first. If Customer cannot fulfill a request using them, REQeV will provide additional reasonable assistance on request to support@reqev.com.

7.3 Requests received by REQeV. If REQeV receives a request directly from a data subject that it can identify as relating to Customer, REQeV will promptly forward it to Customer, or direct the requester to contact Customer, and will not respond itself except to confirm the request was forwarded or as required by law. Our Candidate Privacy Notice explains this process to candidates.

8. Security Incident Notification

8.1 Notice. REQeV will notify Customer of a Security Incident without undue delay and no later than 72 hours after REQeV becomes aware of it. REQeV will not delay notice until its investigation is complete. Notice will be sent to Customer’s account administrator or the security contact Customer designates.

8.2 Content. REQeV’s notice will describe, to the extent then known, the nature of the Security Incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it and mitigate its effects. If REQeV cannot provide all of this information at once, it will provide it in phases as it becomes available.

8.3 Response. REQeV will take reasonable steps to contain, investigate and remediate the Security Incident. REQeV will provide reasonable cooperation to help Customer meet its own obligations to notify supervisory authorities, regulators and affected individuals.

8.4 No admission. REQeV’s notice of or response to a Security Incident is not an acknowledgment of fault or liability. Unless the law requires otherwise, Customer is responsible for notifying affected individuals and regulators, and REQeV will not do so on Customer’s behalf without Customer’s approval, except where required by law.

8.5 Reporting. Customer may report suspected security issues to support@reqev.com.

9. Data Protection Impact Assessments

On Customer’s reasonable request, and taking into account the nature of the processing and the information available to REQeV, REQeV will provide reasonable assistance with Customer’s data protection impact assessments, risk assessments, and prior consultations with supervisory authorities, to the extent required by Applicable Data Protection Law. REQeV may first direct Customer to its published documentation, including this DPA, the Security Overview and the Subprocessors page. REQeV may charge a reasonable fee for assistance that requires significant effort beyond providing that documentation.

10. Deletion and Return

10.1 Return. During the Subscription Term, Customer may export Customer Personal Data using the Services. At the end of the Services, Customer may choose return or deletion of Customer Personal Data. Unless Customer requests earlier deletion, REQeV will make that data available for export during the window described in the Agreement, including any longer retrieval period required by applicable law.

10.2 Deletion. REQeV will delete Customer Personal Data and existing copies without undue delay after the applicable export window, or earlier on Customer’s instruction, unless applicable law requires retention. Backup copies will be put beyond use pending overwrite under the applicable documented backup retention schedule. REQeV will provide information about that schedule and confirm deletion status in writing on request, including any copies awaiting backup overwrite or retained by law. If a backup is restored, deletion instructions will be reapplied before the affected data is returned to active use. These arrangements do not extend applicable legal deadlines for responding to or fulfilling privacy requests.

10.3 Retained data. Any Customer Personal Data that REQeV retains to comply with law, or that remains in backups before they are overwritten, will remain protected under this DPA, will be isolated from further active processing, and will be used only for the purpose that requires its retention.

11. Audits

11.1 Information. REQeV will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA. This includes responses to reasonable security questionnaires and, where available, summaries of any third-party security assessments or penetration tests that REQeV has obtained.

11.2 Reports in lieu of audit. Customer agrees that its audit rights will first be satisfied by the documentation and reports described in Section 11.1. REQeV’s Subprocessors, including its hosting and database providers, maintain their own independent audit reports, which REQeV may make available where their terms allow.

11.3 On-site or remote audits. If the information in Section 11.1 is not reasonably sufficient to demonstrate compliance, or if a supervisory authority requires it, Customer may conduct an audit, either itself or through an independent auditor bound by confidentiality obligations who is not a REQeV competitor. Audits are subject to these conditions:

1. Customer may audit no more than once in any 12-month period, unless required by a supervisory authority or following a Security Incident affecting Customer Personal Data.
2. Customer must give at least 30 days’ written notice to support@reqev.com, and the parties will agree the scope, timing and duration in advance.
3. Audits will take place during business hours, will not unreasonably interfere with REQeV’s operations, and will not give access to other customers’ data or to information subject to confidentiality obligations to third parties.
4. Customer will bear its own costs and will reimburse REQeV’s reasonable costs for time spent beyond one business day.
5. Customer will share a copy of any audit report with REQeV, and the report will be REQeV’s Confidential Information.

12. International Transfers

12.1 Location of processing. REQeV primarily stores and processes Customer Personal Data in the United States, using the hosting and database providers listed on the Subprocessors page. REQeV and its Subprocessors may process Customer Personal Data in other countries where they operate, subject to this Section.

12.2 EEA transfers. For Restricted Transfers from the EEA, the parties incorporate the SCCs by reference as follows:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor;
• Clause 7 (docking clause) applies;
• in Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 6.3 of this DPA;
• in Clause 11, the optional language does not apply;
• in Clause 13, the supervisory authority is the one determined under Clause 13(a) based on Customer’s establishment or representative;
• in Clauses 17 and 18, the governing law and courts are those of Ireland;
• Annexes I and II of the SCCs are completed with the information in Annexes I and II of this DPA, and Annex III is completed with the Subprocessors page;
• for Module Three, Customer will pass on any relevant notices to its controller, and REQeV may rely on Customer’s instructions as reflecting those of the controller.

12.3 UK transfers. For Restricted Transfers from the United Kingdom, the SCCs apply as modified by the UK Addendum, which the parties incorporate by reference. Table 1 of the UK Addendum is completed with the parties’ details in this DPA, Table 2 with the modules and options selected in Section 12.2, and Table 3 with Annexes I to III of this DPA. For Table 4, either party may end the UK Addendum as permitted by its Section 19.

12.4 Swiss transfers. For Restricted Transfers from Switzerland, the SCCs apply as described in Section 12.2 with these changes: references to the GDPR are read as references to the FADP where the transfer is subject to it; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and references to “Member State” are read to allow data subjects in Switzerland to bring claims in their place of habitual residence.

12.5 Alternative mechanisms. If a transfer mechanism in this Section is invalidated or replaced, the parties will cooperate in good faith to adopt a valid alternative mechanism. If REQeV adopts another lawful transfer mechanism, that mechanism will apply to the extent it covers the transfer.

12.6 Government access requests. If REQeV receives a legally binding request from a public authority for Customer Personal Data, REQeV will, unless legally prohibited, notify Customer promptly and direct the authority to request the data from Customer. REQeV will review each request for legality, challenge requests it reasonably believes are unlawful, and disclose only the minimum data required.

13. CCPA and US State Privacy Laws

13.1 Service provider role. For Customer Personal Data subject to the CCPA or other US State Privacy Laws, REQeV is a service provider or processor, and Customer discloses Customer Personal Data to REQeV only for the limited and specified business purposes of providing the Services as described in the Agreement and Annex I.

13.2 Certifications. REQeV certifies that it understands and will comply with the following restrictions. REQeV will not:

1. sell or share Customer Personal Data, including for cross-context behavioral advertising;
2. retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in the Agreement, or as otherwise permitted by the CCPA;
3. retain, use or disclose Customer Personal Data outside the direct business relationship between REQeV and Customer;
4. combine Customer Personal Data with personal information that REQeV receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA and its regulations.

13.3 Compliance. REQeV will comply with the obligations that apply to it under the CCPA and other US State Privacy Laws, and will provide the same level of privacy protection required of businesses by those laws. REQeV will notify Customer if it determines that it can no longer meet its obligations under those laws.

13.4 Customer rights. Customer may take reasonable and appropriate steps to ensure that REQeV uses Customer Personal Data consistently with Customer’s obligations under the CCPA. On notice, including under Section 13.3, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, such as requiring REQeV to delete or cease processing the affected data.

13.5 Permitted uses. REQeV may use Customer Personal Data as permitted for service providers under the CCPA regulations, including to maintain and improve the Services for Customer, to detect and prevent security incidents and fraud, to debug and repair errors, and to comply with law, provided that REQeV does not use Customer Personal Data to build or modify profiles for use in providing services to another business.

13.6 Deidentified data. If REQeV receives or creates deidentified data from Customer Personal Data, it will take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintain and use it only in deidentified form, not attempt to reidentify it, and require any recipient to do the same.

13.7 Subcontractors. REQeV will engage Subprocessors under written contracts that bind them to obligations consistent with this Section 13, and will notify Customer of new Subprocessors as described in Section 6.

13.8 Other state laws. To the extent other US State Privacy Laws apply, REQeV will also (a) help Customer meet its obligations to respond to consumer requests and conduct data protection assessments, (b) impose a duty of confidentiality on its personnel, and (c) delete or return personal data at the end of the Services, as described in this DPA.

14. Liability

Each party’s liability arising out of or relating to this DPA, including under the Standard Contractual Clauses to the extent permitted by them, is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits either party’s liability to data subjects where the Standard Contractual Clauses or Applicable Data Protection Law do not permit such a limitation.

15. General

15.1 Term. This DPA remains in effect for as long as REQeV processes Customer Personal Data, even if the Agreement has ended.

15.2 Changes in law. REQeV may update this DPA as reasonably necessary to comply with changes in Applicable Data Protection Law or guidance from a supervisory authority. REQeV will give Customer notice of material changes and will not make changes that materially reduce the protection of Customer Personal Data without Customer’s agreement, unless required by law.

15.3 Governing law. Except as required by the Standard Contractual Clauses or Applicable Data Protection Law, this DPA is governed by the governing law and dispute resolution provisions of the Agreement.

16. Annex I: Details of Processing

A. List of parties

The parties’ acceptance of the Agreement is treated as their signature of this Annex.

B. Description of processing

17. Annex II: Technical and Organizational Measures

REQeV maintains the following measures, which it may update as described in Section 5.2. More detail is available in our Security and Privacy at REQeV.

Hosting and infrastructure

• The application is hosted on Vercel, Inc. infrastructure in the United States.
• Customer Data is stored in managed PostgreSQL databases provided by Supabase, Inc., which runs on Amazon Web Services in the United States.
• REQeV relies on its hosting and database providers for physical and environmental security of data centers.
• Production, staging and development environments are separated.

Encryption

• Data in transit over public networks is encrypted using TLS.
• Data at rest in production databases and backups is encrypted by REQeV’s database provider.
• Payment card data is handled by Stripe, Inc., and REQeV does not store full card numbers.
• Secrets and credentials are stored in managed secret stores or environment configuration, not in source code.

Access control

• Access to production systems and Customer Data is limited to authorized personnel with a business need, based on least privilege.
• Administrative access requires unique accounts and multi-factor authentication where supported.
• Access is removed promptly when personnel change roles or leave.
• The Services support role-based permissions so that Customer can limit what its Authorized Users can see and do.
• Database access controls, including row-level security where appropriate, help keep each customer’s data logically separated.

Application and service security

• Tool-to-hub calls use per-tool shared secrets. Outbound credit-grant commands from the hub are HMAC-signed.
• API access requires authentication and is subject to rate limiting.
• Code changes go through version control and review before deployment to production.
• Third-party dependencies are monitored for known vulnerabilities and updated as needed.

Monitoring and logging

• Application, access and infrastructure events are logged and retained for security and troubleshooting.
• Monitoring and alerting are in place for availability and suspicious activity.

Availability and resilience

• Production databases are backed up automatically, with backups retained for a limited period and overwritten in the ordinary course.
• Backup restoration and recovery procedures are maintained.
• Where expressly incorporated into a signed Order Form, service availability commitments are described in the Service Level Agreement.

Incident response

• REQeV maintains an incident response process covering detection, containment, investigation, notification and remediation.
• Customers are notified of Security Incidents as described in Section 8.
• Vulnerability reports are accepted at support@reqev.com under our Responsible Disclosure Policy.

Personnel and vendors

• Personnel with access to Customer Data are bound by confidentiality obligations.
• Subprocessors are assessed for security and privacy practices before engagement and are bound by written data protection terms.

AI Features

• AI Features send only the data needed to perform the requested task to the relevant model provider.
• REQeV does not permit its model providers to use Customer Personal Data to train their general-purpose models.

Data minimization, retention and deletion

• Customer controls the Customer Personal Data submitted to the Services and can correct, export and delete it.
• Customer Personal Data is deleted after termination as described in Section 10.

18. Annex III: Subprocessors

The current list of Subprocessors, including each Subprocessor’s name, the service it provides and its location, is published at Subprocessors. That list forms Annex III of this DPA and of the Standard Contractual Clauses. That page explains how to subscribe to notice of changes as described in Section 6.

19. Contact

Questions about this DPA or requests for assistance can be sent to:

• ECDG, Inc., doing business as REQeV
• 236 West Portal Ave #390, San Francisco, CA 94127
• Privacy and DPA requests: support@reqev.com
• Security incidents and vulnerabilities: support@reqev.com
• Legal notices: support@reqev.com