REQeV Subprocessors

ECDG, Inc., a California corporation, doing business as REQeV (“REQeV”, “we”, “us”), uses a small number of third-party service providers to help deliver REQeV ATS, REQeV Sourcing, REQeV Mission Control and our related APIs, integrations, browser extensions and AI features (the “Services”). This page lists the providers that may process Customer Data on our behalf.

This page forms part of our Data Processing Addendum (“DPA”). Capitalized terms not defined here have the meanings given in the DPA or our Master Subscription Agreement.

1. What a Subprocessor Is

A subprocessor is a third party that REQeV engages to process Customer Data in its role as a processor or service provider for our customers. Customer Data includes the candidate, contact and other personal information that customers store in or generate through the Services.

Vendors that process only REQeV’s own business data, such as our internal accounting or marketing tools, are not subprocessors for Customer Data and are described in our Privacy Policy instead.

2. How We Select and Oversee Subprocessors

Before engaging a subprocessor, we review its security and privacy practices in light of the data it will handle. We engage each subprocessor under a written agreement that imposes data protection obligations at least as protective as those in the DPA.

Those agreements limit the subprocessor to processing Customer Data only as needed to provide its services to us. Where Customer Data from the EEA, the UK or Switzerland is transferred, they include appropriate transfer safeguards, as described in our GDPR Policy. REQeV remains responsible for the acts and omissions of its subprocessors as set out in the DPA.

3. Current Subprocessors

REQeV also runs models using Ollama on REQeV-controlled servers. This local use does not send Customer Data to Ollama’s cloud service; Ollama is software used by REQeV, rather than a separate recipient of Customer Data for that processing.

Depending on the feature, AI processing uses OpenAI, Anthropic or models running on REQeV-controlled servers. Third-party AI processing is subject to the DPA’s subprocessor protections. New subprocessors will be added here with notice as described in Section 5.

Some subprocessors rely on their own infrastructure providers. For example, Supabase, Inc. hosts its managed database service on Amazon Web Services. These providers are bound by the subprocessor’s own contractual commitments.

Payments are handled by Stripe, Inc. Stripe processes billing and payment details as REQeV’s own vendor rather than Customer Data, so it is not listed as a subprocessor. REQeV does not store full payment card numbers.

4. Affiliates

REQeV does not currently use any affiliates to process Customer Data.

If we begin using an affiliate as a subprocessor, we will add it to this page and give notice as described in Section 5.

5. Notice of Changes

We will give at least 30 days’ notice before a new subprocessor begins processing Customer Data. We give notice by updating this page and by emailing each customer’s account administrator and anyone who has subscribed to updates.

To subscribe, email support@reqev.com with the subject line “Subprocessor updates”. Please include your name, company and the email address that should receive notices. Customers are responsible for keeping their subscription current.

In rare cases, we may need to replace a subprocessor on shorter notice to protect the security or continuity of the Services, for example if a provider suffers an outage or ceases operations. In that case, we will give notice as soon as reasonably practicable, and your objection rights under Section 6 still apply.

Removing a subprocessor or making changes that do not affect how Customer Data is processed, such as a company name change, may be made without advance notice. We will still update this page.

6. Objecting to a New Subprocessor

If you have a reasonable, good-faith objection to a new subprocessor based on data protection concerns, you may object in writing during the 30-day notice period, as provided in the DPA. Send your objection to support@reqev.com and explain the grounds for it.

If you object, we will work with you in good faith to address your concerns. Options may include changing your configuration so that the new subprocessor does not process your Customer Data, or offering other reasonable measures.

If we cannot resolve the objection within 30 days after you raise it, you may terminate the affected Services by written notice, as described in the DPA. In that case, we will refund any prepaid fees for the terminated Services covering the period after termination. If you do not object within the notice period, the new subprocessor is treated as approved.

7. Integrations You Enable

The Services let you connect third-party products, such as job boards, email and calendar providers, and other recruiting tools. Those providers are not REQeV subprocessors. When you enable an integration, you direct REQeV to exchange data with that provider, and your use of it is governed by your own agreement with the provider.

Please review the privacy and security practices of any integration before you connect it. Our Developer Terms apply to applications that use our APIs.

8. Contact

For questions about this page or to subscribe to updates, contact ECDG, Inc., a California corporation, doing business as REQeV, 236 West Portal Ave #390, San Francisco, CA 94127.

Subprocessor questions and objections: support@reqev.com

Legal notices: support@reqev.com