This Data Processing Agreement (“DPA”) forms an integral part of the Cloud Services Agreement and/or Order Form (“Agreement”) between Sentiva LLC (“Provider”) and the Customer identified in the Agreement.
1. Key Terms and Definitions
1.1. Roles of the Parties
- Provider Role: Processor (Processing Personal Data on behalf of Customer), except where acting as a Controller for Candidate Services as defined in the Agreement.
- Customer Role: Controller (Determining the purpose and means of Processing).
1.2. Security Contact
- Provider Privacy Contact: dpo@sentiva.ai
1.3. CCPA Service Provider Status
To the extent the California Consumer Privacy Act (“CCPA”) applies, Provider acts as a “Service Provider” and shall not sell or share Personal Data. Provider certifies that it understands these restrictions and will comply with applicable data protection laws.
2. Approved Subprocessors
Customer approves the following Subprocessors to process Customer Personal Data:
| Subprocessor Name | Location of Processing | Service / Purpose |
|---|---|---|
| Microsoft Corporation (Azure) | United States | Cloud infrastructure, computing resources, and object storage. |
| Google LLC (GCP & Gemini) | United States | Cloud infrastructure and AI (LLM) processing for analysis/generation. |
| MongoDB, Inc. | United States | Managed database services for structured storage and retrieval. |
| Twilio Inc. (SendGrid) | United States | Transmission of transactional emails, notifications, and alerts. |
| Atlassian Pty Ltd (Jira) | United States | Customer support ticketing and issue tracking. |
| Functional Software Inc. (Sentry) | United States | Real-time application error tracking and performance monitoring. |
| Google LLC (Analytics) | United States | Aggregated usage metrics and platform performance data. |
| Better Stack, Inc. (Better Stack) | United States | Centralized application log collection, storage, and analysis. |
| OpenAI, L.L.C. (OpenAI) | United States | AI features. |
3. Standard Terms
3.1. Processing of Personal Data
a. Instructions: Provider will Process Customer Personal Data only to provide the Service, as documented in the Agreement, or as per Customer’s written instructions.
b. Compliance: Provider will comply with all Applicable Data Protection Laws (including GDPR and CCPA where applicable).
c. Updates: If Provider updates the Service, it may update the categories of data or processing activities by notifying Customer, provided such changes do not materially degrade security.
3.2. Subprocessor Management
a. Changes: Provider will notify Customer at least 10 business days in advance of adding/replacing a Subprocessor. Customer has 30 days to object. If Customer objects, parties will cooperate in good faith to resolve the concern.
b. Liability: Provider remains liable for the acts and omissions of its Subprocessors to the same extent as if such acts or omissions were performed by Provider itself under the Agreement, subject to the limitations of liability set forth in the Agreement and to the extent required by Applicable Data Protection Laws.
c. Emergency Subprocessors: Notwithstanding the foregoing, Sentiva may engage a new sub-processor without prior notice where required to address an immediate security, availability, or legal compliance issue, provided that Sentiva notifies Customer within 72 hours of engaging such Subprocessor.
3.3. International Transfers
a. Authorization. Customer authorizes Provider to process and transfer Personal Data to locations outside the country in which it was originally collected, to the extent necessary to provide the Services, and in accordance with Applicable Data Protection Laws.
b. Transfer Mechanisms. Where Applicable Data Protection Laws require a lawful transfer mechanism for cross-border transfers of Personal Data, the parties agree that such transfers shall be subject to appropriate safeguards recognized under those laws, which may include standard contractual clauses or equivalent mechanisms approved by a competent supervisory authority.
c. Incorporation by Reference. To the extent standard contractual clauses or similar mechanisms apply pursuant to Section 3.3(b), the parties agree that:
(i) Customer shall be deemed the “data exporter” and Provider the “data importer”;
(ii) such clauses shall be deemed incorporated into this DPA by reference; and
(iii) the required descriptions of processing, technical and organizational measures, and subprocessors shall be satisfied by the corresponding provisions of this Agreement, the Privacy Policy, and any publicly available subprocessor disclosures maintained by Provider.
d. Precedence. In the event of a conflict between this DPA and any applicable transfer mechanism incorporated pursuant to this Section 3.3, the terms of the transfer mechanism shall prevail solely to the extent required by Applicable Data Protection Laws.
3.4. Security Incident Response
Upon becoming aware of a confirmed Security Incident (Data Breach), Provider will:
a. Notify Customer without undue delay (no later than 72 hours).
b. Provide timely information about the incident.
c. Take reasonable steps to contain and investigate the incident.
3.5. Audit Rights
Provider will allow for and contribute to audits by Customer to assess compliance. Provider may satisfy this requirement by providing a summary of its latest Security Report or responding to a Security Questionnaire once per year.
3.6. Data Deletion
Upon termination of the Agreement, Provider will delete or return Customer Personal Data within sixty (60) calendar days, unless Applicable Law requires further storage.
3.7. Limitation of Liability
Liability arising from this DPA is subject to the Liability Caps and Damages Waivers set forth in the main Agreement (Order Form/Cloud Services Agreement).
3.8. Special Category Data
a. Customer Representations and Warranties. Customer represents and warrants that:
(i) It has conducted an appropriate assessment to determine whether any Personal Data submitted to the Service constitutes “special categories of personal data” as defined under Article 9 of the GDPR, or equivalent sensitive data categories under other Applicable Data Protection Laws (collectively, “Special Category Data”);
(ii) Prior to submitting any Special Category Data to the Service, Customer has established a valid legal basis for the processing of such data, which may include (as applicable): (A) explicit consent from the relevant Data Subjects; (B) processing necessary for the purposes of carrying out obligations in the field of employment and social security law; or (C) another lawful basis permitted under Article 9(2) of the GDPR or equivalent provisions of Applicable Data Protection Laws;
(iii) Customer has provided all required notices to, and obtained all required authorizations from, Data Subjects whose Special Category Data is processed through the Service; and
(iv) Customer’s instructions to Provider regarding the processing of Special Category Data shall at all times comply with Applicable Data Protection Laws.
b. Customer Obligations. Customer shall:
(i) Maintain appropriate records documenting the legal basis relied upon for the processing of Special Category Data;
(ii) Promptly notify Provider if the legal basis for processing any Special Category Data is withdrawn, revoked, or otherwise ceases to be valid; and
(iii) Cooperate with Provider to cease processing or delete any Special Category Data where the legal basis for such processing no longer exists.
c. Provider Reliance. Provider is entitled to rely on Customer’s representations, warranties, and instructions regarding Special Category Data. Provider shall have no independent obligation to verify Customer’s legal basis for processing Special Category Data, and Customer shall indemnify Provider against any claims, losses, or regulatory penalties arising from Customer’s failure to comply with this Section 3.8.
d. Limitation of Liability. Notwithstanding anything to the contrary in the Agreement, Provider shall not be liable for any claims arising from or related to Customer’s failure to obtain a valid legal basis for the processing of Special Category Data.
Annex I: Details of Processing
A. List of Parties
- Data Exporter: Customer.
- Data Importer: Provider (Sentiva).
B. Description of Processing
- Subject Matter: A cloud-based human capital management platform (ATS, HRMS, LMS) including AI-enabled capabilities for recruitment and analytics.
- Categories of Data Subjects: Customer’s employees and Candidates (end users).
- Categories of Personal Data: Name, Contact Info (email/phone), Employment Info (ID, compensation), Financial Info (bank details for payroll), Professional Info (CV/Resume), and Usage Data (IP/Device logs).
- Special Category Data: Yes. (May include diversity data, health/leave records).
- Frequency: Continuous.
Annex II: Technical and Organizational Security Measures
Provider implements the following security measures to protect Customer Personal Data:
1. Encryption
Personal Data is encrypted at rest using AES-256 standards and in transit using TLS 1.2 or higher. Where technically feasible, direct identifiers in database records are pseudonymized.
2. Confidentiality & Availability
The Service is hosted on enterprise-grade cloud infrastructure (Microsoft Azure / GCP) utilizing high-availability zones and redundant architecture to ensure continuous uptime.
3. Backup & Restoration
Automated daily backups of all production databases are maintained via provider-managed services (e.g., MongoDB Atlas). Disaster recovery procedures are in place to restore data availability in the event of a technical incident.
4. Vulnerability Assessment
Provider performs regular automated vulnerability scanning of the production environment and conducts manual code reviews prior to deployment.
5. Access Control (RBAC)
Access to production systems is restricted to authorized personnel via strong authentication mechanisms (Unique IDs, MFA). Internal access follows the “principle of least privilege.”
6. Physical Security
Provider utilizes top-tier cloud providers (Azure, GCP) that maintain ISO 27001 certified data centers with 24/7 on-site security and biometric access controls.
7. Logging & Monitoring
Centralized logging systems (e.g., Sentry, Cloud Logs) capture application errors and system activities for security monitoring and troubleshooting.
8. Data Minimization & Retention
Collection of personal data is limited to what is strictly necessary for the Service. Customer Data is retained only for the duration of the Agreement plus a standard grace period, after which it is securely deleted.