Data Processing Addendum

This Data Processing Addendum is supplemental to and forms part of GoHire’s Terms of Service found on GoHire’s website at www.gohire.io/terms (“Agreement”), between GoHire Technologies Ltd (“GoHire”) and the customer entity that is party to the Agreement (“Data Controller”).

In consideration of the mutual rights and obligations adopted in this addendum and in further consideration of the mutual rights and obligations in the Agreement, GoHire and the Data Controller hereby agree as follows:

4.1. GoHire shall ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Protected Data and against accidental loss or destruction of, or damage to, Protected Data, which is appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it) so as to allow the Data Controller to comply with its obligations under the Data Protection Legislation.

5.1. The Data Controller hereby provides its prior, general authorisation for GoHire to appoint processors to process the Protected Data, including initially those sub-processors set out in Part B, provided that GoHire:

5.2. shall ensure that the terms on which it appoints such processors comply with the Data Protection Legislation, and are consistent with the obligations imposed on GoHire in this

5.3. shall remain responsible for the acts and omission of any such processor as if they were the acts and omissions of GoHire;

5.4. shall inform the Data Controller of any intended changes concerning the addition or replacement of the processors, thereby giving the Data Controller the opportunity to object to such changes provided that if the Data Controller objects to the changes and cannot demonstrate, to GoHire’s reasonable satisfaction, that the objection is due to an actual or likely breach of the Data Protection Legislation, the Data Processor shall indemnify GoHire for any losses, damages, costs (including legal fees) and expenses suffered by GoHire in accommodating the objection.

5.5. GoHire shall ensure that all persons authorised by GoHire (or any authorised sub-processor) to process Protected Data are subject to a binding written contractual obligation to keep the Protected Data confidential.

6.1. GoHire shall:

6.2. notify the Data Controller without undue delay if it receives from any Data Subject whose Personal Data forms part of the Protected Data any communication seeking to exercise rights conferred on the Data Subject by the Data Protection Legislation, or any complaint or any claim for compensation arising from or relating to the processing of the Protected Data;

6.3. provide such information and such assistance to the Data Controller as the Data Controller may reasonably require insofar as this is reasonably possible (taking into account the nature of the processing and the information available to GoHire), and at the Data Controller’s cost, to allow the Data Controller to comply with its obligations under the Data Protection Legislation, including to:

6.3.1 assist the Data Controller in ensuring compliance with the Data Controller’s obligations pursuant to Articles 32 to 36 of the UK GDPR (and any similar obligations under applicable Data Protection Legislation);

6.3.2 assist the Data Controller (by appropriate technical and organisational measures), insofar as this is reasonably possible, for the fulfilment of the Data Controller’s obligations to respond to requests for exercising a Data Subjects’ rights under Chapter III of the UK GDPR (and any similar obligations under applicable Data Protection Legislation) in respect of any Protected Data.

7.1. The Data Controller hereby provides its prior, general authorisation for GoHire to transfer Protected Data outside of the UK, provided that GoHire shall ensure that all such transfers are affected in accordance with the Data Protection Legislation. For these purposes, the Data Controller shall promptly comply with any reasonable request of GoHire, including any request to enter into standard data protection clauses adopted by the Information Commissioner from time to time (where the UK GDPR applies to the transfer.

8.1. GoHire shall keep or cause to be kept such information as is necessary to demonstrate compliance with its obligations under this addendum including full and accurate records relating to the processing of the Protected Data and shall, upon reasonable notice, make available to the Data Controller or grant to the Data Controller and its auditors and agents, a right of access to and to take copies of any information or records kept by GoHire pursuant to this paragraph.

Processing of the Protected Data by the Data Processor under this addendum shall be for the subject-matter, duration, nature and purposes and involve the types of personal data and categories of Data Subjects set out in this Part A.

1 Subject-matter of processing:

Provision of an online recruiting solution that distributes job advertisements, as described further in the Agreement

2 Duration of the processing:

Personal Data will be retained for twelve months unless the Data Controller has stipulated otherwise.

3 Nature and purpose of the processing:

The collection, recording, processing and erasure of the Protected Data to comply with the Data Processor’s obligations in the Agreement

4 Type of Personal Data:

Name, Email, Phone Number, IP Address, Resume/CV, Work History, and Responses to Screening Questions of applicants using GoHire’s website to apply for employment with or hire by the Data Controller

5 Categories of Data Subjects:

Website Visitors

Job Applicants

Trialists

Customers