Data Processing Agreement (DPA)

Effective 2026-08-24  ·  Version 1.0-f9ce22f58e97
Operated by Akovex, Inc., a Delaware corporation. This document is not legal advice.

1. Scope and roles

This DPA forms part of the Terms of Service or Master Service Agreement between Akovex, Inc. ("Processor", "we") and the customer ("Controller", "you").

You are the controller (and, under the CCPA, the business) for all personal information you or your users upload to or generate in the Platform about your employees, job applicants, contractors, contacts, customers and meeting participants ("Customer Personal Data"). We are the processor (and, under the CCPA, the service provider).

You determine what personal information enters the Platform, for what purpose, under what lawful basis, with what notices and consents, and for how long. We process it only on your documented instructions, which consist of this DPA, the Terms, and your configuration and use of the Platform.

We will tell you if, in our opinion, an instruction infringes applicable data protection law.

2. Service-provider restrictions (CCPA/CPRA)

We will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than performing the services or as permitted by law; retain, use or disclose it outside the direct business relationship with you; or combine it with personal information received from other sources, except as permitted to perform the services or as the CCPA allows. We certify that we understand and will comply with these restrictions.

Note on the employment context. Under the CCPA, your employees, applicants and contractors are "consumers". Their data in the Platform is therefore within CCPA scope for you as the business.

3. Nature and purpose of processing

Categories of data subjects: your employees, job applicants and candidates, contractors, meeting participants (including external participants), your business contacts and leads, and your end customers.

Categories of personal data (from the schema, not a template): identity and contact details; employment records; financial account details (bank name, routing number, account number); date of birth; home address and emergency contacts; compensation and pay history; time-off records; performance scores, grades, review content and survey responses; automated assessments including hire recommendations, attrition-risk scores and compensation recommendations; audio/video recordings, transcripts, per-speaker talk-time and sentiment analysis; email content from connected mailboxes; CRM and transaction records; authentication and usage logs including IP addresses.

Special/sensitive categories. The Platform is not designed for special-category data. Financial account details and date of birth are "sensitive personal information" under the CCPA. Free-text fields (for example time-off reasons) may receive health information if your users type it; you are responsible for instructing your users not to.

4. Confidentiality

We limit access to Customer Personal Data to personnel who need it to perform the services, who are bound by confidentiality obligations, and whose access is role-restricted within the Platform.

5. Security measures (Annex A)

We implement the technical and organisational measures in Annex A. Annex A lists only measures actually in force and expressly records what is not in force, so that you can assess residual risk honestly rather than rely on a marketing claim.

6. Subprocessors

6.1 Authorisation. You give general authorisation for us to engage the subprocessors listed in Annex B.

6.2 Flow-down. We impose data protection obligations on each subprocessor no less protective than those in this DPA, and remain liable to you for their performance.

6.3 Changes. We will give at least 30 days' notice before adding or replacing a subprocessor that processes Customer Personal Data, by updating Annex B and notifying account administrators. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees.

6.4 A material caveat on AI routing. The Platform routes AI requests dynamically across providers based on task and cost. Which listed AI provider receives a given request is not fixed. All providers that may receive Customer Personal Data are listed in Annex B; you should treat the AI provider list as a set, not a single vendor.

7. Assistance to the controller

7.1 Data subject requests. We will assist you in responding to access, correction, deletion, portability, objection and automated-decision requests, taking into account the nature of processing. If a data subject contacts us directly about data you control, we will refer them to you and notify you.

7.2 What that assistance looks like in practice today.

• Deletion of an individual is currently a deactivation, not an erasure: the record is flagged archived and retained, and can be restored by an administrator. Irreversible deletion, where you require it, is performed manually by our team on written request, not by a self-service control.
• There is no automated data-subject-request intake or fulfilment tracking in the Platform.
• Export is partial. Self-service export covers projects, contacts and people only. A complete extract of a tenant's data is produced manually on request.
• We commit to completing manual requests within 30 days of your written request, and we will not represent these as automated capabilities until they are.

7.3 DPIAs and risk assessments. We will provide reasonable information to support your data protection impact assessments and, where applicable, your automated-decision risk assessments.

7.4 Automated-decision recordkeeping — a limitation you must factor in. Several jurisdictions require deployers of automated employment decision tools to retain decision records; California's FEHA regulations require four years. The Platform does not currently maintain a per-decision audit record. Our AI usage log captures provider, model, token counts and cost only, with no subject, input, output or reviewer, and the Evaluations module does not persist its output at all. We cannot presently supply the records you would need to meet that duty. A decision log is in development. Until it ships, if you are subject to those rules you must maintain your own records outside the Platform, and you must not rely on Akovex for that compliance.

7.5 Bias audits. Where your jurisdiction requires an independent bias audit of an automated employment decision tool (for example NYC Local Law 144), note that the Platform does not collect the demographic data required to compute selection rates and impact ratios. We cannot produce an audit-ready dataset from the data we hold. This is a material limitation you must factor into your deployment decision.

8. Personal data breach

We will notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, and the measures taken or proposed. We will provide reasonable assistance with your own notification obligations. You remain responsible for notifying data subjects and regulators where the law places that duty on the controller.

9. Deletion and return on termination

On termination, we will return or delete Customer Personal Data as set out in the Terms, section 15, subject to the honest limitations recorded there and in 7.2 above, and subject to retention required by law. Data persists in encrypted backups until those backups rotate out (most recent 30 retained).

10. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including Annex A and Annex B and responses to a reasonable security questionnaire, no more than once per year unless a breach or a regulator requires otherwise. We do not currently hold a SOC 2 report or ISO 27001 certificate to offer in lieu of a questionnaire. On-site or penetration-testing audits require our prior written agreement, reasonable notice, a confidentiality undertaking, and are at your cost.

11. International transfers

We process in the United States. We do not currently offer EU or UK data residency. If you intend to process EU or UK personal data in the Platform, you must tell us in advance: the Standard Contractual Clauses or UK Addendum must be executed, and certain Platform features — in particular the automated assessment features described in the Privacy Policy, section 3 — carry obligations under EU law that the Platform does not currently support. Do not enable those features for EU or UK data subjects without our written agreement.

12. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms or MSA. Where this DPA conflicts with the Terms on the processing of personal data, this DPA controls.

ANNEX A — Technical and organisational security measures

Every measure below was verified in code. Nothing is claimed that was not verified.

Expressly NOT in force. Disclosed so you can assess residual risk.

ANNEX B — Subprocessors

Authoritative as of 2026-08-24. Any subprocessor engaged and not listed here is a breach of section 6.

B.1 Infrastructure

B.2 AI model providers

Requests are routed dynamically; any of the following may receive a given request.

B.3 Meetings, recording and media

B.4 Business systems and integrations

Engaged only where the customer enables the corresponding integration.