Screenloop Data Processing Addendum to SAAS Terms & Conditions


Last updated: 13 July 2021

Contents

Data Processing Addendum

- Exhibit 1: Details of the Personal Data and Processing Activities

- Exhibit 2: 2010 EU Model clauses

- - Appendix 1 to the Standard Contractual Clauses

- - Appendix 2 to the Standard Contractual Clauses

Sub-Processor List

Data Processing Addendum

This Data Processing Addendum along with the exhibits thereto (collectively referred to as “DPA”) supplements the agreement signed by and between Screenloop Ltd (“Screenloop”) and the Customer (the “Agreement”).

This DPA contains terms to ensure that adequate safeguards are in place with respect to the protection of Personal Data to be processed by Screenloop pursuant to the Agreement, as required by the Applicable Data Protection Laws. Any terms not defined in this DPA shall have the meaning set forth in the Agreement. Except as modified below, this DPA automatically expires upon deletion of all Personal Data as described in herein.

THIS DATA PROCESSING ADDENDUM will take effect as of the Effective Date of the Agreement, between Customer and Screenloop.

 

1. Definitions

1.1 The following expressions are used in this DPA:

(a) "Adequate Country" means a country or territory that is recognized under EU Data Protection Laws from time to time as providing adequate protection for Personal Data;

b) "Customer Group" means Customer and any corporate entities which are from time to time:

        (a) under Common Control with Customer; and

        (b) established and/or doing business in the European Economic Area or Switzerland;

(c) "EU Data Protection Laws" means all laws and regulations, including laws and regulations of the European Union, the European Economic Area, their member states and the United Kingdom, applicable to the processing of Personal Data under the SaaS Terms & Conditions, including (where applicable) the GDPR;

(d) "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (known as the General Data Protection Regulation);

(e) "Personal Data" means all data which is defined and regulated as ‘Personal Data’ in the EU Data Protection Laws and which is provided by Customer to Screenloop or accessed, stored or otherwise processed by Screenloop in connection with the Screenloop Services;

(f) "processing", "data controller", "data subject", "supervisory authority" and "data processor" will have the meanings ascribed to them in the EU Data Protection Laws.

1.2 An entity "Controls" another entity if it: (a) holds a majority of the voting rights in it; (b) is a member or shareholder of it and has the right to remove a majority of its board of directors or equivalent managing body; (c) is a member or shareholder of it and controls alone or pursuant to an agreement with other shareholders or members, a majority of the voting rights in it; or (d) has the right to exercise a dominant influence over it pursuant to its constitutional documents or pursuant to a contract; and two entities are treated as being in "Common Control" if either controls the other (directly or indirectly) or both are controlled (directly or indirectly) by the same entity.

2. Status of the Parties

2.1 The type of Personal Data processed pursuant to this Addendum and the subject matter, duration, nature and purpose of the processing, and the categories of data subjects, are as described in Exhibit 1.

2.2. As between the parties, Customer is solely responsible for obtaining, and represents and covenants that it has obtained and will obtain, all necessary consents, licenses and approvals for the processing, or otherwise has a valid legal basis under EU Data Protection Laws for the Processing of any Personal Data as part of the Services (the “Customer Legal Basis Assurance”). Each of Customer and Screenloop warrant in relation to Personal Data that it will comply with (and will ensure that any of its staff and/or subcontractors comply with), the EU Data Protection Laws; provided, however, that Screenloop’s warranty is subject to Customer Legal Basis Assurance.

2.3. In respect of the parties' rights and obligations under this DPA regarding the Personal Data, the parties hereby acknowledge and agree that Customer is the Data Controller and Screenloop is the Data Processor and accordingly Screenloop agrees that it will process all Personal Data in accordance with its obligations pursuant to this DPA.

2.4 Each of Screenloop and Customer will notify to each other one or more individuals within its organisation authorised to respond from time to time to enquiries regarding the Personal Data and each of Screenloop and Customer will deal with such enquiries promptly.

3. Screenloop Obligations

3.1. With respect to all Personal Data, Screenloop agrees that it will:

(a) only process the Personal Data in order to provide the Services and will act only in accordance with this Agreement and Customer's written instructions. The terms of the Agreement and this DPA, constitute the Customer’s written instructions to Screenloop in relation to the processing of Personal Data. For the avoidance of doubt, the Customer can issue further instructions for processing at any time;

(b) in the unlikely event that Applicable Law requires Screenloop to process Personal Data other than pursuant to Customer's instructions, Screenloop will immediately notify the Customer (unless prohibited from so doing by Applicable Law);

(c) without delay after becoming aware, inform the Customer if, in Screenloop's opinion, any instructions provided by the Customer under Clause 3.1(a) infringe the GDPR;

(d) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks that are presented by the processing, in particular protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data in Screenloop’s possession or under its control. Such measures include the security measures specified in Screenloop’s information security policies.

(e) ensure that its personnel have access to such Personal Data only as necessary to perform the Screenloop Services in accordance with the Agreement and this DPA, and that any persons whom it authorises to have access to the Personal Data are under obligations of confidentiality and will adhere with the Agreement and this DPA;

(f) without delay after becoming aware and in any case within twenty-four (24) hours, notify the Customer of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data in Screenloop’s possession or under its control (including when transmitted, stored or otherwise processed by Screenloop) (a "Security Breach");

(g) taking into account the nature of the processing, promptly provide the Customer with reasonable cooperation and assistance in respect of the Security Breach and information in Screenloop's possession concerning the Security Breach, including, to the extent known to Screenloop, the following:

(i) the nature of the Security Breach;

(ii) the categories and approximate number of data subjects concerned;

(iii) the categories and approximate number of Personal Data records concerned;

(iv) the likely consequences of the Security Breach;

(v) a summary of the unauthorised recipients of the Personal Data; and

(vi) the measures taken or proposed to be taken by Screenloop to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects;

(h) insofar as a Security Breach relates to Customer, not make any announcement about a Security Breach (a "Breach Notice") without:

(i) the prior written consent from Customer; and

(ii)prior written approval by the Customer of the content, media and timing of the Breach Notice;

unless required to make a disclosure or announcement by applicable law.

(i) Screenloop will return or delete Customer’s Personal Data within fourteen (14) days of termination or expiration of the Term. Screenloop shall comply with all directions provided by the Customer with respect to the return or disposal of Personal Data. This requirement shall not apply to the extent Screenloop is required by any EU (or any EU Member State) law to retain some or all of the Personal Data, in which event Screenloop shall isolate and protect the Personal Data from any further processing except to the extent required by such law.  

(j) assist the Customer when reasonably requested in relation to Customer’s obligations under EU Data Protection Laws with respect to:

(i) data protection impact assessments (as such term is defined in the GDPR);

(ii) subject access requests;

(iii) notifications to the supervisory authority under EU Data Protection Laws and/or communications to data subjects by the Customer in response to any Security Breach; and

(iv) Customer’s compliance with its obligations under the GDPR with respect to the security of processing.

     

(k) assist the Customer by appropriate technical and organizational measures, insofar as this is possible, to respond to data subjects’ requests to exercise their rights under Chapter III of the GDPR. Screenloop will promptly notify the Customer (and in any case within twenty-four (24) hours of requests received by Screenloop, unless otherwise required by applicable law. Screenloop will not make changes to such data except as agreed in writing with Customer.

(l) Maintain records of its processing activities as required by Article 30.2 of the GDPR and to demonstrate its compliance with this DPA and make such records available to the applicable supervisory authority and/or the Customer upon request.

4. Sub-processing

4.1 The Customer consents to Screenloop’s use of sub-processors to provide aspects of the Screenloop Services, and to Screenloop’s disclosure and provision of Personal Data to those sub-processors for the provision of the Services. Screenloop will require its sub-processors to comply with terms that provide substantially the same protection of Personal Data than those imposed on Screenloop in the Agreement and this DPA. Screenloop will be liable for all the acts and omissions of its sub-processors in relation to the Agreement and this DPA. Screenloop publishes a list of its then-current sub-processors (“Sub-Processor List”, see below). When any new sub-processor is engaged, Screenloop will provide at least fourteen (14) business days’ notice before the new sub-processor processes any Personal Data and add them to the Sub-Processor List.

4.2 Screenloop may authorise new sub-processors, provided that the new sub-processor only processes Personal Data in connection with the provision of Screenloop Services and Screenloop will update the list of all sub-processors engaged to process Personal Data under this Agreement published in the Sub-Processor List or make such updated version available to the Customer prior to such authorisation of the sub-processor.

4.3 If the Customer objects to the authorisation of any future sub-processor on reasonable data protection grounds, and if Screenloop is unable to provide an alternative or workaround to avoid processing of Personal Data by the objected to sub-processor to the satisfaction of the Customer within a reasonable period of time, not to exceed 7 days from receipt of the objection, then the Customer may elect to terminate the Agreement. Should the Customer terminate this Agreement in accordance with this paragraph 4.3 then the Customer shall receive a refund of all fees paid for Services and/or Support Services not provided as of the date of termination.

5. Audit and Records

5.1 Screenloop will, in accordance with EU Data Protection Laws, make available to the Customer such information in Screenloop's possession or control as the Customer may reasonably request with a view to demonstrating Screenloop's compliance with the obligations of data processors under EU Data Protection Law in relation to its processing of Personal Data.

5.2 The Customer may exercise its right of audit under EU Data Protection Laws, through Screenloop providing additional information in Screenloop's possession or control to an EU supervisory authority when it requests or requires additional information in relation to the data processing activities carried out by Screenloop under this DPA.

6. Data Transfers

6.1 The Customer will ensure that the Customer and Customer’s authorised Users are entitled to transfer the Personal Data to Screenloop so that Screenloop, and its sub-processors, may lawfully process the Personal Data in accordance with this DPA.

6.2 The Customer acknowledges that the provision of the Services under the SaaS Terms & Conditions may require the processing of Personal Data by sub-processors in countries outside the EEA from time to time.

6.3 To the extent any processing of Personal Data by Screenloop and its sub-processors take place in any country outside the EEA (other than exclusively in an Adequate Country), the parties agree that the Standard Contractual Clauses approved by the EU authorities under EU Data Protection Laws and set out in Exhibit 2, and as updated from time to time, will apply in respect of that processing and Screenloop will comply with the obligations of the ‘data importer’ in the European Union Standard Contractual Clauses and the Customer will comply with the obligations of 'data exporter'. By entering into this DPA, the Parties are deemed to be signing the European Union Standard Contractual Clauses, as updated from time to time, and its applicable Appendices. The parties agree to enter into any updated Standard Contractual Clauses as approved by the EU authorities under EU Data Protection Laws.

6.4 Should the European Union Standard Contractual Clauses or other method applied for cross-border processing under Clause 6.3 cease to be a lawful means of transferring the Personal Data, the parties shall comply with any alternative lawful method of transfer required and complete any documentation required for such alternative lawful method of transfer.

6.5 The following terms will apply to the European Union Standard Contractual Clauses set out in Exhibit 2 (whether used pursuant to clause 6.1 or 6.3(a)) and as updated from time to time:

     (a) The Customer may exercise its right of audit under clause 5.1(f) of the Standard Contractual Clauses as set out in, and subject to the requirements of, clause 5.2 of this DPA; and

     (b) The data importer may appoint sub-processors as set out, and subject to the requirements of, clauses 4 and 6.3 of this DPA.

7. General

7.1 This DPA is without prejudice to the rights and obligations of the parties under the Agreement which will continue to have full force and effect. This DPA is incorporated into and made a part of the Agreement by this reference. In the event of any conflict between the terms of this DPA and the terms of the SaaS Terms & Conditions, the terms of this DPA will prevail so far as the subject matter concerns the processing of Personal Data.

7.2 The Customer and Screenloop each agree that any dispute resolution provisions of the Agreement (including governing law and venue) apply to this DPA.

---

Exhibit 1

Details of the Personal Data and Processing Activities

1. The processing will comprise the following: as necessary for the provision of the Services including the integration process between the Customer’s video conferencing solution(s) (VCS) and/or applicant tracking system (ATS) and the Screenloop platform. The Customer follows a simple setup process to to authorize access to the aforementioned integrations. Once the ATS integration has been activated the Screenloop platform will collect data to auto-populate data fields i) related to the applicant’s first name, last name, email, role, interview stage, interview location/URL, and interview dates and ii) fields related to the jobs, including name, and department on its platform and iii) fields related to the interviewers’ name and email. Activity and usage data is also collected for technical/troubleshooting purposes as well as to generate interviewer coaching insights and decision maker insights for the Customer. Once the VCS integration has been activated the Screenloop platform will collect data i) related to the meeting attendance, including participant names, emails, join and leaving times and ii) the recordings of the meeting including audio, video, transcript and related recording metadata if available. The collected data will be used to generate interview insights, coaching tips, and link interview transcripts and recordings to interviews.

2. The duration of the processing will be: until expiration or termination of the Agreement.

3. The purpose(s) of the processing is: the provision of the Services, pursuant to the Agreement.

4. Categories data subjects are: interview candidates of the Customer and other data subjects with respect to whom the Customer elects to collect their personal data, and the Customer’s and the Customer Group members’, and their service providers, employees, consultants, agents and representatives authorised by the Customer to use the Services.

5. Type of personal data: name, email address, employer name, IP addresses, and any personal data the Customer’s Users may record using Screenloop’s functionality to make notes during an interview.

---

Exhibit 2

2010 EU Model clauses extracted from 2010/87/EU Annex EU Standard Contractual Clauses for the transfer of personal data to data processors established in third countries which do not ensure an adequate level of data protection

INTRODUCTION

Both parties have agreed on the following Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

AGREED TERMS
1. Definitions

For the purposes of the Clauses:

     (a) "personal data", "special categories of data", "process/processing", "controller", "processor", "data subject" and "supervisory authority" shall have the same meaning as in EU Data Protection Laws 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

     (b) the "data exporter" means the entity who transfers the personal data;

     (c) the "data importer" means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of EU Data Protection Laws 95/46/EC;

     (d). the "sub-processor" means any processor engaged by the data importer or by any other sub- processor of the data importer who agrees to receive from the data importer or from any other sub-processor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;

     (e) the "applicable data protection law" means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established; and

     (f) "technical and organisational security measures" means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

2. Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

3. Third-party beneficiary clause

3.1 The data subject can enforce against the data exporter this Clause, Clause 4.1(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

3.2 The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

3.3 The data subject can enforce against the sub-processor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the sub- processor shall be limited to its own processing operations under the Clauses.

3.4 The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

4. Obligations of the data exporter

4.1 The data exporter agrees and warrants:

     (a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;

     (b) that it has instructed and throughout the duration of the personal data-processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;

     (c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;

     (d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

     (e) that it will ensure compliance with the security measures;

     (f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of EU Data Protection Laws 95/46/EC;

     (g) to forward any notification received from the data importer or any sub-processor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;

     (h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for sub-processing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;

     (i) that, in the event of sub-processing, the processing activity is carried out in accordance with Clause 11 by a sub- processor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and that it will ensure compliance with Clause 4(a) to (i).

5. Obligations of the data importer

5.1 The data importer agrees and warrants:

     (a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

     (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

     (c) that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;

     (d) that it will promptly notify the data exporter about:

        (i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;

        (ii) any accidental or unauthorised access; and

        (iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;

     (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;

     (f) at the request of the data exporter to submit its data-processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

     (g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for sub-processing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;

     (h) that, in the event of sub-processing, it has previously informed the data exporter and obtained its prior written consent;

     (i) that the processing services by the sub-processor will be carried out in accordance with Clause 11;

     (j) to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the data exporter.

6. Liability

6.1 The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive compensation from the data exporter for the damage suffered.

6.2 If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his sub-processor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own liabilities.

6.3 If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the sub-processor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees that the data subject may issue a claim against the data sub-processor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the sub-processor shall be limited to its own processing operations under the Clauses.

7. Mediation and jurisdiction

7.1 The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

     (a) to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

     (b) to refer the dispute to the courts in the Member State in which the data exporter is established.

7.2 The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

8. Co-operation with supervisory authorities

8.1 The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

8.2 The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

8.3 The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any sub-processor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5(b).

9. Governing law

The Clauses shall be governed by the governing law of the Member State in which the data exporter is established.

10. Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

11. Sub-processing

11.1 The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on the data importer under the Clauses. Where the sub-processor fails to fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the sub-processor’s obligations under such agreement.

11.2 The prior written contract between the data importer and the sub-processor shall also provide for a third- party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the sub-processor shall be limited to its own processing operations under the Clauses.

11.3 The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the law of England and Wales.

11.4 The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5.1(j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.

12. Obligation after the termination of personal data-processing services

12.1 The parties agree that on the termination of the provision of data-processing services, the data importer and the sub-processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

12.2 The data importer and the sub-processor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data-processing facilities for an audit of the measures referred to in paragraph

___

Appendix 1 to the Standard Contractual Clauses

This Appendix forms part of the Clauses and is agreed to upon acceptance of the Agreement.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.

Data exporter

The data exporter is (please specify briefly your activities relevant to the transfer):

An entity that has executed the EU Standard Contractual Clauses as a data exporter and that uses the data importer’s Services.

Data importer

The data importer is (please specify briefly activities relevant to the transfer):

An entity which provides the Services to the data exporter.

Data subjects

The personal data transferred concern the following categories of data subjects (please specify):

See Exhibit 1 of the DPA.

Categories of data

The personal data transferred concern the following categories of data (please specify):

See Exhibit 1 of the DPA.

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data:

No transfer of special categories is anticipated.

Processing operations

The personal data transferred will be subject to the following basic processing activities (please specify):

The objective of the processing of Personal Data by Screenloop is to provide the Service, pursuant to the Agreement.

---

Appendix 2 to the Standard Contractual Clauses

This Appendix forms part of the Clauses and is agreed to upon acceptance of the Agreement.

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

VIRTUAL ACCESS CONTROL

Technical and organisational measures to prevent data processing systems from being used by unauthorised persons include:

* Only using well-established, reputable software/infrastructure such as AWS;

* User identification and authentication procedures;

* ID/password security procedures (special characters, minimum length, change of password);

* Password managers;

* Automatic blocking (e.g. password or timeout);

* Owner policy for each application storing/processing data;

* Monitoring of break-in-attempts and automatic turn-off of the user ID upon several erroneous passwords attempts;

* Creation of one master record per user.

DATA ACCESS CONTROL

Technical and organisational measures to ensure that persons entitled to use a data processing system gain access only to such customer data in accordance with their access rights, and that customer data cannot be read, copied, modified or deleted without authorisation, include:

* Paperless policy i.e. digital data only;

* Only using well-established, reputable software/infrastructure such as AWS;

* Internal policies and procedures;

* Control authorisation schemes;

* Differentiated access rights (profiles, roles, transactions and objects);

* Monitoring and logging of accesses;

* Disciplinary action against employees who access customer data without authorisation;

* Change procedure;

* Deletion procedure;

* Encryption.

DISCLOSURE CONTROL

Technical and organisational measures to ensure that customer data cannot be read, copied, modified or deleted without authorisation during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities customer data are disclosed, include:

* Encryption/tunneling;

* Monitoring and logging;

* Paperless policy;

* Control authorisation procedures.

ENTRY CONTROL

Technical and organisational measures to monitor whether data have been entered, changed or removed (deleted), and by whom, from data processing systems, include:

* Access control (see Virtual Access Control and Data Access Control);

* Logging and reporting systems;

* Audit trails and documentation.

AVAILABILITY CONTROL

Technical and organisational measures to ensure that customer data are protected against accidental destruction or loss (physical/logical) include:

* Only using well-established, reputable software/infrastructure such as AWS;

* Backup procedures;

* Remote storage;

* Anti-virus/firewall systems.

SEPARATION CONTROL

Technical and organisational measures to ensure that customer data collected for different purposes can be processed separately include:

* Need-only storage of data;

* Separation of databases/processing infrastructure;

* Segregation of functions (e.g. production/testing.);

* Procedures for storage, amendment, deletion, transmission of data for different purposes.

___

Sub-Processor List

Permitted Sub-Processor:

Google Cloud Computing Services

Details of this Sub-Processor:

A company incorporated in the United States registered office is 1600 Amphitheatre Parkway. Mountain View, CA 94043, USA

Details of the processing of Protected Data which may be undertaken by this Sub-Processor:

Transcriptions will be taken on behalf of Screenloop

Subject matter of the processing:

Processing personal data owned or licenced by Controller of interviews for the purposes of speech recognition, recording analytics, interview insights, and customer analytics processing to the Controller by the Processor and sub-processed by Sub-Processor

Duration of the processing:

Processing shall begin when an interview is initiated until the interview is transcribe and its analytics and insights are processed

Nature and purposes of the processing:

Collecting and processing for the purposes of allowing the Controller to provide interview insights and transcript

Type of Personal Data:

Names, Email Addresses, and personal data contained in communications customers send or receive through Screenloop

Categories of Data Subject:

Personal Data

-

Permitted Sub-Processor:

Amazon Web Services EMEA SARL (“AWS Europe”)

Details of this Sub-Processor:

A company incorporated in Luxembourg whose registered office is at 5 Rue Plaetis, 2338 Luxembourg.

Subject matter of the processing:

Processing personal data owned or licenced by Controller of interviews for the purposes of delivering coaching tips, and analytics on the hiring process to the Controller by the Processor and sub-processed by Sub-Processor

Duration of the processing:

Processing shall begin when the service has started will continue indefinitely throughout duration of the service

Nature and purposes of the processing:

Collecting, sorting and transferring for the purposes delivering the Software as a Service Screenloop platform

Type of Personal Data:

Names, Email Addresses, user IP, and personal data contained in communications customers send or receive through Screenloop

Categories of Data Subject:

Personal Data

-

Permitted Sub-Processor:

Postmark, (Wildbit, LLC)

Details of this Sub-Processor:

A company incorporated in the United States whose registered office is at 225 Chestnut St., Philadelphia, PA, 19106

Subject matter of the processing:

Collecting, sorting and transferring for the purposes of allowing the Processor to send email notifications to customers in regards to interview recording, and insights, receiving notifications from the Screenloop platform ie. Email notifying that an interview is available

Duration of the processing:

Processing shall begin when the service has started and will continue indefinitely throughout duration of the service

Nature and purposes of the processing:

Collecting, sorting and transferring for the purposes delivering the Software as a Service Screenloop platform

Type of Personal Data:

Names, Email Addresses, Interview Notes

Categories of Data Subject:

Personal Data

-

Permitted Sub-Processor:

Segment

Details of this Sub-Processor:

A company incorporated in the United States whose registered office is at 100 California Street Suite 700 San Francisco, CA 9411

Subject matter of the processing:

Collecting, sorting and transferring for the purposes of allowing the Processor to gather event data across platforms about the Controller to conduct marketing, research and development, and analytics

Duration of the processing:

Processing shall begin when the service has started and will continue indefinitely throughout the duration of the service

Nature and purposes of the processing:

Collecting, sorting and transferring for the purposes of allowing the Controller to gather event data

Type of Personal Data:

Names, Email Addresses, IP address

Categories of Data Subject:

Personal Data

-

Permitted Sub-Processor:

Algolia

Details of this Sub-Processor:

A company incorporated in the United Kingdom whose registered office is at 14 New St, London EC2M 4HE

Subject matter of the processing:

Collecting, sorting and transferring for the purposes of allowing the Controller to search data owned or licenced by Controller

Duration of the processing:

Processing shall begin when the service has started and will continue indefinitely throughout the duration of the service

Nature and purposes of the processing:

Collecting, sorting and transferring for the purposes of allowing the Controller to index and search across interviews, candidates, and jobs.

Type of Personal Data:

Names, Email Addresses, and personal data contained in communications customers send or receive through Screenloop

Categories of Data Subject:

Personal Data

-

Permitted Sub-Processor:

Intercom

Details of this Sub-Processor:

A company incorporated in Ireland whose registered office is at 2nd Floor, Stephen Court, 18-21 Saint Stephen's Green

Subject matter of the processing:

Collecting, sorting and transferring for the purposes of allowing the Controller to conduct marketing, research and development, and analytics

Duration of the processing:

Processing shall begin when the service has started and will continue indefinitely throughout the duration of the service

Nature and purposes of the processing:

Collecting, sorting and transferring for the purposes of allowing Screenloop to communicate with Customer via Chat or Email

Type of Personal Data:

Names, Email Addresses, and personal data contained in communication to and with Screenloop

Categories of Data Subject:

Personal Data