Data Processing Agreement

Effective notice. This consolidated Data Processing Agreement is effective from September 3, 2026. It states, in the standard structure of Article 28(3) GDPR, the data-processing commitments between Scovai and each Tenant that are also reflected in Section 6 of the Companies Terms of Service. Where this DPA and the Terms conflict in respect of Personal Data, this DPA prevails as set out in Section 13.

Sub-processor notice of October 19, 2026. The features that let a Digital Employee use the tools of the Controller's organisation — its mailbox, calendar, messaging and connected apps — rely on two sub-processors listed in Section 6: UNIPILE (Unipile SAS, connection broker, processing in the European Union), which connects the mail, calendar, messaging and LinkedIn accounts a person chooses to link to a Digital Employee, and Pipedream, Inc. (connected-app gateway, processing in the United States), which carries out the calls to the apps a person chooses to connect, such as Google Drive or OneDrive. Both act only on the accounts and apps that a person deliberately connects: if none is connected, neither receives any data, and access ends when the account or app is disconnected from the Digital Employee's page. In accordance with Section 6, the Controller may object to this change until November 3, 2026 by writing to privacy@scovai.com.

This Data Processing Agreement ("DPA") forms part of the agreement between OmniSage LLC, operating the Scovai platform ("Scovai", "Processor", "we", "us"), and the organisation using the Scovai platform for recruitment, talent management and workplace purposes ("Tenant", "Controller", "you"). It governs the processing of personal data carried out by Scovai on the Tenant's behalf — of Candidates, and, where the Tenant uses the services described in Section 3.1, of its personnel and of third parties, including the data processed by Digital Employees (together, "Personal Data") — as required by Article 28 of Regulation (EU) 2016/679 ("GDPR"). Capitalised terms not defined here have the meaning given in the Companies Terms of Service ("Terms").

1. Parties and Roles

• The Tenant is the Data Controller: you determine the purposes and means of processing Personal Data for your recruitment, talent management and workplace activities, including which candidates to assess, which features and Digital Employees to use, what data to collect, and what legal basis applies.
• OmniSage LLC is the Data Processor: we process Personal Data only on your behalf and on your documented instructions, for the purpose of providing the Scovai platform as described in the Terms.

For data relating to our own website visitors, direct applicants to our talent pool, and account holders, Scovai acts as an independent data controller; that processing is governed by our Privacy Policy and is outside the scope of this DPA.

2. Subject Matter, Duration, Nature and Purpose of Processing

• Subject matter: the provision of the Scovai platform: position creation and publishing, CV parsing and semantic matching, candidate screening and shortlisting, technical, psychometric and cognitive assessments, AI-conducted and live interviews, analytics, and talent pipeline management.
• Duration: the term of the Tenant's subscription, plus the post-termination retention window described in Section 10 of this DPA.
• Nature: collection, recording, organisation, structuring, storage, analysis (including AI-assisted parsing, scoring, matching, assessment and interview evaluation), retrieval, disclosure to the Controller and its authorised users, restriction, and erasure.
• Purpose: solely the provision of the Service as described in the Terms. We will not process Personal Data for any other purpose without the Controller's prior written consent.

3. Categories of Data Subjects and Personal Data

Data subjects: Candidates, meaning individuals whose data is processed through the platform for the Tenant's recruitment purposes, whether sourced directly, via applications, or through the CV Bank.

Categories of personal data:

• Identification and contact data: name, email address, phone number, location
• CV and career data: work experience, education, skills, certifications, languages, extracted through AI-assisted CV parsing
• Assessment data: technical assessment responses, psychometric assessment results, cognitive assessment results
• Interview data: interview transcripts, responses, recordings where the Controller enables them, and generated evaluation reports
• Scoring data: AI-generated scores across multiple dimensions, with explainability rationales
• Embedding data: vector representations of CV content used for semantic matching (not human-readable)
• Platform activity data: application status, consent records, and audit trail entries relating to the Candidate

Special categories of data (Article 9 GDPR) are processed only where the Controller chooses to collect them through its own configuration of the platform. The Controller is responsible for ensuring a lawful basis for any such collection.

3.1 Digital Employee and workplace services

Where the Tenant uses a Digital Employee, the performance management module, or the meeting recording and summary features, the processing reaches people who are not Candidates, and the following applies in addition to the above.

Data subjects: the Tenant's employees, contractors and other personnel; and the clients, suppliers, candidates, colleagues and other individuals who send messages to, receive messages from, attend a meeting with, or are named in material handled by a Digital Employee.

Categories of personal data:

• Connected account content: the email, calendar, chat and messaging content of an account that a person links to a Digital Employee, including messages written by third parties to that account
• Files and documents: files in a connected storage account that the Digital Employee is asked to read or write, and files a person shares with it directly
• Meeting data: audio and video of a recorded meeting, its transcript, its summary, the action items derived from it, the in-call chat, and the names and email addresses of participants and guests
• Digital Employee records: its working memory and conversation transcripts, which are held on the machine described in Section 7, and its own mailbox
• Supervision records: approval decisions, reported activity, incidents and the standing instructions written on the seat
• Employee evaluation data: competency scorecards, review-cycle records, goals, check-ins and development plans, including the qualitative layer generated by an AI model

Because the Tenant chooses which accounts to connect and what to ask of a Digital Employee, these categories may include any category of personal data, including special categories. The Tenant must not connect an account that holds special-category data, or ask a Digital Employee to handle it, without its own lawful basis under Article 9 and its own assessment of the risk.

The Controller's duties for these services. The Tenant informs its personnel about the processing, and where national law requires it, informs or consults their representatives or works council before enabling recording, monitoring or evaluation features. The Tenant gives the information required by Articles 13 and 14 GDPR to third parties whose data a Digital Employee handles. The Tenant decides the retention of Digital Employee and meeting records within the periods described in Section 10 and on the Privacy Policy. Scovai assists as described in Section 8.

4. Processor Obligations

Scovai will:

• process Personal Data only on the Controller's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in that case, we will inform the Controller of that legal requirement before processing, unless the law prohibits it;
• ensure that persons authorised to process Personal Data are bound by confidentiality obligations;
• not use Personal Data for marketing purposes, not sell or license it to third parties, and not use individual Personal Data, including the content a Digital Employee handles, to train or fine-tune AI models;
• assist the Controller as described in Sections 8 and 9 of this DPA;
• provide reasonable assistance to the Controller in complying with its obligations under Articles 35 and 36 GDPR (data protection impact assessments and prior consultation with supervisory authorities), taking into account the nature of processing and the information available to Scovai;
• delete or return personal data at the end of the provision of services as described in Section 10;
• make available the information necessary to demonstrate compliance as described in Section 11;
• inform the Controller immediately if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

5. Security Measures (Article 32 GDPR)

Scovai implements appropriate technical and organisational measures to protect Personal Data, including:

• TLS encryption (TLS 1.2/1.3) for all data in transit
• AES-256 encryption of API keys and sensitive credentials at rest: GCM for Digital Employee credentials, CBC for AI provider keys, connected-inbox tokens and contract-signing tokens. We do not claim encryption of the database or of uploaded files at rest beyond this.
• Argon2 password hashing
• JWT-based authentication with access and refresh tokens
• Role-based access control (RBAC) with logical isolation of each Tenant's data
• Comprehensive audit logging of platform actions, accessible to the Controller through the platform audit trail
• Pseudonymised vector embeddings for semantic matching that are not human-readable and cannot be reversed to reconstruct the original CV text
• Regular security assessments

Personal Data is stored on servers provided by Contabo GmbH in a data centre in France, within the European Economic Area, except for the data of a Digital Employee in the Middle East region, described in Section 7. Details of our data-protection-by-design measures are described in our GDPR Policy.

6. Sub-Processing

The Controller grants Scovai a general authorisation to engage the sub-processors listed below. Scovai engages each of them under that provider's applicable terms and, where a data-processing agreement is in force, under that agreement; the Safeguards column states which applies to each. Scovai remains liable to the Controller for the performance of each sub-processor's obligations.

Digital Employee execution. A Digital Employee runs in its own virtual machine, in the processing region the Controller chooses. In the European region the machine runs on servers provided by Contabo GmbH in France, listed above. In the Middle East region it runs on servers owned and operated by OmniSage LLC, located in the data centre at 2704 Fortune Executive Tower, Cluster T, Jumeirah Lakes Towers (JLT), Dubai, United Arab Emirates; no third-party hosting provider holds or operates those machines or the mailboxes attached to them, so the hosting of a Digital Employee in that region adds no sub-processor. In either region its execution does rely on the model providers and the connected-app gateway listed above, each of which is a sub-processor, and on the processing locations stated in Section 7. Any change to that set is notified in advance with the right to object described below.

Changes to sub-processors. We will notify the Controller in advance before engaging a new sub-processor that handles Personal Data, giving the Controller the opportunity to object within 15 days of the notice. If an objection cannot be resolved, the Controller may suspend or terminate the affected part of the Service in accordance with the Terms. The current sub-processor list is available on request at privacy@scovai.com.

7. International Data Transfers

The Scovai platform, its database and uploaded files are stored on servers provided by Contabo GmbH in a data centre in France, within the European Economic Area.

A Digital Employee runs in the processing region the Controller chooses, and the Controller should read this paragraph before connecting one. In the European region, the virtual machine runs on servers provided by Contabo GmbH in France, within the European Economic Area, and the language model it calls is Anthropic, OpenAI or a provider routed through OpenRouter, listed in Section 6. In the Middle East region, the virtual machine runs on servers owned and operated by OmniSage LLC, located outside the European Economic Area, in the data centre at 2704 Fortune Executive Tower, Cluster T, Jumeirah Lakes Towers (JLT), Dubai, United Arab Emirates, and the language model it calls processes that material at an endpoint in the People's Republic of China, with a fallback in Japan. In either region that machine holds the Digital Employee's working memory, its conversation transcripts, the files shared with it and its mailbox, and the connected-app gateway processes requests in the United States. Digital Employees connected before the European region opened run in the Middle East region; a Controller that prefers the European region for them may ask at privacy@scovai.com.

Transfers of Personal Data to the recipients listed in Section 6 that are located outside the EEA, other than in a country covered by a European Commission adequacy decision as indicated in Section 6, are to be covered by the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor) or, where Scovai acts as processor, Module Three (Processor to Processor), as amended or replaced from time to time. Scovai is completing the execution of those clauses, and the related transfer impact assessments, with each such recipient. The current status for each recipient is available to the Controller on request at privacy@scovai.com. No third-party hosting provider holds or operates the machines in the United Arab Emirates on which Digital Employees in the Middle East region run. Material changes to processing locations or transfer mechanisms are notified in advance, with the right to object described in Section 6.

8. Assistance with Data Subject Rights

Taking into account the nature of the processing, Scovai assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to data subject requests under Articles 12 to 23 GDPR:

• Access and rectification: Candidates can view and edit their profile data directly; the Controller can export Candidate data via the compliance module.
• Erasure and restriction: data deletion requests and per-candidate processing restrictions can be initiated through the compliance module, with full audit logging.
• Portability: data can be exported in structured JSON format via the compliance module or API.
• Automated decision-making: human review requests can be submitted for any AI-generated assessment or score, and every AI-generated score includes an explainability rationale to support Article 22 safeguards.

If a data subject contacts Scovai directly with a request concerning processing carried out on the Controller's behalf, we will forward the request to the Controller without undue delay and execute the Controller's resulting instructions.

9. Personal Data Breach Notification

In the event of a personal data breach affecting Personal Data, Scovai will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach, providing the information necessary for the Controller to fulfil its own notification obligations under Articles 33 and 34 GDPR, including the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it. Breaches are documented in an internal breach register.

10. Return and Deletion of Personal Data

Termination of a subscription changes the Tenant's plan; it is not a closure, and no data is deleted by it. On the Controller's written request to close the workspace, we record the date of the request, retain the workspace data for 90 days so that the Controller can export it, and then delete or anonymise the personal data processed on the Controller's behalf, except where retention is required by law. Deletion is performed by a named person rather than by an automatic job, so that it can be confirmed in writing, and the Controller may ask for it sooner. Interview recordings are deleted automatically 90 days after the interview, and live meeting recordings 180 days after the meeting. Transcripts, summaries and action items are kept until the Tenant deletes the interview or the meeting, or the workspace is deleted. Written confirmation of deletion is available on request.

11. Audit and Demonstration of Compliance

Scovai makes available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, on a documentation-first basis: technical documentation, relevant logs, and access to technical contacts. In addition, the Controller may conduct audits or inspections under Article 28(3)(h) GDPR, provided that they:

• are requested in writing at least 15 days in advance;
• take place during normal business hours;
• do not exceed one audit per calendar year, unless required following a personal data breach or by a supervisory authority;
• are conducted by auditors bound by confidentiality obligations;
• do not include destructive testing, load testing, or security scanning without prior written approval.

12. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Companies Terms of Service. Nothing in this DPA limits any liability that cannot be limited under applicable law, or affects the rights that data subjects hold directly under the GDPR.

13. Final Provisions

• Precedence: in the event of a conflict between this DPA and the Terms with respect to the processing of Personal Data, this DPA prevails.
• Third parties: this DPA does not create third-party beneficiary rights; data subjects retain the rights granted to them directly by the GDPR.
• Governing law: this DPA is governed by the law applicable to the Terms; where the Controller is established in the European Union, the mandatory provisions of EU law, including the GDPR, apply.
• Contact: privacy@scovai.com for any question about this DPA or our data-processing commitments.