Data Processing Agreement

This Agreement is concluded between

the Account Owner as defined in our Terms of Service — the customer that uses the CometHire platform and determines the purposes and means of the processing of personal data described here (the "Controller"),

and

CometHire UG (haftungsbeschränkt), Hermannstraße 91, 12051 Berlin, Germany, registered at Amtsgericht Charlottenburg under HRB 289332 B (the "Processor").

This Agreement forms part of our Terms of Service and takes effect when the Controller accepts those Terms or begins using the Service, whichever is earlier. Art. 28 (9) GDPR permits electronic form, so no signature is required. Controllers who prefer a signed copy can request one from anja@comethire.com — the signed document is identical to this text.

Where the Controller and the Processor have signed an individually negotiated data processing agreement, that document prevails over this one to the extent of any conflict.

The Processor provides software for recruitment and evidence-based candidate review workflows.

The Processor processes personal data solely on behalf of and under the documented instructions of the Controller in accordance with Article 28 GDPR.

This Agreement governs all processing of personal data performed by the Processor on behalf of the Controller in connection with the use of the CometHire platform.

This Agreement remains in force for the duration of the service relationship between the parties and for as long as the Processor processes personal data on behalf of the Controller.

The Processor provides recruitment software that enables the Controller to manage, review and assess candidate applications.

Processing activities may include:

• storage of application documents
• OCR extraction of text from application documents and transcription of voice or video recordings
• AI-assisted de-identification of personal information
• extraction of profile details from application documents
• checking applications against knock-out criteria defined by the Controller
• automated moderation of submitted content for abuse
• extraction of role-related evaluation criteria from job descriptions
• AI-supported analysis of application documents against criteria defined by the Controller
• generation of requirement-level evidence assessments
• aggregation of requirement-level assessments into an overall evidence level per candidate, shown as a score from 0 to 100
• generation of evidence-linked candidate reports and summaries
• collaboration features for recruitment teams
• audit logging
• deletion and retention management

The software is designed as a decision-support tool. The Processor does not make hiring decisions on behalf of the Controller.

• job applicants
• recruiters
• hiring managers
• other users of the Controller

• names
• contact information
• employment history
• education history
• qualifications
• certifications
• skills
• project descriptions
• application documents
• voice or video recordings and their transcripts
• answers to application form questions, such as availability, salary expectation, languages and residence
• interview notes
• recruiter comments
• review-related information

Applicants may voluntarily provide special category data within application documents. The Processor does not intentionally process special category data for review purposes. Where such information is included by applicants, processing is limited to what is necessary for providing the contracted services.

The Processor shall:

• process personal data only on documented instructions from the Controller
• ensure that personnel authorised to process personal data are subject to confidentiality obligations
• implement appropriate technical and organisational measures
• assist the Controller in fulfilling data subject rights requests
• support the Controller with Data Protection Impact Assessments where required
• notify the Controller without undue delay of any personal data breach
• make available information reasonably necessary to demonstrate compliance with Article 28 GDPR

The Processor provides AI-supported functionality intended solely to support candidate review workflows.

De-identification
Before the evaluation step, application documents are passed through an AI-assisted de-identification process intended to reduce personally identifying information, including names, contact details, dates of birth and gender where detected. The de-identification step is performed by the AI provider named for that purpose in Annex III, which receives the application document in its original form in order to perform it. Evaluation requests contain only the de-identified text and the Controller's requirement profile; the candidate report also receives the job description. Profile details are extracted from the original text, by the provider named for that purpose in Annex III.

The purpose of this process is to support more job-related and less bias-prone candidate reviews. Because the process is AI-assisted, complete removal of all identifying information cannot be guaranteed in every case.

No automated decisions
The software does not automatically hire, reject or advance candidates.

Knock-out criteria defined by the Controller are checked automatically. An application that does not meet one is flagged for the Controller's users, never declined.

For each requirement defined by the Controller, the software indicates the level of supporting evidence found in the application — No, Partial, Substantial or Full evidence — and links it to the passage it came from. These levels describe how well the application evidences the Controller's requirements. They are not assessments of a candidate's suitability for the role.

The software aggregates these requirement-level assessments into a single overall evidence level per candidate, shown as a score from 0 to 100, using a fixed rule and the requirement weightings defined by the Controller. Candidate lists can be sorted by this score. Sorting changes the order in which candidates are displayed and has no further effect.

The overall evidence level is not a hiring recommendation, and the Processor gives no advice on which candidates to select. The score is marked as AI-generated until a user of the Controller rates a requirement themselves; such a rating replaces the AI assessment for that requirement.

Advancing or declining a candidate always requires an action by a user of the Controller. No action is triggered by an evidence level, a knock-out criterion or any other calculated value.

The requirement-level assessments and the aggregated overall level constitute profiling within the meaning of Art. 4 (4) GDPR. They do not constitute a decision within the meaning of Art. 22 GDPR. The Controller remains responsible for ensuring that every decision affecting a candidate is taken by a competent person on the basis of an individual review, and that the aggregated level is not applied as a threshold that determines the outcome.

Recruiters remain responsible for:

• defining or approving role-specific requirements
• reviewing evidence identified by the system
• independently evaluating candidates
• assigning candidate scores or ratings where applicable
• making hiring decisions

All hiring decisions remain under the control and responsibility of the Controller.

No model training
Personal data processed under this Agreement shall not be used by the Processor to train, fine-tune or otherwise improve artificial intelligence models. The Processor does not authorise the AI providers named in Annex III to use such data to train or improve their own models, and has contracted with them on terms that exclude this.

The Processor shall implement and maintain appropriate technical and organisational measures in accordance with Article 32 GDPR. The measures currently implemented are described in Annex II and include, among others:

• encryption in transit
• daily backups
• role-based access controls
• optional two-factor authentication with an authenticator app
• audit logging
• infrastructure monitoring
• secure deletion procedures
• access management controls

The Processor may update such measures from time to time provided that the overall level of security is not materially reduced.

The Controller authorises the use of the subprocessors listed in Annex III.

The Processor shall inform the Controller of material changes to subprocessors at least 30 days in advance and provide the Controller with the opportunity to object. Where the Controller objects on reasonable data protection grounds and the parties cannot agree a solution, either party may terminate the affected part of the service relationship.

All subprocessors shall be bound by data protection obligations substantially equivalent to those set out in this Agreement.

Personal data is stored and processed in data centres in the European Union. Where a subprocessor is established in a third country, the transfer is covered by Chapter V GDPR: by an adequacy decision for the United Kingdom, and by the EU-US Data Privacy Framework and standard contractual clauses for the United States, as stated in Annex III.

Should a further transfer outside the European Economic Area become necessary, the Processor will inform the Controller in advance in accordance with Section 9 and implement appropriate safeguards in accordance with Chapter V GDPR. Integrations the Controller enables, such as Greenhouse, Personio or an AI assistant connected through the CometHire MCP server, receive data on the Controller's instruction; they are engaged by the Controller, not by the Processor.

Taking into account the nature of the processing and the information available to the Processor, the Processor shall provide reasonable assistance to the Controller regarding:

• Data Protection Impact Assessments
• AI governance reviews
• risk assessments
• supervisory authority inquiries
• data subject rights requests
• compliance obligations under GDPR

The Controller may verify compliance with this Agreement upon reasonable notice and during normal business hours.

The Processor may satisfy audit requests through documentation, security reports, certifications, independent assessments or other evidence demonstrating compliance.

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed under this Agreement.

The notification shall include the information reasonably available at the time and shall be supplemented as further information becomes available.

Candidate data.
Candidate-related data, including application documents, recordings, OCR transcripts, AI-supported analyses, generated reports and associated audit records, is deleted automatically 184 days (six months) after it was received. Deleting a workspace or the Controller's organisation deletes its candidate data and files immediately. Logs of AI processing steps, which can include the AI output, are kept for 184 days from each step, as the AI Act requires (Art. 19 and 26(6)), even where the candidate data they concern was deleted earlier. Backups are kept for fourteen (14) days.

Technical processing and diagnostic logs.
Technical logs generated during processing, including those kept for debugging and quality assurance, are rotated by size, so older entries are overwritten on a rolling basis. Error reports sent to the error-monitoring subprocessor named in Annex III, including masked session replays, are deleted after at most ninety (90) days.

End of the agreement.
Upon termination of the service relationship, personal data shall be deleted or returned to the Controller unless retention is required by applicable law.

The Processor may amend this Agreement where necessary to reflect changes in law, in the Service, or in its technical or organisational setup, provided the level of protection for data subjects is not reduced. The Controller will be notified in writing at least 30 days in advance and may object; Section 9 applies accordingly to changes of subprocessors.

Purpose of processing.
Support recruitment workflows through AI-assisted document analysis, requirement-level evidence assessments and structured candidate review.

Nature of processing.
Storage, OCR and transcription, extraction, de-identification, analysis, knock-out checks, moderation, reporting, audit logging, deletion.

Web search.
When suggesting evaluation criteria from a job description, the AI model may search the public web for the employer and the role. Search queries carry only the employer's name, the role title, the industry and the country, never candidate data.

Categories of data subjects.
Job applicants, recruiters, hiring managers, other users of the Controller.

Categories of personal data.
Application documents, voice or video recordings, application form answers, professional experience, qualifications, education, skills, recruiter-generated information.

Processing sequence.

1. The application document is received and converted into a text transcript.
2. The transcript is de-identified by the provider named in Annex III for that purpose.
3. Profile details are extracted from the original text into the candidate profile by the provider named in Annex III for that purpose.
4. The de-identified transcript, together with the requirement profile defined by the Controller, is analysed to produce requirement-level evidence assessments. These are aggregated into an overall evidence level per candidate, shown as a score from 0 to 100, using a fixed rule and the Controller's requirement weightings.
5. Results are made available to the Controller's users, who review them and decide.

Access control.
Role-based permissions, authenticated user access with optional two-factor authentication by authenticator app, least-privilege principles.

Encryption.
Encryption in transit (TLS) for all access to the platform.

Pseudonymisation.
Application documents are de-identified before AI evaluation; candidates are shown under a pseudonym by default; AI assistants connected through the MCP server receive pseudonymised candidate data only.

Availability and backups.
Daily backups stored in Hetzner Object Storage in Germany and kept for 14 days; infrastructure and error monitoring.

Infrastructure security.
Infrastructure monitoring, access logging, security investigations.

Regular testing.
Automated tests run on every code change; these measures are reviewed whenever the platform or its subprocessors change.

AI processing safeguards.
De-identification before evaluation, human oversight, no automated hiring decisions, no AI model training on customer data, contractual exclusion of model training by AI providers.

Logging.
Audit records may include processing timestamps, analysis generation events, hashes of prompts and their inputs, model versions, AI outputs, user actions, scoring changes and deletion events.

Storage limitation.
Automated deletion of candidate-related information 184 days after it was received; logs of AI processing steps kept for 184 days from each step; size-based rotation of technical processing and diagnostic logs; deletion of error reports in Sentry after at most 90 days; backups kept for 14 days.

Note on the evaluation models.
The AI models used for evaluation and extraction are operated by Microsoft in the Azure region Germany West Central and reached through Requesty. The model developer does not receive the data and is therefore not a subprocessor. Prompts and outputs are not made available to the model developer and are not used for model training.

Data is stored and processed in data centres in the European Union. Transfers to subprocessors established outside the European Union are covered as stated in Section 10.