Data Processing Agreement (DPA)

1. Scope

This Data Processing Agreement ("DPA") applies when a company, organisation or headhunter ("Client") uses Referral ATS at business.uctalent.io. It forms part of the Terms of Service (section C4) and applies on every plan, including the free Starter plan. If a separately signed contract conflicts with this DPA, the signed contract prevails.

2. Roles

• The Client is the controller of the personal data it uploads to or creates in its workspace, and decides the purposes and means of processing.
• UCTalent Labs Company Limited ("UCTalent") is the processor. It processes that data only to provide Referral ATS, on the Client's documented instructions. These instructions are this DPA, the Terms of Service and the Client's use of product features.

3. Processing details

4. UCTalent's obligations

• Process personal data only on the Client's instructions, and tell the Client if we believe an instruction breaks the law.
• Make sure staff who can access workspace data are bound by confidentiality.
• Apply the security measures described on our Security page.
• Not use workspace data to train AI models. Send workspace data to the AI provider only while the Client has AI features turned on.
• Help the Client respond to requests from data subjects. Requests we receive directly about workspace data are passed to the Client.
• Help the Client, with the information we hold, to prepare impact assessments and cross-border transfer dossiers where the law requires them.

5. Sub-processors

The Client authorises UCTalent to use the sub-processors listed on our Sub-processors page. We give notice before adding or replacing a sub-processor, so the Client can object. Each sub-processor is bound by written data protection terms.

6. International transfers

Workspace data is stored mainly in Vietnam. Some sub-processors process data in Singapore or other countries, for example when the Client turns on AI features. We follow the procedures required by Vietnamese law for cross-border transfers of personal data.

7. Personal data breaches

UCTalent notifies the Client without undue delay after becoming aware of a breach affecting workspace data, and in time for the Client to meet its own legal deadline for notifying the authority. The notice describes what happened, the data and people affected, and the measures taken.

8. Information and audits

On reasonable request, UCTalent provides the information needed to show compliance with this DPA, such as summaries of our security policies and test results. Audits must be agreed in advance, limited to what is necessary and kept confidential.

9. Return and deletion

The Client can export and delete its data at any time, on every plan. When a paid plan is cancelled or a workspace is closed, data is archived for 30 days for export and then deleted. Closed Starter workspaces, or those inactive for 12 months, are deleted after prior notice. Backups are overwritten within at most 90 days. Records the law requires us to keep, such as invoices and accounting records, are kept for the required period.

10. Governing law and contact

This DPA is governed by the laws of Vietnam, including the Law on Personal Data Protection and Decree 13/2023/ND-CP. Disputes are resolved as set out in section A18 of the Terms of Service. Questions: privacy@uctalent.io.