Data processing addendum
1. Status of this addendum
1.1 This addendum forms part of the terms of service between Idealweb (Pty) Ltd trading as Recruit 360 (the Operator) and the customer (the Responsible Party).
1.2 It applies to all personal information that the Operator processes on the Responsible Party’s behalf in a workspace — candidates, client contacts, referees, and anyone else recorded there.
1.3 It does not apply to the personal information of the Responsible Party’s own users, its billing contacts, visitors to our website, or a person’s own Recruit 360 Jobs account. For those the Operator is itself the responsible party, and the privacy policy — or, for a Recruit 360 Jobs account, the Recruit 360 Jobs privacy notice — governs. Where a Recruit 360 Jobs job seeker is copied into the workspace, that copy is the Responsible Party’s record and this addendum applies to it from the moment it is created (clause 6A of the terms of service).
1.4 Terms defined in POPIA carry their POPIA meanings. Where this addendum and the terms of service conflict on the processing of personal information, this addendum prevails.
2. Roles
2.1 The Responsible Party determines the purpose and means of processing candidate and client personal information. It is responsible for having a lawful basis, for giving the notice required by section 18, for the accuracy of what it records, and for answering data subjects.
2.2 The Operator processes that information only on the Responsible Party’s documented instructions. Using the features of the service as provided constitutes a documented instruction; so does a written instruction sent to the address in clause 12.
2.3 If the Operator believes an instruction contravenes POPIA it will say so, and may suspend that instruction until it is resolved.
2.4 The service does not make decisions about a data subject. Scores, rankings, summaries and suggestions it produces are aids for a person at the Responsible Party, who remains the only party deciding about a candidate, and the Responsible Party is responsible for section 71 of POPIA accordingly.
3. What is processed
What the Operator processes, why, for how long and about whom is set out in Annexure B, so that the Responsible Party has the record it needs for its own obligations under POPIA.
4. Operator obligations
4.1 The Operator will:
- process personal information only for the purposes in Annexure B, and not for its own purposes — save that the Operator may derive aggregated, de-identified statistics from use of the service, which cannot reasonably identify any data subject or the Responsible Party, and use them to operate, improve and benchmark the service;
- treat all personal information in a workspace as confidential, and ensure that every person it authorises to process it is bound to confidentiality (section 20(b));
- maintain the security measures in clause 5 and in section 19 of POPIA;
- notify the Responsible Party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person (section 21(2)), and give the Responsible Party the information it reasonably needs for its own notifications under section 22;
- not sell, share, pool or otherwise make available the Responsible Party’s personal information to any other customer or third party except as this addendum permits. A person’s own Recruit 360 Jobs account is not the Responsible Party’s personal information for this purpose (clause 1.3); a copy of that person in the Responsible Party’s workspace is;
- not use the Responsible Party’s personal information to train artificial-intelligence models for its own or any third party’s benefit.
5. Security measures
5.1 The Operator maintains at least the following, and will not weaken them during the agreement:
- Tenant isolation enforced in the database. Row-level security applies to the tables that hold workspace data, so a query issued for one workspace does not return another workspace’s rows even if application code is at fault.
- Encryption. Transport encryption for all traffic, encryption of backups held off-site, and separate key-based encryption for the credentials of a connected mailbox and calendar account. The servers that hold the workspace are in a South African data centre with physical and network access controls.
- Access control. Role-based access within a workspace, multi-factor authentication available on every account, and time-limited, logged, purpose-bound access by Operator staff to a workspace for support.
- Audit trail. A record of significant actions in a workspace, including exports of candidate data and changes to consent and retention.
- Backups taken regularly, encrypted, and overwritten on a cycle not exceeding 35 days.
6. Sub-operators
6.1 The Responsible Party gives the Operator general authorisation to appoint sub-operators to perform the functions listed in Annexure A, in the countries stated there. A named list of the current sub-operators is available to the Responsible Party on written request under clause 12, for the purpose of its own data-protection compliance or a request from its client, an auditor or the Regulator, and is the Operator’s confidential information under clause 8 of the terms of service.
6.2 The Operator may add or replace a sub-operator within a function in Annexure A without notice where the country and the basis of engagement stated there do not change. Where a new function is added, or a function moves to another country or to a weaker basis of engagement, the Operator will update Annexure A and give the workspace owner at least 30 days’ written notice before personal information is processed under the change. A Responsible Party that objects on reasonable data-protection grounds may raise the objection within that period; if it cannot be resolved, the Responsible Party may terminate this agreement and the terms of service before the change takes effect, on the terms of clause 17.2 of the terms of service (pro-rata refund of the unused portion of prepaid fees), and has no other remedy in respect of the change.
6.3 Each sub-operator is engaged on written terms that protect the information as this addendum requires for the function it performs, stated for each function in Annexure A. The Operator is responsible for selecting its sub-operators with reasonable care, for the instructions it gives them and for what it sends them, and is liable to the Responsible Party for a sub-operator’s failure to the extent the Operator would have been liable under this addendum had the failure been its own — subject in every case to clause 14 of the terms of service.
6.4 Job boards, mailbox providers and other systems that the Responsible Party chooses to connect to its workspace are not sub-operators of the Operator. The Responsible Party appoints them directly and is responsible for its arrangements with them.
7. Transfers outside South Africa
7.1 Where a sub-operator processes personal information outside the Republic, the Operator engages it only on written terms that bind it not to use the information to train any model, not to retain it beyond serving the request, and not to use it for any purpose of its own; and, where the provider offers them, on data-processing terms of the standard section 72(1)(a) of POPIA describes. Annexure A states, for each function, the country and the basis on which the provider is engaged. The Responsible Party may rely on this clause as the Operator’s account of those terms; the current list is given on written request under clause 6.1.
7.2 The processing location of each function is stated in Annexure A, and the named list available under clause 6.1 gives the country of each provider and the terms it is engaged on.
8. Data subject requests
8.1 The service gives the Responsible Party the means to answer requests itself: to find a data subject’s records, correct them, record and withdraw consent, export the record in a machine-readable format, and erase it.
8.2 Where a data subject approaches the Operator directly about a record in the Responsible Party’s workspace, the Operator will not decide the request on the Responsible Party’s behalf. It will refer the person to the Responsible Party and tell the Responsible Party promptly. Where the person holds a Recruit 360 Jobs account and exercises through it a choice that clause 6A of the terms of service describes, the Operator gives effect to that choice on the Responsible Party’s copy and records it on the Responsible Party’s request register.
8.3 The Operator will give reasonable assistance, at no charge for ordinary requests, with a data subject request, a security-compromise notification, or an enquiry from the Information Regulator.
9. Retention and deletion
9.1 The Operator retains personal information for as long as the workspace exists, subject to the retention rules the Responsible Party configures in the service, which dispose of records on the schedule it sets.
9.2 On termination the Responsible Party may export its data throughout a 30-day read-only period, other than the records clause 6A.8 of the terms of service holds on licence for the subscription only. At the end of that period the Operator deletes the workspace and its personal information, including files in object storage, once it can show both of the notices in clause 12.2 of the terms of service were sent; where it cannot, it holds the workspace unchanged and acts on it by hand. It retains only a record of the organisation name, the billing contact, the subscription dates and the fact of deletion. The Operator also keeps, indefinitely and separately from any workspace, the email addresses that have bounced or reported its mail as spam, together with the delivery report that caused it. It keeps those as responsible party for its own sending, so that it does not write to an address that has asked it not to or that does not exist, and uses them for nothing else.
9.3 Backups containing deleted data are overwritten on the ordinary cycle in clause 5.1 and are not restored for any purpose other than disaster recovery.
9.4 The Operator may retain personal information where a law or a tax rule obliges it to, or where it is needed for a legal claim that has been made or that the Operator reasonably expects, and in each case only for as long as that reason lasts. Information retained for such a reason is not used for any other purpose.
10. Audit
10.1 On reasonable written notice, and not more than once a year unless a security compromise has occurred, the Operator will give the Responsible Party the information reasonably necessary to demonstrate compliance with this addendum.
10.2 Where an on-site or third-party audit is required, it must be at the Responsible Party’s cost, during business hours, subject to confidentiality, and conducted so as not to compromise the security or confidentiality of any other customer’s data.
11. Liability
11.1 The limitations in clause 14 of the terms of service apply to this addendum, except that nothing limits either party’s liability to a data subject or to the Information Regulator under POPIA.
12. Notices
12.1 Notices and instructions under this addendum go to [email protected], marked for the attention of the Information Officer, Louis Coetzee.
Annexure A — sub-operators
Current at the revision date above. Sub-operators are described by the function each performs and the country in which it processes. Each entry is a function this service actually performs, not a possibility. The named list is available on written request under clause 6.1, and the list is updated on notice under clause 6.2.
| Function | What it does | Processing location | Engaged on |
|---|---|---|---|
| Hosting of the workspace | The servers on which the Operator runs the workspace software — database, authentication and file storage — in a South African data centre. The software is operated by the Operator’s own staff; the hosting provider supplies the infrastructure | South Africa | The Operator’s hosting contract; the provider supplies the infrastructure and does not operate the software |
| System email and off-site backups | Delivery of email sent from the service — invitations, notifications, candidate correspondence — and encrypted off-site storage of database backups, through a cloud provider’s South African region | South Africa (Cape Town) | The provider’s data-processing terms, in its South African region |
| Payments | A South African payment gateway that tokenises cards and collects subscription payments. Card numbers are held by the gateway, never by the Operator | South Africa | Merchant agreement; PCI DSS |
| Mailbox, calendar and online meetings | Where the Responsible Party connects its own mailbox and calendar account: synchronisation of mail and calendar, and the hosting of online meetings. Connected by the Responsible Party, to its own tenant with that provider, and disconnectable by it at any time | The Responsible Party’s own tenant | The Responsible Party’s own agreement with that provider (clause 6.4) |
| Language-model and speech-to-text inference | CV parsing, summarising, drafting and matching, and interview transcription. Content is sent only when a user invokes such a feature, and only the content that feature needs. Inference is bought as a service from providers that do not train on the content submitted to them and, for embeddings and transcription, are restricted to hosts that do not retain it | United States and the European Union | Each provider’s published terms, which bar training on inputs and outputs and limit processing to serving the request; for embeddings and transcription, a zero-retention routing instruction on every call. Where a provider offers data-processing terms — for embeddings and transcription some do, incorporated into the terms the Operator accepts — the Operator is on them; the general text-inference provider offers none and is engaged on its published terms alone. The Operator negotiates no separate agreement with any provider in this function |
| Web search | The assistant’s research and business-development features. Search terms only — company names and market questions. Candidate personal information is not sent | Outside South Africa; the provider does not state a single location | The provider’s published terms; no personal information is sent |
| Address autocomplete | Receives the partial text typed into an address field and returns suggestions | United States | The provider’s standard terms, under which it acts for itself; the Operator sends no name or record identifier with the text |
| Geocoding of place names | Turns a suburb, town or province name into map coordinates for distance and travel features. Place names only; no name or record identifier is sent | United Kingdom and the European Union | A public service under its published usage policy; place names only |
| Recorded video interviews | Where the Responsible Party sends a candidate a recorded interview: the candidate records their answers in their own browser, the recording is stored with the workspace’s other files on the hosting above, and the audio track is transcribed through the inference function above. Nothing joins a live meeting | South Africa; transcription as for the inference function | As for hosting and inference above |
Every provider that processes personal information outside South Africa is engaged on the basis set out in clause 7. Where the last column above says otherwise, the function sends no personal information, or no name or record identifier, and clause 7 does not apply to it. The Operator will not appoint a language-model provider that reserves the right to train on content submitted to it.
Annexure B — details of processing
Subject matter and duration
Provision of the Recruit 360 applicant tracking service, for the duration of the Responsible Party’s subscription and the 30-day read-only period that follows it.
Nature and purpose
Collection, storage, organisation, retrieval, use, transmission and erasure of personal information for the purposes of recruitment and talent acquisition: advertising vacancies, receiving and assessing applications, corresponding with candidates and clients, arranging interviews and assessments, making placements, and statutory reporting.
Categories of data subject
- Candidates and applicants, including speculative registrations
- Referees and emergency contacts a candidate supplies
- Employees and contacts of the Responsible Party’s clients
- Hiring managers and interviewers
Categories of personal information
- Identifying and contact information — name, identity or passport number, date of birth, email address, telephone number, address
- Career information — CV, employment history, qualifications, references, notice period, current and expected remuneration
- Application information — applications, stages, notes, interview records, assessment results, scores and rankings
- Recordings — audio and video recordings of a candidate, and the transcripts made from them, where the Responsible Party uses recorded video interviews
- Correspondence between the Responsible Party and the data subject
- Special personal information — race and gender where a candidate volunteers it for Employment Equity reporting, health or disability information where a candidate volunteers it, and criminal record or credit-check outcomes where the Responsible Party lawfully obtains them. These are processed only under section 27 or 28 of POPIA, on the Responsible Party’s instruction, and are never used by the Operator for any purpose of its own
Erasure
On the schedule set by the Responsible Party’s retention rules, on its instruction, or on the timetable in clause 9.2, whichever comes first.