Data processing addendum
1. Status of this addendum
1.1 This addendum forms part of the terms of service between Idealweb (Pty) Ltd trading as Recruit 360 (the Operator) and the customer (the Responsible Party).
1.2 It applies to all personal information that the Operator processes on the Responsible Party’s behalf in a workspace — candidates, client contacts, referees, and anyone else recorded there.
1.3 It does not apply to the personal information the Operator processes for its own purposes as responsible party: the account, sign-in, security, billing and support records of the Responsible Party’s users and billing contacts; the security and operational logs the Operator keeps to secure and run the service — sign-in and session records, the record of who opened which record, network addresses, and error and performance logs; and information about visitors to our website. The privacy policy describes that processing. What a user writes or does in the workspace — the notes they write, the messages they send and the actions the workspace’s audit trail attributes to them — is information in the workspace, and this addendum applies to it. A person who applies or registers through the Responsible Party’s doors (clause 6A of the terms of service) is the Responsible Party’s record, and this addendum applies to it from the moment it is created.
1.4 Terms defined in POPIA carry their POPIA meanings. Where this addendum and the terms of service conflict on the processing of personal information, this addendum prevails; each party’s liability under this addendum is governed by clauses 13 to 15 of the terms of service (clause 11).
2. Roles
2.1 The Responsible Party determines the purpose and means of processing candidate and client personal information. It is responsible for having a lawful basis, for giving the notice required by section 18, for the accuracy of what it records, and for answering data subjects.
2.2 The Operator processes that information only on the Responsible Party’s documented instructions. Using the features of the service as provided constitutes a documented instruction; so does a written instruction sent to the address in clause 12. A written instruction is given by the workspace owner or an administrator. Before acting on an instruction to delete information other than through the service’s own functions, to send information to a third party, or to change how information is processed, the Operator may take reasonable steps to confirm that the person giving it has authority to do so.
2.3 If the Operator believes an instruction contravenes POPIA it will say so, and may suspend that instruction until it is resolved.
2.4 The service does not make decisions about a data subject. Scores, rankings, summaries and suggestions it produces are aids for a person at the Responsible Party, who remains the only party deciding about a candidate, and the Responsible Party is responsible for section 71 of POPIA accordingly.
3. What is processed
What the Operator processes, why, for how long and about whom is set out in Annexure B, so that the Responsible Party has the record it needs for its own obligations under POPIA.
4. Operator obligations
4.1 The Operator will:
- process personal information only for the purposes in Annexure B, and not for its own purposes — save that the Operator may derive aggregated, de-identified statistics from use of the service, which cannot reasonably identify any data subject or the Responsible Party, and use them to operate, improve and benchmark the service, and may de-identify documents and records as clause 4.2 allows;
- treat all personal information in a workspace as confidential, and ensure that every person it authorises to process it is bound to confidentiality (section 20(b));
- maintain the security measures in clause 5 and in section 19 of POPIA;
- notify the Responsible Party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person (section 21(2)), and give the Responsible Party the information it reasonably needs for its own notifications under section 22. The first notice may be given before all the facts are known, and the Operator will update it as they become available; a notice is not an admission of fault or liability;
- not sell, share, pool or otherwise make available the Responsible Party’s personal information to any other customer or third party except as this addendum permits;
- not use the Responsible Party’s personal information to train artificial-intelligence models, other than in de-identified form as clause 4.2 allows, and never for a third party’s benefit.
4.2 De-identified data. The Responsible Party authorises the Operator to de-identify documents and records processed in the service — removing names, contact details, identity and account numbers and other information that identifies a person, so that the result cannot reasonably be linked back to any data subject or to the Responsible Party — and to use the de-identified data to build, train and improve the service’s own models, including the models that read CVs. The Operator does not attempt to re-identify it and does not disclose it to another customer or to a third party. Once de-identified it is not the Responsible Party’s personal information, and the models are the Operator’s (clause 7.1 of the terms of service).
5. Security measures
5.1 The Operator maintains appropriate, reasonable technical and organisational measures under section 19 of POPIA, which at the date of this addendum include those below. The Operator may replace or update any of them, and will not materially reduce the overall level of security they provide.
- Tenant isolation. Each workspace’s data is kept apart from other workspaces’ data by access controls in the database and in the application.
- Encryption. Encryption of traffic in transit and of backups held off-site, and further encryption of the credentials that connect a mailbox or calendar. The servers that hold the workspace are in a South African data centre with physical and network access controls.
- Access control. Role-based access within a workspace, and multi-factor authentication available on every account. Operator staff access to a workspace for support is limited, time-bound and logged, and administrative access to the servers is restricted to the staff who operate them.
- Audit trail. A record of significant actions in a workspace, including exports of candidate data and changes to consent and retention.
- Backups taken regularly, encrypted, and overwritten or expired on a cycle not exceeding 35 days.
6. Sub-operators
6.1 The Responsible Party gives the Operator general authorisation to appoint and replace sub-operators for the functions in group A of Annexure A. Annexure A describes each function, where it is processed and the terms on which its provider is engaged.
6.2 The Operator keeps Annexure A current. Where it adds a function to group A, or a function comes to be processed in a country Annexure A does not state for it, it updates Annexure A and tells the workspace owner in writing. A change of provider does not by itself give either party a right to end this agreement.
6.3 Each sub-operator is engaged on written terms, which Annexure A describes for each function. Where a sub-operator performs part of the processing, the Operator remains responsible for its own obligations under this addendum, including selecting the sub-operator with reasonable care, the instructions it gives it, what it sends it and the safeguards it applies — subject in every case to clauses 13 to 15 of the terms of service.
6.4 Job boards, mailbox providers and other systems that the Responsible Party chooses to connect to its workspace are not sub-operators of the Operator. The Responsible Party appoints them directly and is responsible for its arrangements with them. Group B of Annexure A lists the kinds the service connects to.
7. Transfers outside South Africa
7.1 Some functions in Annexure A are performed outside the Republic. For each function, Annexure A states what is sent, the country and the terms on which the provider is engaged, so that the Responsible Party can assess the transfer for the purposes of section 72 of POPIA. The Operator sends only the content a function needs. It does not permit a sub-operator to use the information to train any model, and does not engage one on terms that let it use the information for purposes of its own, beyond keeping its service secure and complying with the law — save for the providers in group C of Annexure A, which act for themselves: to those the Operator sends only the text the function needs, from the Operator’s own servers and without the user’s network address, and Annexure A describes what that text can contain.
7.2 The processing location of each function is stated in Annexure A.
8. Data subject requests
8.1 The service gives the Responsible Party the means to answer requests itself: to find a data subject’s records, correct them, record and withdraw consent, export the record in a machine-readable format, and erase it.
8.2 Where a data subject approaches the Operator directly about a record in the Responsible Party’s workspace, the Operator will not decide the request on the Responsible Party’s behalf. It will refer the person to the Responsible Party, tell the Responsible Party promptly and raise the request on the Responsible Party’s request register. Where the person withdraws their consent or asks for their information to be deleted, the Operator may, until the Responsible Party decides, mark the Responsible Party’s record as withdrawn and not to be contacted. Deciding the request, including deleting the record, is for the Responsible Party (clause 6A.5 of the terms of service).
8.3 Where the service’s own functions (clause 8.1) do not let the Responsible Party answer a data subject request, make a notification under section 22 of POPIA or answer an enquiry from the Information Regulator, the Operator will give it reasonable help with the information the Operator holds, proportionate to the request. The Operator may charge for that help at reasonable rates, agreed in advance where practicable, except where the need for it arises from the Operator’s own breach of this addendum. The information clause 4.1 requires after a security compromise is given without charge.
9. Retention and deletion
9.1 The Operator retains personal information for as long as the workspace exists, subject to the retention rules the Responsible Party configures in the service, which dispose of records on the schedule it sets.
9.2 On termination the Responsible Party may export its data throughout a 30-day read-only period, provided no invoice is overdue. At the end of that period the Operator deletes the workspace and its personal information, including files in object storage, once the notice in clause 12.2 of the terms of service has been sent (clause 12.3 of the terms says when a notice is sent). Of the workspace it retains only a record of the organisation name, the billing contact, the subscription dates and the fact of deletion; the Operator’s own records about the Responsible Party and its users are kept as the retention schedule in section 7 of the privacy policy describes. The Operator also keeps, separately from any workspace and for as long as it sends mail, the email addresses that have bounced, reported its mail as spam or unsubscribed, with the reason and the dates. It keeps those as responsible party for its own sending, so that it does not write to an address that has asked it not to or that does not exist, and uses them for nothing else. The delivery report that caused a suppression is kept for 12 months and then removed. For the same reason it keeps a record of each message sent through the service — the recipient’s address, the subject, the date and whether it was delivered — for 12 months after it was sent, and deletes a workspace’s records with the workspace.
9.3 Backups containing deleted data are overwritten on the ordinary cycle in clause 5.1 and are not restored for any purpose other than disaster recovery. If the Operator restores personal information from a backup, then before the restored information is used for anything else it re-applies the deletions it holds a record of having made after that backup was taken, and runs once the deletions the service makes on a schedule — under the Responsible Party’s retention rules and at the end of a workspace — so that whatever had fallen due is deleted again.
9.4 Information may be kept for longer where a law requires it or where it is needed for a legal claim that has been made or is reasonably expected, but only for as long as that reason lasts and for no other purpose.
10. Compliance information and access
10.1 The Operator will provide information or access to the extent required by applicable law. Any additional audit or inspection requires the Operator’s prior written agreement on its scope, confidentiality, security arrangements and costs. Nothing in this clause limits the powers of the Information Regulator.
11. Liability
11.1 The Operator’s liability to the Responsible Party under or in connection with this addendum is subject to clause 14 of the terms of service and counts towards the one limit in clause 14.2 of those terms. Nothing in this addendum affects the Responsible Party’s liabilities that clause 14.3 of those terms preserves, including its indemnity under clause 15.1. Between the parties, every claim under or in connection with this addendum, whatever its basis, is subject to clauses 13 to 15 of the terms of service, and this addendum creates no separate limit, indemnity or right to compensation. Nothing in it limits a right or liability that the law does not allow to be limited, binds the Information Regulator or anyone else who is not a party, or limits a right a data subject has under POPIA against either party. A Responsible Party that is itself a data subject has, as a party to this agreement, no wider contractual claim than clauses 13 to 15 allow.
12. Notices
12.1 Notices and instructions under this addendum go to [email protected], marked for the attention of the Information Officer, Louis Coetzee.
Annexure A — sub-operators and other providers
Current at the revision date above. Providers are described by the function each performs and the country in which it processes, in three groups: A, the sub-operators the Operator appoints (clause 6); B, services the Responsible Party connects to its workspace itself, which are not sub-operators (clause 6.4); and C, providers that act for themselves and receive only the text a function needs (clause 7.1). Each entry is a function this service actually performs, not a possibility. The Operator keeps this annexure current as clause 6.2 describes.
A. Sub-operators the Operator appoints
| Function | What it does | Processing location | Engaged on |
|---|---|---|---|
| Hosting of the workspace | The servers on which the Operator runs the workspace software — database, authentication and file storage — in a South African data centre. The software is operated by the Operator’s own staff; the hosting provider supplies the infrastructure | South Africa | The Operator’s hosting contract; the provider supplies the infrastructure and does not operate the software |
| System email and off-site backups | Delivery of email sent from the service — invitations, notifications, candidate correspondence — and encrypted off-site storage of database backups, through a cloud provider’s South African region | South Africa (Cape Town) | The provider’s data-processing terms, in its South African region |
| Payments | A South African payment gateway that tokenises cards and collects subscription payments. Card numbers are held by the gateway, never by the Operator | South Africa | Merchant agreement; PCI DSS |
| Language-model and speech-to-text inference | CV parsing, summarising, drafting and matching, and interview transcription. What is sent is the content the feature works on — CV text and page images, vacancy text, notes, a user’s question to the assistant and the records it draws on, and audio for transcription — when a user invokes the feature or a setting the Responsible Party has switched on runs it. Inference is bought as a service, and no provider is permitted to train on the content (clause 7.1) | United States; text inference may also run in Europe or Singapore when extra capacity is needed | Each provider’s binding terms, accepted by the Operator, which limit how the content may be used and exclude training on it; for text inference they also limit its retention to serving the request, and for embeddings and transcription they incorporate the provider’s data-processing terms, which bind the provider’s own sub-processors to comparable terms |
| Network delivery and protection | Carries and protects traffic between users’ browsers and the service at its main web addresses, so what a user sends to and receives from those addresses passes through it. The provider keeps records of requests, such as the network address, the address requested and the time, under its terms | A global edge network operated from the United States; for users in South Africa, served from Johannesburg in practice | The provider’s data-processing addendum, accepted for the Operator’s account, with standard contractual clauses |
| Recorded video interviews | Where the Responsible Party sends a candidate a recorded interview: the candidate records their answers in their own browser, the recording is stored with the workspace’s other files on the hosting above, and the audio track is transcribed through the inference function above. Nothing joins a live meeting | South Africa; transcription as for the inference function | As for hosting and inference above |
B. Services the Responsible Party connects itself
| Function | What it does | Processing location | Engaged on |
|---|---|---|---|
| Mailbox, calendar and online meetings | Where the Responsible Party connects its own mailbox and calendar account: synchronisation of mail and calendar, and the hosting of online meetings. Connected by the Responsible Party, to its own tenant with that provider, and disconnectable by it at any time | The Responsible Party’s own tenant | The Responsible Party’s own agreement with that provider (clause 6.4) |
| Messaging account | Where a user pairs a messaging account with the workspace: conversations with people already recorded in the workspace, or with people a user chooses to add, are mirrored into it. Paired by the user, on its own account with that provider, and unlinkable at any time | The messaging provider’s own service | The account holder’s own agreement with that provider (clause 6.4) |
C. Providers that act for themselves
| Function | What it does | Processing location | Engaged on |
|---|---|---|---|
| Web search | Sourcing, and the assistant’s research and business-development features. The service sends search queries: a vacancy’s title, skills and place, a company’s name and the roles sought there, or a question a user asks the assistant — which can include a person’s name where the user asks about one. The results, which can include public information about people, come back to the workspace | Outside South Africa; the provider does not state a single location | The provider’s published terms, under which it acts for itself; sent from the Operator’s servers |
| Address autocomplete | Receives the text typed into, or read from a CV for, an address or location field — which can be part of a person’s address — and returns suggestions | United States | The provider’s standard terms, under which it acts for itself; sent from the Operator’s servers, with no name or record identifier |
| Geocoding of place names | Turns the place part of a location field — the suburb, town or province, with any street, unit and number parts removed — into map coordinates for distance and travel features; results are kept so that the same place is not looked up twice | United Kingdom and the European Union | A public service under its published usage policy, which asks that no personal data be submitted; sent from the Operator’s servers, with no name or record identifier |
Clause 7 applies to every function in groups A and C that may send personal information outside South Africa, whatever the last column says; leaving out a name or record identifier does not by itself take a request outside it. The Operator will not appoint a language-model provider that reserves the right to train on content submitted to it.
Annexure B — details of processing
Subject matter and duration
Provision of the Recruit 360 applicant tracking service, for the duration of the Responsible Party’s subscription and the 30-day read-only period that follows it.
Nature and purpose
Collection, storage, organisation, retrieval, use, transmission and erasure of personal information for the purposes of recruitment and talent acquisition: advertising vacancies, receiving and assessing applications, corresponding with candidates and clients, arranging interviews and assessments, making placements, and statutory reporting.
Categories of data subject
- Candidates and applicants, including speculative registrations
- Referees and emergency contacts a candidate supplies
- Employees and contacts of the Responsible Party’s clients
- Hiring managers and interviewers
Categories of personal information
- Identifying and contact information — name, identity or passport number, date of birth, email address, telephone number, address
- Career information — CV, employment history, qualifications, references, notice period, current and expected remuneration
- Application information — applications, stages, notes, interview records, assessment results, scores and rankings
- Recordings — audio and video recordings of a candidate, and the transcripts made from them, where the Responsible Party uses recorded video interviews
- Correspondence between the Responsible Party and the data subject, including mail, calendar entries and messages brought into the workspace from mailboxes and messaging accounts its users connect
- Special personal information — race where a candidate volunteers it for Employment Equity reporting, health or disability information where a candidate volunteers it, and information about criminal behaviour, such as the outcome of a criminal-record check, where the Responsible Party lawfully obtains it. These are processed only where the Responsible Party has a basis under sections 27 to 33 of POPIA, on its instruction, and are never used by the Operator for any purpose of its own
- Other sensitive information — gender where a candidate volunteers it for Employment Equity reporting, and financial or credit-check information where the Responsible Party lawfully obtains it, handled on the same terms
Erasure
On the schedule set by the Responsible Party’s retention rules, on its instruction, or on the timetable in clause 9.2, whichever comes first.