Data Processing Agreement

Version: 1.0 Effective date: August 30, 2026

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between Reqcore, Inc. ("Reqcore", "Processor") and the customer organization identified in the Terms ("Customer", "Controller"). It is entered into pursuant to Article 28(3) of Regulation (EU) 2016/679 ("GDPR"), as implemented in Norway by lov om behandling av personopplysninger (personopplysningsloven).

Where this DPA conflicts with the Terms of Service, this DPA prevails in respect of the processing of personal data.

1. Roles of the parties

The Customer is the controller of personal data relating to candidates, applicants and any other data subjects whose data the Customer submits to or generates within the Service. Reqcore is the processor of that data.

Reqcore is an independent controller for a separate, narrow set of data: the Customer's own account and billing data, and product analytics about how the Customer's users use the Service. That processing is governed by the Privacy Policy, not by this DPA.

Nothing in this DPA makes Reqcore a joint controller of candidate data. If Reqcore determines the purposes and means of processing candidate data for its own ends, it becomes a controller for that processing and accepts the corresponding liability.

2. Subject matter, duration, nature and purpose

3. Reqcore's obligations

Reqcore shall:

a. Process only on documented instructions. Reqcore processes personal data only on the Customer's documented instructions, including in respect of transfers to third countries, unless required to do otherwise by EU or Member State law. The Terms of Service, this DPA, and the Customer's use of the Service's configuration options together constitute the Customer's complete documented instructions. If Reqcore is required by law to process beyond those instructions, it will inform the Customer before processing unless that law prohibits it.

b. Notify unlawful instructions. Reqcore shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

c. Impose confidentiality. Reqcore ensures that persons authorised to process the personal data are bound by an obligation of confidentiality that survives the end of their engagement.

d. Implement security measures. Reqcore implements the technical and organisational measures set out in Annex II, pursuant to Art. 32.

e. Engage sub-processors only under §5.

f. Assist with data subject requests. Taking into account the nature of the processing, Reqcore assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests to exercise rights under Chapter III GDPR. In practice this assistance is built into the Service: per-candidate data export in a structured, machine-readable format (Art. 15 and 20), correction through the ordinary editing screens (Art. 16), and permanent erasure of a candidate's full data graph including stored documents (Art. 17). Where the Service does not cover a request, Reqcore will assist on request; see §9.

g. Assist with Articles 32–36. Reqcore assists the Customer in ensuring compliance with the obligations in Art. 32 to 36, taking into account the nature of processing and the information available to Reqcore. This includes providing the information the Customer needs for a data protection impact assessment of the AI screening features (see §7).

h. Delete or return data. At the Customer's choice, Reqcore deletes or returns all personal data at the end of the provision of services, and deletes existing copies, unless EU or Member State law requires storage. See §11.

i. Make available information for audits. Reqcore makes available to the Customer all information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections. See §10.

4. Customer's obligations

The Customer:

a. Warrants a lawful basis. The Customer warrants that it has a valid legal basis under Art. 6 for the processing it instructs, and has provided data subjects with the information required by Art. 13 and 14. The Service includes a configurable privacy notice on the public application form for this purpose, and displays a notice by default where the Customer has not configured one; the Customer remains responsible for its adequacy.

b. Is responsible for its instructions. The Customer is responsible for the accuracy, quality and legality of the personal data it submits and the means by which it acquired that data.

c. Is responsible for special-category and criminal-offence data. If the Customer collects data falling under Art. 9 or Art. 10 — including through optional fields or free-text fields — it must have a valid condition under Art. 9(2) or Art. 10 for doing so. Reqcore does not evaluate this.

d. Is responsible for automated processing decisions. If the Customer enables AI screening or configures rules that change an application's status automatically, the Customer is responsible for the safeguards in Art. 22, for informing candidates, and for providing meaningful human review. See §7.

e. Sets the retention period. The Customer configures the retention policy applicable to its data. Reqcore does not determine how long candidate data is kept.

5. Sub-processors

The Customer grants Reqcore general written authorisation to engage sub-processors, subject to this section.

The sub-processors in use at the effective date are listed in Annex III and maintained in section 6 of the Privacy Policy, which is the authoritative current list.

Reqcore shall:

• impose on each sub-processor, by contract, data protection obligations materially equivalent to those in this DPA;
• remain fully liable to the Customer for a sub-processor's performance of its data protection obligations;
• give the Customer at least 30 days' notice by email to the Customer's designated contact before adding or replacing a sub-processor.

The Customer may object to a new sub-processor on reasonable data protection grounds within that 30-day period. If the parties cannot agree a resolution, the Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused remainder of the term.

AI sub-processors are opt-in. No candidate data is sent to a model provider unless the Customer enables an AI feature. A Customer that does not enable them has no AI sub-processor in its processing chain.

6. International transfers

Reqcore is established in the United States and several sub-processors in Annex III are outside the EEA.

Where personal data is transferred out of the EEA, the transfer is made under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two (controller to processor) between the Customer as data exporter and Reqcore as data importer, and Module Three (processor to processor) for onward transfers to sub-processors. The SCCs are incorporated into this DPA by reference and, where they conflict with it, the SCCs prevail.

For the purposes of the SCCs:

• Clause 7 (docking): applies.
• Clause 9 (sub-processors): Option 2, general written authorisation, with the 30-day notice period in §5.
• Clause 11 (redress): the optional independent dispute resolution body is not selected.
• Clause 17 (governing law): the law of Norway.
• Clause 18 (forum): the courts of Norway.
• Annexes I, II and III to the SCCs are the corresponding Annexes to this DPA.

Reqcore has carried out a transfer impact assessment covering the transfers in Annex III and makes it available to the Customer on request at privacy@reqcore.com.

Where a Customer requires that candidate data not leave the EEA, the Service supports configuring an EU-hosted, OpenAI-compatible AI endpoint; hosting and storage regions are set per deployment and must be agreed before the Customer subscribes.

7. Automated processing and AI

Two features send candidate data to a model provider. Both are disabled by default and are enabled only by the Customer:

• AI screening, which scores an application against criteria the Customer defines. Scores are advisory. The Service does not reject an application on the basis of a score.
• The AI assistant, which lets the Customer's users ask questions about candidates in the Service.

Reqcore's commitments:

• Candidate gender and date of birth are not made available to the AI assistant.
• Prompt and completion content is never sent to Reqcore's observability tooling; only token counts, latency and cost are recorded.
• Platform-funded AI processing uses providers under terms that do not permit training on submitted content. A Customer using its own API key is subject to the terms it agreed with that provider.
• Reqcore will provide the information the Customer needs to complete a data protection impact assessment of these features.

The Customer's responsibilities:

• Determine whether a DPIA is required (Art. 35). Reqcore's position is that for AI screening in a recruitment context it generally is.
• Provide candidates with the information required by Art. 13(2)(f) and 14(2)(g). The Service displays a notice on the application form when AI screening is enabled; the Customer should satisfy itself that it is adequate for its process.
• Provide meaningful human review where an automated step materially affects a candidate, and handle objections.
• Note that recruitment is a high-risk use case under Regulation (EU) 2024/1689 (the EU AI Act). Obligations under that Regulation fall on the Customer as deployer and are not addressed by this DPA.

8. Personal data breaches

Reqcore shall notify the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the Customer's personal data.

The notification will describe, to the extent known: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point for further information. Where the information is not all available at once, Reqcore will provide it in phases without further undue delay.

Reqcore shall not notify a supervisory authority or data subjects on the Customer's behalf unless the Customer instructs it to. Notification to Datatilsynet under Art. 33 is the Customer's obligation as controller.

9. Data subject requests

If Reqcore receives a request from a data subject relating to the Customer's personal data, Reqcore will not respond to it directly beyond confirming that Reqcore is a processor and identifying the controller, and will forward the request to the Customer without undue delay.

The Service provides self-service export, correction and erasure. Where a request cannot be satisfied through the Service, Reqcore will assist the Customer, at no charge for a reasonable volume of requests.

10. Audits

Reqcore makes available to the Customer the information necessary to demonstrate compliance with Art. 28, including this DPA, the Annexes, its security documentation, and its sub-processor list.

The Customer may audit Reqcore's compliance no more than once per twelve-month period, on 30 days' written notice, during business hours, subject to confidentiality undertakings and without unreasonably disrupting Reqcore's business. A supervisory authority may audit at any time as required by law.

Where Reqcore holds a current third-party audit report or certification covering the relevant controls, providing it satisfies this section unless the Customer demonstrates a specific reason why it does not.

The Customer bears its own costs. Reqcore may charge its reasonable costs for an on-site audit beyond the first in any twelve-month period.

11. Deletion and return

On termination or expiry of the Terms of Service, the Customer may within 30 days request the return of its personal data, which Reqcore will provide in a structured, commonly used, machine-readable format.

After that 30-day period, or earlier on the Customer's written instruction, Reqcore will delete the Customer's personal data from live systems, including stored documents. Deletion removes both database records and the corresponding objects in storage.

Backups. Backups are retained on their ordinary rotation and are not purged on demand — the standard position, since selectively editing a backup destroys its integrity. Backup copies are deleted when the rotation reaches them, within 30 days, and remain subject to this DPA until they are.

Reqcore may retain personal data where required by EU or Member State law, and will inform the Customer of the requirement.

12. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where those limitations are void under applicable data protection law. Nothing in this DPA limits either party's liability to a data subject or a supervisory authority.

13. Term, governing law and disputes

This DPA takes effect when the Customer accepts the Terms of Service and continues for as long as Reqcore processes personal data on the Customer's behalf.

This DPA is governed by the law of Norway. Disputes are subject to the exclusive jurisdiction of the Norwegian courts, with Oslo tingrett as the agreed venue at first instance.

Annex I — Description of processing

I.A. Parties. Data exporter: the Customer, as identified in its Reqcore account. Data importer: Reqcore, Inc., contactable at privacy@reqcore.com.

I.B. Description. As set out in §2 above.

Frequency of transfer: continuous, for the duration of the Terms.

Retention: as configured by the Customer, and otherwise as set out in §11.

I.C. Competent supervisory authority. Where the Customer is established in Norway, Datatilsynet.

Annex II — Technical and organisational measures

Reqcore implements, at minimum:

Access control

• Role-based access control with tenant isolation enforced on every data query, so one organization's data is not reachable from another's session
• Documents are served only through authenticated, authorised requests. No pre-signed or public URLs are issued; the storage bucket is verified private at startup
• Session tokens in HTTP-only, secure cookies; server-side session state

Encryption

• TLS for all data in transit, with HSTS
• Customer-supplied AI provider keys and OAuth tokens encrypted at rest with AES-256-GCM
• Data at rest encrypted by the hosting and storage providers

Data minimisation and segregation

• Candidate gender and date of birth are excluded from AI assistant payloads
• IP addresses are dropped from analytics events and hashed before appearing in logs
• URL query strings and fragments stripped from captured analytics URLs
• Candidate-facing request paths excluded from third-party log forwarding

Integrity and resilience

• Uploaded files validated by content inspection rather than declared type, with size ceilings, parser timeouts and archive-expansion limits
• Rate limiting on public endpoints
• Input validation on every API endpoint
• Automated database backups on a documented rotation

Accountability

• Activity logging of changes to candidate and application records, attributed to the acting user
• A privacy-safe retention audit trail recording erasure actions without reproducing the erased data
• Legal-hold mechanism suppressing automated and manual erasure of records under hold

Assisting the controller

• Per-candidate structured export covering the candidate record, applications, responses, interviews, scores, AI analysis runs, comments, custom properties and activity log
• Single-path erasure removing database records and stored objects together
• Configurable retention policy with a recoverable quarantine window before permanent erasure

Annex III — Sub-processors

The authoritative, current list is section 6 of the Privacy Policy. At the effective date of this DPA:

Contact

Questions about this DPA, requests for a signed counterpart, the transfer impact assessment, or sub-processor notifications: privacy@reqcore.com.