Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between the organization using HireSprint ("Data Fiduciary" / "Controller") and RishantTech Private Limited ("Data Processor" / "HireSprint").

2. Scope

This DPA governs the processing of personal data that the Data Fiduciary uploads, submits, or otherwise provides to HireSprint in connection with the use of the platform, specifically candidate resumes and related information.

3. Roles and Responsibilities

Data Fiduciary (Your Organization):

• Determines the purpose and means of processing candidate data
• Ensures it has a legitimate basis to share candidate resumes with HireSprint for scoring and assessment
• Is responsible for obtaining any necessary candidate consent for processing beyond resume scoring (e.g., assessments, auto-apply)
• Provides the attestation that uploaded resumes are sourced through legitimate recruitment channels

Data Processor (HireSprint):

• Processes candidate data only as instructed by the Data Fiduciary and as described in our Privacy Policy
• Does not use candidate data for any purpose other than providing the contracted services
• Does not sell, share, or disclose candidate data to third parties except as necessary for service delivery (AI providers for scoring, email providers for notifications)
• Implements appropriate technical and organizational security measures

4. Data Processed

• Categories of data subjects: Job candidates whose resumes are uploaded by the organization
• Types of personal data: Name, contact details, employment history, skills, education, assessment answers and scores
• Sensitive data: Not intentionally collected. Resume parsing explicitly excludes photo, age, gender, religion, marital status, and caste
• Processing activities: Resume parsing, AI scoring, assessment grading, job matching, email communications

5. Sub-processors

HireSprint uses the following sub-processors:

• Google Cloud (Cloud Run, Cloud Storage, Cloud Tasks): Infrastructure and file storage — Singapore and Mumbai regions
• Neon: PostgreSQL database hosting
• Firebase (Google): Authentication and hosting
• AI provider (OpenAI / Anthropic / Google): Resume scoring and assessment grading — data sent for processing only, not stored by provider
• SendGrid: Email delivery
• Razorpay: Payment processing

We will notify you before adding or replacing sub-processors.

6. Data Security

• Encryption in transit (TLS 1.2+) and at rest
• Role-based access control with organization-level data isolation (org_id scoping)
• Audit logging of all data access and modifications
• Regular security assessments
• Employee access limited to those who need it for service delivery

7. Data Retention and Deletion

• Candidate data is retained for 12 months from last activity, then automatically purged
• On organization account closure, all associated data is deleted within 30 days
• Candidate deletion requests propagate to both the organization workspace and HireSprint records
• Consent logs and payment records are retained as required by law (5 years and 8 years respectively)

8. Data Subject Rights

HireSprint will assist the Data Fiduciary in responding to data subject (candidate) requests under the DPDP Act 2023, including access, correction, deletion, and portability requests.

9. Data Breach Notification

In the event of a personal data breach, HireSprint will notify the Data Fiduciary without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include the nature of the breach, categories of data affected, and remedial measures taken.

10. International Transfers

Primary data processing occurs in the Singapore and Mumbai regions (Google Cloud). AI provider API calls may be processed in other regions. No data is permanently stored outside these primary regions.

11. Audit Rights

The Data Fiduciary may request information about HireSprint's data processing practices. HireSprint will provide reasonable cooperation for compliance audits, subject to confidentiality obligations.

12. Term and Termination

This DPA remains in effect for the duration of the organization's use of HireSprint. On termination, HireSprint will delete or return all personal data within 30 days, except where retention is required by law.

13. Governing Law

This DPA is governed by the laws of India, including the Digital Personal Data Protection Act 2023. Disputes shall be resolved in the courts of Pune, Maharashtra.

14. Contact

For DPA questions: legal@hiresprint.in

Questions about this policy? Email legal@hiresprint.in.