Data processing agreement

1. Who this is between

You, the customer, decide how the personal information is used. We, AIA, handle it for you.

This agreement is between the customer that uses HR Copilot ("you") and AIA Artificial Intelligence Developing Services L.L.C S.O.C ("AIA", "we", "us"). It forms part of our terms of service.

• You are the controller of the personal information you and your candidates put into HR Copilot, such as applications, interviews and assignments.
• We are your processor: we process that information only to provide HR Copilot to you, on your instructions.

It applies whenever we process personal information for you, under the UAE's Personal Data Protection Law, the GDPR where it applies, and any other data protection law that applies.

2. What we process

Annex 1 lists whose information we process, what it is, why and for how long.

3. Your instructions

We process your information only as you instruct us, and those instructions are your use of HR Copilot.

• Your instructions are these terms, this agreement, the settings you choose in HR Copilot and the way you and your users use it.
• We don't process the information for any other purpose, except to make the anonymised, combined statistics our terms describe, which can't identify anyone, or where the law requires us to (and then we tell you first, unless the law forbids it).
• If we think an instruction breaks data protection law, we tell you.

4. Your responsibilities

You make sure you're allowed to collect the information and that candidates are told how it's used.

• You have a lawful basis for the information you put into HR Copilot, and any consent you need. HR Copilot shows candidates our candidate notice, with a link to your own privacy policy if you add one (Settings › Privacy).
• You don't ask for sensitive information through HR Copilot unless the law requires it for the job.
• Your instructions to us follow the law.

5. Our team

Everyone at AIA who can access your information is bound to keep it confidential, and only those who need it have access.

6. Security

We protect your information with the measures in Annex 2, and keep them up to date.

7. Providers we use (sub-processors)

We use a small number of providers to run HR Copilot. We tell you 30 days before adding a new one, and you can object.

• You allow us to use the providers we use today, of the kinds listed in Annex 3. Their names are available on request at privacy@hrcopilot.ae.
• We give each one the same data protection duties as this agreement, and we remain responsible for them.
• New providers: we email the workspace owner at least 30 days before a new provider starts processing your information, naming it and saying what it does.
• If you object: tell us within those 30 days, with a data protection reason. We'll work with you in good faith to resolve it. If we can't, you may end your subscription before the change applies, and we refund any prepaid fees for the unused time.

8. Transfers abroad

Your information is stored in Singapore, and some providers process it in other countries, including the United States. Every transfer is protected.

• HR Copilot's database and files are stored in Singapore, on Amazon Web Services (AWS).
• Some providers process information in other countries: in particular, our AI services in the United States, and our email delivery provider in Japan.
• You allow these transfers. Each is covered by a data agreement with the provider. For information about people in the EU, EEA or UK, these include the European Commission's standard contractual clauses (or the UK addendum) where needed. For information from the UAE, we follow the UAE law's rules on transfers abroad.

9. Helping you with requests

We help you answer candidates' requests and meet your own duties.

• If a candidate asks to see, correct, delete or move their information, or objects to its use, HR Copilot lets you act on it. Where you can't do it yourself, we help, at no charge. If a candidate writes to us directly, we pass the request to you without delay and don't answer it ourselves unless you ask us to.
• We give reasonable help with your impact assessments and with questions from regulators. Large or unusual requests may be charged at a reasonable rate, agreed first.

10. Breaches

If a breach affects your information, we tell you without undue delay, and within 72 hours of finding out.

We tell you what happened, what information and people are affected (as far as we know), what we're doing about it, and who to contact. We follow up as we learn more, and help you meet your own duties to regulators and to the people affected.

11. Checking how we work (audits)

We answer your security questions and share our security summary each year. A fuller audit is possible when that isn't enough.

• Once a year, on request, we answer your security questionnaire and share our security summary.
• If those don't answer what you reasonably need, or a regulator requires it, you may audit how we process your information, yourself or through an independent auditor bound by confidentiality. You give us at least 30 days' notice, the audit happens during working hours and avoids disrupting the service or other customers' information, and you bear its cost.

12. When the agreement ends

When you stop using HR Copilot, you have 30 days to ask for a copy, and then we delete your information.

• We keep your information for 30 days after your subscription ends or your workspace closes, so you can ask for a copy, which we send you. Then we delete it. Deleted information clears from our backups within 30 more days.
• We keep information longer only where the law requires it, and then only for that purpose.
• Candidates' own accounts: if a candidate has created their own HR Copilot account, the information they chose to keep in it belongs to their agreement with us, not to this agreement, and stays with them.

13. Liability and changes

Our terms of service set the liability limits and how changes are made.

Liability under this agreement is subject to the limits in our terms of service. We change this agreement only as the terms of service describe, with 30 days' notice of important changes.

Annex 1: what we process

Annex 2: security measures

• Information is encrypted in storage and in transit.
• Each customer's information is kept separate. One customer can never see another's.
• The database runs on a private network, with no direct route from the internet.
• Our team's access is limited to the people who need it, and protected by multi-factor sign-in.
• Users have roles (Owner, Admin, Member, Viewer) that limit what each person can see and do.
• Passwords are stored only as strong one-way hashes. Sign-ins are protected by limits on repeated attempts.
• Files are reached only through links that expire quickly: within a minute, or an hour for interview recordings.
• Activity and security records are kept in tamper-evident logs.
• Information is backed up, and backups are encrypted.
• Changes to HR Copilot are released through a controlled process, and its health is checked continuously.
• Our security controls are aligned with the SOC 2 framework.

Annex 3: kinds of providers we use

Services that you or your users connect, such as Google, Microsoft or Zoom, act under your own agreement with them, not as our providers.