1. Roles
The business customer is the Controller; HireFlow360, Inc. is the Processor and processes personal data only on documented instructions.
2. Scope of processing
- Subject matter: provision of ProfileX features to the customer.
- Duration: term of the agreement plus retention window.
- Nature: hosting, display, matching, and storage.
- Data subjects: candidates and customer users.
3. Processor obligations
We process on instructions, maintain confidentiality, apply appropriate security measures, and assist with data-subject requests and impact assessments.
4. Sub-processors
We use sub-processors under contract and remain responsible for their compliance. [CONFIRM — sub-processor register pending.]
5. International transfers
Transfers outside the EEA/UK use Standard Contractual Clauses or another lawful mechanism. [CONFIRM — per hosting region.]
6. Security and breach notification
We apply encryption, access control, and audit logging, and notify the Controller without undue delay of any personal-data breach.
7. Return and deletion
On termination we delete or return personal data at the Controller's choice, subject to legal retention.
8. Audit
We make available information needed to demonstrate compliance, subject to confidentiality.
9. Contact / DPO
Data protection contact: dpo@hireflow360.com.