Book a Demo

DATA PROCESSING ADDENDUM

‍

This Data Processing Addendum (“DPA”) forms part of the Master Subscription Agreement (“Agreement”) between Customer (as defined in the Agreement) and Incanus Technologies Private Limited (“Company”) under which the Company (who shall be the “Data Processor” for the purpose of this DPA) provides the Customer (who shall be the “Data Fiduciary” for the purpose of this DPA) with the software and services (the “Services”). 

The Data Fiduciary and the Data Processor are individually referred to as a “Party” and collectively as the “Parties”.

The Parties seek to implement this DPA to ensure compliance with all Applicable Data Protection Laws, including but not limited to the The Digital Personal Data Protection Act, 2023 (“DPDPA”), Information Technology Act 2000 together with any rules, regulations, or notifications issued thereunder from time to time, in relation to the Data Processor’s processing of Personal Data under the Agreement.

This DPA shall apply to the Data Processor’s processing of Personal Data provided by the Data Fiduciary, solely for the purpose of performing its obligations under the Agreement, and in accordance with the Data Fiduciary’s documented instructions and Applicable Laws. Except as modified below, the terms of the Agreement shall remain in full force and effect.

‍

1. DEFINITIONS

Terms not otherwise defined herein shall have the meaning given to them in the DPDPA or the Agreement. The following terms shall have the corresponding meanings assigned to them below:

1.1 “Applicable Law” means all data protection laws applicable in India.

1.2 “Personal Data” means any data about an identifiable individual processed under the Agreement.

1.3 “Processing” means collection, storage, use, analysis, or any operation performed on Personal Data.

1.4 “Data Principal” means the individual to whom the Personal Data relates.

1.5 “Security Incident” means unauthorized access, disclosure, alteration, or destruction of Personal Data.

‍

2. PURPOSE

2.1 The Data Processor is engaged by the Data Fiduciary to provide the Platform for conducting Candidate interviews, generating transcripts and evaluation and providing analytics from the Platform to the Data Fiduciary along with Services in connection with the Platform.

2.2 The duration of processing shall be co-terminus with the underlying service agreement unless otherwise agreed.

‍

3.  ROLE OF PARTIES

3.1 Data Fiduciary determines the purpose and means of processing Personal Data.

3.2 The Data Processor shall process Personal Data only on documented instructions of the Data Fiduciary and strictly for the purposes set out in the DPA and Agreement. 

3.3 The Data Processor shall not be deemed a Data Fiduciary except where it independently determines the purpose of processing.

‍

4. PROCESSING DETAILS

4.1 Categories of Personal Data include:

  • Name, contact details
  • Resume/CV information
  • Audio/video recordings
  • Interview responses and transcripts
  • AI-generated scores and insights

4.2 Processing activities include collection and storage, AI-based analysis and scoring and generation of reports

4.3 The Data Processor shall process Personal Data strictly in accordance with Clauses 4.1 and 4.2 and the documented instructions of the Data Fiduciary. The Data Processor shall have no obligation to process Personal Data beyond such scope, and no instruction shall be binding unless provided in writing. Any modification to the categories of Personal Data or the nature, scope, or purposes of Processing set out herein shall require prior written agreement between the Parties.

4.4 The Data Processor may use aggregated, anonymized, and de-identified data in accordance with Clause 10, provided such data does not constitute Personal Data or Customer Data capable of identifying any individual. 

‍

5. OBLIGATION OF THE PARTIES

5.1 The Data Fiduciary shall be solely responsible for obtaining all notices, consents, authorizations, and lawful bases required under Applicable Law for the collection, processing, transfer, and use of Personal Data in connection with the Services. 

5.2 The Data Processor shall:

  • Process Personal Data only in accordance with this Agreement.
  • Implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, including accidental loss, destruction, or damage.
  • Ensure that all personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.
  • Not sell, disclose, or otherwise process Personal Data except as permitted under this Agreement or as required by Applicable Law.
  • The Data Processor shall not be responsible for determining the legality of any instructions provided by the Data Fiduciary.
  • The Data Processor may implement (a) encryption of data in transit and at rest: (b) role-based access controls; (c) monitoring and logging mechanisms and (d) secure infrastructure practices

‍

6. DATA RETENTION AND DELETION

6.1 Personal Data shall be retained only as per the terms of this clause. 

6.2 Following termination of the Agreement, Data Processor will, at the choice of Customer, delete or return to Customer all personal data processed by Data Processor, except to the extent applicable law requires the retention of any personal data. If Customer does not notify Data Processor of Customer's preferred choice within 30 days following termination of the Agreement, Data Processor will delete Customer’s data in accordance with its data retention policy. Until the personal data is deleted or returned, it will remain subject to the terms of this DPA.

‍

7. AI-SPECIFIC TERMS: 

7.1 The Data Fiduciary acknowledges that AI-generated outputs are probabilistic in nature and should not be the sole basis for hiring decisions.

7.2 The Data Processor does not guarantee accuracy or absence of bias. 

7.3 The Data Fiduciary remains solely responsible for all employment decisions.

‍

8. PERSONAL DATA BREACH

8.1 The Data Processor shall notify the Data Fiduciary of any Security Incident without undue delay, and in any event within 48 (forty eight) hours.

8.2 Such notification shall include:

  • Nature of the incident
  • Categories of data affected
  • Mitigation measures taken

‍

9. DATA PRINCIPAL RIGHTS: 

9.1 The Data Processor shall, taking into account the nature of Processing, provide reasonable assistance to the Data Fiduciary in fulfilling its obligations to respond to requests from Data Principals under Applicable Law. 

9.2 The Data Processor shall not respond directly to any Data Principal unless instructed by the Data Fiduciary.

‍

10. DE-INDENTIFIED AND AI MODEL IMPROVEMENT:

10.1 Except as expressly authorized by the Customer in writing, the Company shall not use Personal Data or Customer Data to train, fine-tune, or otherwise improve any machine learning or artificial intelligence models.

10.2 Notwithstanding the foregoing, the Company may collect, create, use, retain, and process aggregated, anonymized, and de-identified data derived from Customer Data, provided that such data does not identify and cannot reasonably be used to identify the Customer, any User, candidate, or other individual. The Company may use such aggregated, anonymized, and de-identified data for analytics, benchmarking, research, service improvement, product development, and the training, testing, validation, and improvement of the Company's machine learning and artificial intelligence models and services. Aggregated, anonymized, and de-identified data used pursuant to this Clause shall not constitute Personal Data or Customer Data for the purposes of this Agreement, provided that the Company maintains reasonable technical and organizational measures designed to prevent re-identification.

10.3  The Parties acknowledge that aggregated, anonymized, and de-identified data created by the Company in accordance with this Agreement shall not constitute Customer Data, and the Company shall own all right, title, and interest in and to such data, subject to the Company's obligations under this Agreement and applicable law. 

11. SUB-PROCESSORS: 

11.1 The Data Processor may engage third-party service providers (“Sub-processors”) for the performance of the Services.

11.2 The Data Fiduciary hereby provides a general authorization for the engagement Sub-processors listed on Data Fiduciary's Sub-Processor page available at https://koyo.newtonschool.co/ . 

11.3 The Data Processor shall ensure that each Sub-processor is subject to data protection obligations no less protective than those set out in this DPA. 

11.4 The Data Processor shall remain liable for the acts and omissions of its Sub-processors in connection with the performance of its obligations under this DPA.

12. CROSS-BORDER DATA TRANSFERS

12.1 The Data Fiduciary acknowledges and authorizes the Data Processor to process Personal Data in jurisdictions outside India.

12.2 The Data Processor shall ensure that such cross-border Processing is carried out in compliance with Applicable Law and subject to implementation of reasonable safeguards.

‍

13. LIABILITY 

13.1 The liability of the Parties under this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement. 

13.2 The Data Processor shall not be liable for any claims arising from instructions provided by the Data Fiduciary or from the Data Fiduciary’s failure to comply with Applicable Law.

‍

14. AUDIT RIGHTS 

The Data Fiduciary may request reasonable information to demonstrate compliance with this DPA. Any audit shall be subject to reasonable prior notice, conducted during business hours, and shall not unreasonably interfere with the Data Processor’s operations.

‍

15. ORDER OF PRECEDENCE 

In the event of conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters.

‍