Data Processing Agreement (DPA)

    (GDPR Art. 28)

    Between: - Controller: Recruiter Company - Processor: Beexpro Consulting Ltd, Cyprus

    1. Subject Matter

    This DPA governs the processing of personal data of applicants by BeeXpro HR on behalf of recruiter companies.

    2. Duration

    Processing lasts for: - The duration of the service agreement - Plus applicable retention periods defined in the Privacy Policy

    3. Nature and Purpose of Processing

    Processing includes: - CV parsing and analysis - Candidate scoring and assessment - AI-assisted interviews - Recruitment workflow support - Talent pool management (where consented)

    4. Categories of Data Subjects

    • Job applicants
    • Candidates
    • Recruiter users (limited)

    5. Categories of Personal Data

    • Identification data
    • CV and career information
    • Assessment results
    • AI-generated insights
    • Communication data

    6. Processor Obligations

    BeeXpro shall: - Process data only on documented instructions - Ensure confidentiality - Implement appropriate security measures - Assist with data subject rights - Notify the Controller of data breaches without undue delay - Delete or return data upon termination

    7. Sub-Processors

    Approved sub-processors include: - VPS Hosting Provider (Cyprus) - Supabase (Ireland) - Stripe (EU) - Cloudflare (EU/global) - AI service providers (e.g. OpenAI API)

    BeeXpro ensures all sub-processors are bound by GDPR-compliant agreements.

    8. International Transfers

    Transfers outside the EU/UK/Switzerland are protected by: - Standard Contractual Clauses (SCCs) - Adequacy decisions

    9. Audits

    BeeXpro shall make available information necessary to demonstrate compliance.

    10. Governing Law

    This DPA is governed by the laws of Cyprus, aligned with EU GDPR.