1.PURPOSE AND SCOPE
The Parties acknowledge that the Customer may upload, store, transmit, access, manage, analyze, or otherwise process Personal Data relating to candidates, applicants, employees, recruiters, interviewers, hiring managers, and other individuals through the Platform.
This Policy applies to all Personal Data processed by TalanteEaseAI on behalf of the Customer regardless of the jurisdiction in which such Personal Data originates.
2.DATA WE COLLECT
TalanteEaseAI collects Data that is necessary to provide, operate, maintain, support, secure, and improve the Platform and the services offered through it. The Data we collect may be obtained directly from Customers, Candidates, integrations, third-party service providers, and through automated technologies used in connection with the Platform.
The categories of Data we collect include the following:
3.1.1 Customer Account Data
When a Customer registers for an account, subscribes to the Platform, requests Data regarding the Platform, or otherwise interacts with TalanteEaseAI, we may collect Data including:
- Full name
- Business email address
- Business telephone number
- Employer or organization name
- Job title and department
- Company address
- Usernames and account credentials
- User preferences and settings
- Subscription Data
- Billing and payment-related information
- Communications and correspondence with TalanteEaseAI
We collect and process this Data to create and administer accounts, authenticate users, manage subscriptions, provide customer support, communicate service-related Data, comply with legal obligations, and maintain the security of the Platform.
4.1.2 Candidate Data
Customers may upload, enter, import, store, manage, or otherwise process Data relating to job applicants and candidates through the Platform.
Such Data may include:
- Full name
- Residential address
- Email address
- Telephone number
- Date of birth (where applicable)
- Nationality
- Professional qualifications
- Educational qualifications
- Employment history
5.1.3 Resume and CV Data
The Platform permits Customers to upload resumes, CVs, and other candidate-related documentation.
Such documentation may contain personal Data including:
- Career history
- Educational records
- Skills and competencies
- Languages spoken
- Professional memberships
- Publications
- Awards and achievements
- Personal statements
- Contact Data
6.1.4 Interview and Recruitment Data
The Platform may process Data generated throughout the recruitment lifecycle, including:
- Interview schedules
- Interview notes
- Candidate evaluations
- Candidate feedback
- Hiring manager comments
- Internal assessments
- Candidate rankings
- Hiring recommendations
- Offer management Data
- Recruitment workflow records
7.1.5 AI-Generated Data
TalanteEaseAI incorporates artificial intelligence functionality to assist Customers in managing recruitment processes.
As a result, the Platform may generate additional Data including:
- Extracted skills and competencies
- Candidate summaries
- Candidate-job matching scores
- Candidate rankings
- Suitability assessments
- Recruitment recommendations
- Job profile suggestions
- AI-generated job descriptions
- Interview summaries
8.1.6 Technical Data and Usage Data
When users access or interact with the Platform, certain Data is automatically collected through system logs and related technologies.
This Data may include:
- Internet Protocol (IP) address
- Device identifiers
- Browser type and version
- Operating system
- Language settings
- Date and time of access
- Session duration
- Login and logout records
- Pages visited
9.1.7 Payment and Billing Data
Subscription payments are processed through third-party payment processors, including Stripe.
Depending on the payment method used, payment-related Data may include:
- Billing name
- Billing address
- Payment card details
- Bank account Data
- Tax Data
- Transaction history
- Payment status
TalanteEaseAI generally does not store complete payment card Data. Such Data is collected and processed directly by the applicable payment processor in accordance with its own privacy and security practices.
10.1.8 Communications Data
We may collect Data contained in communications between users and TalanteEaseAI, including:
- Support requests
- Product inquiries
- Feedback submissions
- Survey responses
- Customer service communications
- Technical support interactions
These communications may be monitored, recorded, stored, and reviewed for quality assurance, training, compliance, security, and service improvement purposes.
11.1.9 Data from Third-Party Integrations
Where Customers choose to connect third-party applications or services to the Platform, TalanteEaseAI may receive Data from such services as authorized by the Customer.
Examples may include:
- HR systems
- Applicant sourcing platforms
- Email providers
- Calendar applications
- Video interview platforms
- Identity and authentication providers
The Data received will depend on the integration selected and the permissions granted by the Customer.
12.1.10 Data We Do Not Intentionally Collect
TalanteEaseAI does not intentionally collect Personal Data that is unrelated to recruitment, talent acquisition, human resources management, or the operation of the Platform.
Customers are responsible for ensuring that they do not upload Data that is unnecessary for the legitimate recruitment and hiring purposes for which the Platform is intended.
13.CONTROLLER AND PROCESSOR ROLES
14.2.1 Relationship of the Parties
The Parties acknowledge and agree that:
- the Customer determines the purposes and means of processing Candidate Data and other Personal Data submitted to the Platform
- the Customer acts as the Controller, Business, or equivalent legal role under applicable privacy laws
- TalanteEaseAI acts as the Processor, Service Provider, or equivalent legal role when processing Personal Data on behalf of the Customer
- nothing in this POLICY shall be construed as granting TalanteEaseAI ownership of Customer Personal Data
15.2.2 Customer Responsibilities
The Customer shall be solely responsible for:
- establishing a lawful basis for processing
- obtaining required notices and consents
- responding to Data Subject requests
- determining retention periods
- determining whether Personal Data should be collected, uploaded, or deleted
- ensuring compliance with applicable privacy laws
The Customer warrants that all Personal Data supplied to TalanteEaseAI has been collected and disclosed lawfully.
16.2.3 Processor Obligations
TalanteEaseAI shall:
- process Personal Data only on documented instructions from the Customer
- process Personal Data solely for purposes of providing the Services
- not sell Personal Data
- not retain, use, or disclose Personal Data except as permitted by this Policy or applicable law
- notify Customer if any instruction violates applicable law, to the extent legally permitted
17.NATURE AND PURPOSE OF PROCESSING
TalanteEaseAI may process Personal Data for the following purposes:
- applicant tracking
- recruitment management
- candidate screening
- interview scheduling
- interview management
- candidate communications
- offer management
- recruitment reporting
- AI-assisted candidate analysis
- AI-assisted candidate matching
18.CATEGORIES OF PERSONAL DATA
Personal Data processed may include:
Candidate Data
- name
- email address
- telephone number
- address
- resume Data
- educational history
- employment history
- skills
- certifications
- references
19.CONFIDENTIALITY OF PROCESSING
TalanteEaseAI shall ensure that all personnel authorized to process Personal Data:
- are bound by confidentiality obligations
- receive appropriate privacy and security training
- access Personal Data only where necessary to perform assigned responsibilities
TalanteEaseAI shall maintain internal procedures designed to ensure Personal Data is processed only by authorized personnel.
20.SUBPROCESSORS
22.6.2 Categories of Subprocessors
Subprocessors may include:
- cloud infrastructure providers
- artificial intelligence providers
- payment processors
- customer support platforms
- email service providers
- authentication providers
- monitoring providers
- analytics providers
Examples may include
- Amazon Web Services (AWS)
23.6.3 Subprocessor Obligations
TalanteEaseAI shall:
- conduct reasonable due diligence before engaging subprocessors
- enter into written agreements imposing privacy and security obligations substantially similar to those contained in this Policy
- remain responsible for the performance of its subprocessors to the extent required by applicable law
24.6.4 Changes to Subprocessors
TalanteEaseAI reserves the right to add, replace, or remove subprocessors.
An updated list of subprocessors shall be made available upon request or through the Platform.
25.SECURITY MEASURES
TalanteEaseAI shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against:
- unauthorized access
- unauthorized disclosure
- accidental loss
- destruction
- alteration
- misuse
Access Controls
- role-based access controls
- least-privilege access principles
- authentication controls
26.INTERNATIONAL TRANSFERS
Customers acknowledge that Personal Data may be transferred to, stored in, or accessed from jurisdictions outside the country where such Personal Data originated.
Such transfers may occur through:
- AWS infrastructure
- OpenAI services
- support personnel
- subprocessors
Safeguards
- contractual safeguards
- standard contractual clauses
- transfer impact assessments
- supplementary security measures where appropriate
27.INCIDENT NOTIFICATION
28.9.1 Security Incident
TalanteEaseAI shall notify the Customer without undue delay after becoming aware of a confirmed Security Incident affecting Personal Data processed on behalf of the Customer.
29.9.2 Notification Content
To the extent reasonably available, such notification shall include:
- nature of the incident
- categories of affected data
- likely consequences
- containment measures taken
- remediation efforts underway
30.9.3 Cooperation
TalanteEaseAI shall reasonably cooperate with the Customer in investigating and responding to the Security Incident.
31.9.4 No Admission of Liability
Notification of a Security Incident shall not constitute an admission of fault or liability.
32.DELETION AND RETURN OF DATA
Upon expiration or termination of the Services, Customer may request:
- return of Personal Data in a commercially reasonable format; or
- deletion of Personal Data
Retention exceptions
- backup copies may remain temporarily in accordance with disaster recovery procedures
- archived copies may be retained where required by law
- security logs may be retained for legitimate security purposes
Unless legally required to retain Data, TalanteEaseAI shall delete or return Customer Personal Data within a commercially reasonable period following such request.
Notwithstanding the foregoing:
33.AUDIT RIGHTS
34.11.1 Compliance Data
Upon reasonable written request, TalanteEaseAI shall make available Data reasonably necessary to demonstrate compliance with this Policy.
Such Data may include:
- security certifications
- audit reports
- security summaries
- compliance documentation
35.11.2 Customer Audit Requests
Where required by applicable law, Customer may request an audit of TalanteEaseAI's compliance with this Policy.
Any audit shall:
- occur no more than once annually unless required by law or following a Security Incident
- be conducted during normal business hours
- avoid disruption to TalanteEaseAI operations
- protect confidential Data of other customers
36.11.3 Alternative Compliance Demonstration
TalanteEaseAI may satisfy audit requirements by providing:
- SOC reports
- ISO certifications
- penetration testing summaries
- independent security assessments
- equivalent third-party compliance documentation
37.11.4 Audit Costs
Customer shall bear its own audit costs and reimburse TalanteEaseAI for reasonable costs incurred in supporting customer-specific audits.
38.LIABILITY
The liability provisions contained in the Terms of Service shall apply equally to this Policy and shall govern all claims arising out of or relating to this Policy.
Any liability cap set forth in the Terms shall apply in aggregate to all claims arising under both the Terms and this Policy.