Data processing agreement

This agreement is between Seedglass, Inc., a Delaware corporation, and the customer that accepts it when creating a Seedglass account. It sets out how we handle personal information for that customer. It adds to the Terms of Service and the Privacy Policy.

Who this agreement covers

Seedglass, Inc. is a controller of candidate data it sources, and a processor of customer account, role and recruiting message data, on the customer's instructions. We and our customers have a legitimate interest in connecting professionals with relevant career opportunities. A message a customer sends through Seedglass is that customer's message.

What we process

Customer accounts: each user's name and work email, a hash of the password, and the activity your team performs in the product.

Candidates: name, role, employer, work history, public work, and contact details.

Roles: the role descriptions and requirements you give us.

Connected email: the messages you approve, and the replies to them. We keep the text of a reply for 30 days and then delete it. We keep the record that a reply arrived, who sent it and when.

How we use it

We use this information to run Seedglass for you. We do not sell it or use it for advertising. Mail from a connected account is never used to train or improve a model. No one at Seedglass opens your mail, except under a declared security incident as the Privacy Policy describes.

Our commitments as processor

For the data we process for you, we act only on your documented instructions, which are these terms and your use of Seedglass, unless the law requires otherwise; if it does, we tell you first where the law allows. Everyone at Seedglass who can access the data is bound to keep it confidential.

We help you answer requests from people who exercise their data rights, and with your own security, breach notice and data protection assessment duties, as far as the information we have allows. When the service ends, we delete the data or return it, as you choose, unless the law requires us to keep it. We give you the information you need to show that we keep these commitments.

Service providers

You authorize us to use service providers to run Seedglass. Each one is bound by written terms that protect the data at least as well as this agreement does, and we remain responsible for them. Our list of service providers describes them by category. A list of named subprocessors is available to customers under confidentiality on request to privacy@seedglass.com. We give customers 30 days' notice before a new category of provider, or a new provider in a category, starts receiving their data, and you can object to it on reasonable grounds.

How we protect it

We use technical and organizational measures suited to the risk. They include encryption in transit and at rest, keeping each customer's data separate from every other customer's, two-step sign-in for staff, access limited to people who need it, and activity logging. We test these measures regularly.

Deleting data

A candidate can ask us to delete what we hold on our privacy request page. Once the request is confirmed, we delete the data within 30 days. We keep the email address on our do-not-contact list so that nobody writes to that person again.

You can disconnect a connected email account at any time from Seedglass settings or from your email provider.

Customer data is deleted within 30 days of a written request at contract end.

Where data is stored

We host Seedglass in the United States. Our service providers may process data in the United States or in other countries where they work.

Transfers out of the EU, the UK and Switzerland

Where you send us personal data from the European Economic Area, the United Kingdom or Switzerland, the transfer to us in the United States is made under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which form part of this agreement: Module Two where you are a controller and we are your processor, and Module Three where you are a processor and we are your subprocessor.

In the clauses, the optional docking clause applies; Clause 9(a), Option 2, applies, with the notice period set out under Service providers; the optional wording in Clause 11 does not apply; the competent supervisory authority under Clause 13 is the one in the member state where our EU representative is established; and Clauses 17 and 18 choose the law and the courts of Ireland. This agreement completes the annexes: the parties and their roles under Who this agreement covers, the data and the processing under What we process and How we use it, and the security measures under How we protect it.

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner (version B1.0), forms part of this agreement. Its Table 1 names the parties above, Table 2 selects the modules above, Table 3 is completed by this agreement, and under Table 4 neither party may end the Addendum when it changes.

For transfers from Switzerland, the clauses apply with the changes the Swiss Federal Act on Data Protection requires: the Swiss Federal Data Protection and Information Commissioner is the competent authority for those transfers, and references to EU law include that Act.

If these terms and the clauses conflict, the clauses prevail.

Breaches

If personal information we hold for you is breached, we tell you without undue delay and within 72 hours of confirming a breach.

Audits

Once a year, you can check how we keep this agreement. We answer your security questionnaire and share the independent audit reports we have.

Liability

Each party's liability under this agreement is limited as the Terms of Service set out.

Governing law

This agreement is governed by the laws of the State of Delaware.

Contact

Questions about this agreement go to privacy@seedglass.com.

Prighter acts for Seedglass, Inc. in the EU under Article 27 GDPR. It also acts for us in the UK under Article 27 UK GDPR. You can write to our representative about your data at:

EU (GDPR Art. 27): Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria

UK (UK GDPR Art. 27): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom