Data processing agreement

1. Who we are and what this covers

Processor: Pavel Valynets PR Beograd, trading as Resume Banger (Resume Banger Hiring), a business registered in Serbia with the Serbian Business Registers Agency (APR). Seat: Jurija Gagarina 231, 11073 Beograd. Registration number (MB): 67436644. Tax identification number (PIB): 114255826. Email: [email protected].

Controller: the business that accepts the Service Terms, that is, you.

This agreement contains the terms that Article 28 of the UK GDPR and of the EU GDPR requires, and those of Article 45 of Serbia's Law on Personal Data Protection (ZZPL), which binds us directly because we are established in Serbia.

If you act for a client as its processor, you confirm that your client has authorised you to use us and our sub-processors.

2. What we process

The subject matter, nature and purpose of the processing, the types of personal data, the people concerned and the duration are set out for each service in Annex 1.

3. Your instructions

We process the data only on your documented instructions. Your instructions are the Service Terms, this agreement, and what you tell us through the service: what you upload or forward, your must-haves, your house format and your emails. This includes transfers outside the UK and the EU, which you authorise as set out in Transfers.

If a law we are subject to requires us to process the data in another way, we tell you before we do, unless that law forbids it.

If we believe an instruction breaks data protection law, we tell you at once, and we may pause that work until you confirm or change the instruction.

4. What we never do

• We never use your data for anything but delivering the service to you.
• We never use it to train or improve any AI model, ours or anyone else's.
• We never sell it, and never share it with anyone but the sub-processors in Annex 3.
• We never contact your applicants or candidates.
• We never score, rank, recommend or reject anyone, and never ask an AI model to guess a person's protected characteristics, such as age, gender, ethnic origin, health or religion.

5. Confidentiality

Everyone we allow to process your data is bound to keep it confidential. Today that is only the owner of the business, who runs the service. Anyone who joins will sign a confidentiality commitment before they get access.

6. Security

We take the technical and organisational measures that Article 32 of the GDPR requires. They are set out in Annex 2. We review them at least once a year. We may improve them, but we never lower the protection they give.

7. Sub-processors

You give us general written authorisation to use the sub-processors listed in Annex 3.

We email you at least 14 days before we add or replace a sub-processor, and record the change on our security page. If you object on reasonable data protection grounds within those 14 days and we cannot meet your objection, you may stop using the affected service, and we refund through Creem what you paid for work not yet delivered.

Each sub-processor is bound by a written contract to data protection duties that protect your data at least as well as this agreement. We remain fully liable to you for their work.

8. Helping you

Taking into account what we process and the information we have, we help you:

• answer people who use their rights (access, correction, deletion, restriction, objection, portability): tell us, and we act within 7 days, or delete a whole pile, CV or pack at once;
• keep the data secure, deal with breaches, and tell the people affected where you must (see Breaches);
• carry out a data protection impact assessment and, if needed, consult your supervisory authority: write to [email protected] and we send you a plain description of how each service works and a model impact assessment.

If a person asks us directly about data we process for you, we pass the request to you and do not answer it ourselves, unless you ask us to.

9. Breaches

If we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 48 hours, by email.

We tell you, as far as we know them: what happened; the kinds of data and the approximate number of people and records affected; the likely consequences; what we have done or propose to do about it; and who to contact. If we do not know everything at once, we send what we know and the rest as soon as we have it.

We keep a record of every breach. We do not notify a regulator or the people affected about your data unless you ask us to or the law requires it.

10. Deletion and return

We delete your data on this schedule, which repeats the promises in our Service Terms word for word:

Automatic jobs delete data on schedule: every hour for Shortlist, every day for the Submission pack and the Outplacement pack.

Deletion covers the files, the text we read from them, our results, and the emails in our mailbox that carry CVs or documents.

Any database backup rolls over within 7 days, so a deleted record can stay in a backup for up to 7 more days. Files are not in any backup.

After deletion we keep only an order record with no CV content, for example how many files a pile had.

Google keeps Gemini prompts and answers for a limited period to detect abuse, under its terms for Paid Services. We cannot delete those logs; Google deletes them.

Return: you receive your results as downloads or email attachments before the deletion date. Downloading them is the return of your data. If you want everything deleted sooner, tell us and we delete it at once. On request we confirm the deletion in writing.

11. Information and audits

We give you the information you reasonably need to show that you and we meet Article 28: answers to your security questions, this agreement and its annexes, and our records of processing for your data.

You may audit us, or have an independent auditor bound by confidentiality do it. We start with a review of documents and answers at a distance. If that is not enough, an inspection on site can take place with 30 days' notice, during working hours, at most once a year unless a breach or a regulator requires more, at your cost.

12. Your duties as controller

You are responsible for:

• having a lawful basis for the processing, including a condition under Article 9 of the GDPR for any special category data;
• telling the people concerned about the processing (Annex 4 has a paragraph you can use);
• the duties in the Service Terms: a person makes every decision, roles only where the terms allow, the Illinois notice, and your own copy of our output as your record;
• sending only the data the role needs.

13. Transfers

We are established in Serbia. Neither the EU nor the UK has found that Serbia protects personal data adequately, so data sent to us from the UK or the EU needs a transfer safeguard. The safeguards below are part of this agreement.

From the United Kingdom

For customers in the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (the UK Addendum, issued under section 119A of the Data Protection Act 2018) applies, with Module 2 (controller to processor) of the EU Standard Contractual Clauses. Its tables are completed as follows:

• Table 1, the parties: you as exporter and us as importer, with the details in Who we are.
• Table 2, the clauses: Module 2; no docking clause (Clause 7); general written authorisation for sub-processors with 14 days' notice (Clause 9(a), option 2); no optional redress clause (Clause 11).
• Table 3, the appendix: Annex 1 (details), Annex 2 (security) and Annex 3 (sub-processors) of this agreement.
• Table 4: either party may end the UK Addendum if the Information Commission issues a revised version.

From the European Union

For customers in the EU or the EEA, Module 2 of the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) applies, completed as above. Under Clause 17, option 2, the clauses are governed by the law of the EU country where you are established; disputes go to its courts (Clause 18), and its data protection authority is the competent supervisory authority (Clause 13).

Back to you in the United States

If Serbian law requires a safeguard for returning results to a customer in the United States, the standard contractual clauses adopted by Serbia's Commissioner for Information of Public Importance and Personal Data Protection apply between us, and we sign them with you on request.

Onward transfers

You authorise us to transfer the data to the sub-processors in Annex 3. Those in the EU need no further safeguard. Cloudflare and Google are in the United States and are certified under the EU-US Data Privacy Framework and its UK Extension, which the EU and the UK recognise as adequate; we rely on that recognition for transfers from Serbia too.

Write to [email protected] and we send you a short description of Serbian data protection law, our security and our onward transfers, for your own transfer risk assessment.

14. Use of AI

We use Google's Gemini API only on Google's Paid Services, where Google does not use prompts or answers to improve its products. Google keeps them for a limited period to detect abuse.

The job ad you give Shortlist is never sent to an AI model: it is used only on our server, to flag CVs that copy it. Knockout questions are written from your must-haves alone.

Every quoted line is checked word for word against the CV it comes from, and every employer, job title, date and qualification we write is checked against its source, before anything is sent. Output that fails a check is held for a person to review, not delivered.

15. Customers covered by the CCPA

If the California Consumer Privacy Act applies to you, we act as your service provider. We will not sell or share the personal information; not keep, use or disclose it for any purpose other than the services in the Service Terms, or outside our direct business relationship with you; and not combine it with personal information we get from anyone else, except as the CCPA allows. We will meet the CCPA's duties for service providers, tell you if we can no longer meet them, and let you take reasonable steps to stop and correct any unauthorised use.

16. Liability, law and order

Each party's liability under this agreement is subject to the limits in the Service Terms, as far as the law allows.

For customers in the United Kingdom, the terms of this agreement that Article 28 of the UK GDPR requires are governed by the law of England and Wales. For customers in the EU, they are governed by the law of the EU country where you are established. Everything else in this agreement, and the whole agreement for other customers, is governed by Serbian law, like the Service Terms.

If the UK Addendum or the EU Standard Contractual Clauses conflict with this agreement, they prevail. If this agreement conflicts with the Service Terms on data protection, this agreement prevails.

17. Changes, copies and contact

We may update this agreement for future orders, as the Service Terms explain. A change that lowers the protection of your data needs your agreement.

Your acceptance online is a written contract, and you can download this version to keep. If you need a signed copy, we sign one on request.

Questions: [email protected], or reply to the email that brought you your link.

Annex 1: Details of the processing

Shortlist

• Subject matter and purpose: making your applicant sheet, blind one-page summaries, groups of near-identical CVs, the check for CVs that copy the job ad, and three knockout questions, and sending you the link to them.
• Nature: storing the files; reading their text; comparing the text with your must-haves using an AI model; checking every quote against its CV; making the sheet and summaries; deleting everything on schedule.
• Personal data: the CV files and everything in them (names, contact details, work history, education, and anything else an applicant chose to include, which can include special category data), your must-haves, nice-to-haves and job ad, and our results. Up to 1,000 applicants a pile.
• People concerned: people who applied for your roles.
• Fingerprints: for each CV read for free we keep a one-way keyed fingerprint of its text, per organisation, so the same CV is not read for free a second time. It cannot be turned back into the CV or the person, and we use it for nothing else. It is deleted with the pile, and 7 days after it was made at the latest.
• Duration: until deletion: Files are used only to make your sheet and are deleted 7 days after delivery.

Submission pack

• Subject matter and purpose: putting each CV you forward into your house format, making an anonymised version and a five-line client summary, and sending them to you.
• Nature: receiving the email; storing the files; reading their text; restructuring and summarising it using an AI model; checking every employer, title, date and qualification against the CV; making the documents; deleting everything on schedule.
• Personal data: the CVs and notes you forward and everything in them (as for Shortlist), the example CV you send for your house format, and the documents we make.
• People concerned: candidates you put forward to your clients.
• Duration: until deletion: CVs are used only to make your documents and are deleted after 30 days.

Outplacement pack

• Subject matter and purpose: sending codes to your employees, only if you send us their names or email addresses so that we do it for you.
• Nature: storing the list, sending the codes, deleting the list.
• Personal data: names and email addresses of employees.
• People concerned: your employees who are leaving.
• Duration: deleted within 30 days.

Competent supervisory authority, for the transfer clauses: for UK customers, the Information Commission; for customers in the EU, the authority of the country where you are established.

Annex 2: Security measures

Where the data is

• The application and its database run on a server we rent from Hetzner (Hetzner Cloud) in Helsinki, Finland.
• Files, meaning the CVs you upload or forward and the documents we make, are stored in Cloudflare R2. The bucket was created with Cloudflare's location hint for Eastern Europe, in R2's default jurisdiction. A location hint is best effort, not a guarantee, so today Cloudflare does not promise that the files stay in the EU. We plan to move the bucket to R2's EU jurisdiction, which does guarantee it.
• Email runs on Zoho Mail, in Zoho's EU data centre.
• Google processes the text we send to the Gemini API in its own data centres, and may store it briefly or cache it in any country where it operates.

Encryption

• Traffic between your browser and the site is encrypted with TLS by Cloudflare, and Cloudflare passes it to our server through an encrypted Cloudflare Tunnel.
• Files in Cloudflare R2 are encrypted at rest with AES-256.
• Our server reaches Cloudflare R2, Google and Zoho only over encrypted connections.

Access

• Access to the server, the storage, the mailbox and our accounts with the sub-processors is limited to the operator who runs the service.
• The storage bucket is private. Files are never public: they are reached only through the application, with your private link.

Private links and codes

• There are no accounts and no passwords. Each customer gets a private link or forwarding address that carries a random key of 192 bits, which cannot be guessed. Outplacement codes are 12 random characters, and repeated tries are limited.
• Private pages are left out of our sitemap, and search engines are asked not to crawl them.
• No advertising or tracking scripts run on the hiring pages. The one measurement script is Cloudflare Web Analytics, run by Cloudflare, which already carries our pages. Private link pages are sent so that Cloudflare leaves the script out of them, so their addresses are not recorded by it and no other outside party sees them.
• When the data is deleted, the link no longer gives access to it.

Keeping data to a minimum

• We use Google's Gemini API only on Google's Paid Services, where Google does not use prompts or answers to improve its products. Google keeps them for a limited period to detect abuse.
• The job ad you give Shortlist is never sent to an AI model: it is used only on our server, to flag CVs that copy it. Knockout questions are written from your must-haves alone.
• Blind summaries leave out the applicant's name, contact details, photo, date of birth, age and graduation years.
• We never ask an AI model to guess a person's age, gender, ethnic origin, health or any other protected characteristic, or to score or judge anyone.
• Error reports go to our own error tracker (GlitchTip, run by us). They carry internal order and company references but no CV text, names or file names, and what we send is filtered to remove email addresses, private link secrets, IP addresses and cookies before it leaves our server or your browser. It never records browsing sessions.

Checks

• Every quoted line is checked word for word against the CV it comes from, and every employer, job title, date and qualification we write is checked against its source, before anything is sent. Output that fails a check is held for a person to review, not delivered.

Deletion

• Automatic jobs delete data on schedule: every hour for Shortlist, every day for the Submission pack and the Outplacement pack.
• Deletion covers the files, the text we read from them, our results, and the emails in our mailbox that carry CVs or documents.
• Any database backup rolls over within 7 days, so a deleted record can stay in a backup for up to 7 more days. Files are not in any backup.
• After deletion we keep only an order record with no CV content, for example how many files a pile had.

Incidents and review

• The owner decides how to respond to an incident, tells affected customers within 48 hours of becoming aware of a breach, and keeps a record of every breach.
• We review these measures at least once a year.

Annex 3: Sub-processors

Every sub-processor above works on all three services, except that Shortlist sends no files by email, only the email with your link.

These are not sub-processors: Creem (Armitage Labs OÜ, Tallinn, Estonia) takes payments as merchant of record and is an independent controller of payment data, and never receives CVs. TypeSafe (typesafe.ai) checks the tone of our own outreach emails and never receives the data you give us. Our error tracker, GlitchTip, is run by us.

Annex 4: A paragraph for your applicant notice

You tell your applicants and candidates about the processing, not us. You can use or adapt this paragraph in your privacy notice for them, keeping the parts that fit the service you use:

We use Resume Banger Hiring, a service provider, to help us read applications. It uses an AI model (Google Gemini) to find the lines in your CV that match the requirements of the role, to write a short summary without your name and contact details, or to put your CV into our format. It does not score, rank or reject anyone: a member of our team reads your application and makes every decision. The service processes your data only on our instructions and never uses it to train AI models. It deletes the data 7 days after it delivers its results to us (Shortlist), or 30 days after delivery (Submission pack).

If you hire in a place with its own rules on AI in hiring, such as Illinois, check whether your notice must say more.