Legal

Data processing agreement

Our commitments as a processor of the candidate data our customers put into HireOSS, as required by GDPR Article 28. It forms part of the terms of service and does not need to be signed separately.

Last updated: 28 October 2026

01Parties and roles

The customer is the controller. It decides why and how candidate data is processed.
Kermit Tech AS is the processor and acts only on the customer’s documented instructions.
This agreement forms part of the terms of service. Where the two conflict on data protection, this agreement wins.

02Subject matter and duration

We process candidate data to assess candidates against criteria the customer sets, and to support the customer’s hiring process.
The processing lasts as long as the subscription, and ends when the data has been deleted as described under “Deletion and return”.

03Categories of data subject

Job applicants.
People named in candidate documents, such as referees and former colleagues.
The customer’s own staff who use the service.

04Categories of personal data

CVs, cover letters and other application documents.
Interview transcripts, presentations and submitted work.
Evaluations generated from those, including scores and the reasoning behind them.
Contact details and pipeline status.
The service does not ask for special category data, such as health, religion or ethnic origin. Applicants sometimes include it in their documents anyway. It is then processed only as part of the application, and the customer is responsible for having a lawful basis for it under GDPR Article 9.

05Processing only on instructions

The customer’s instructions are this agreement, the terms of service, and the settings it chooses in the product.
We process customer data only to deliver the service.
We do not use customer data to train or improve AI models, and we only use AI providers that make the same commitment.
We may use aggregated statistics that cannot identify anyone, such as how many evaluations run each day, to operate and improve the service.
If we believe an instruction breaks data protection law, we tell the customer straight away and may pause that processing until it is resolved.

06Confidentiality and staff access

Everyone with access is bound by confidentiality obligations.
Support and operations access is limited to a small number of authorised people.
That access is granted outside the application, requires two factors, and is recorded.

07Security measures

We apply the technical and organisational measures in the annex below, as required by GDPR Article 32.
We may improve them as the platform changes, but never in a way that lowers the overall level of protection.

08Sub-processors

The customer gives general authorisation for us to use sub-processors. The current list is on the sub-processors page.
We email the customer’s administrators at least 30 days before adding or replacing one. The customer may object in writing during that period.
If we cannot resolve an objection, the customer may end the affected part of the service and get back fees paid for the period after it ends.
Each sub-processor is bound by a written agreement with the same data protection obligations as this one. We remain responsible to the customer for its work.

09Assisting with data subject rights

The customer can view, correct, export and delete candidate data in the product, which covers most requests.
If a request needs our help, we respond to the customer within 10 working days, so it can meet the one month deadline.
If a candidate contacts us directly, we pass the request to the customer and do not answer it ourselves unless the customer asks us to.

10Assisting with compliance

We give the customer the information it reasonably needs for a data protection impact assessment, and for any consultation with a data protection authority.
This includes how the AI evaluation works, what data it uses, and the safeguards around it.

11Personal data breaches

We notify the customer without undue delay after becoming aware of a breach that affects its data, and aim to do so within 48 hours.
The notice describes what happened, the data and people affected, the likely consequences, and what we have done or plan to do.
Where we do not have all of this yet, we send what we have and follow up as we learn more.

12Deletion and return

When the subscription ends, the customer has 30 days to export its data.
We delete the customer’s data within 30 days after that window.
Backups are not edited. They expire on their own cycle, so deletion is complete when the last backup containing the data expires, within 90 days.
We keep data longer only where the law requires it, and tell the customer if that applies.

13Retention during the relationship

Raw document and transcript text is purged a set period after a hire or reject decision is recorded. The default is 180 days.
The customer can ask us to set a different period for its account.
Uploaded original files are deleted automatically 180 days after upload.
Scores, recommendations and the short evidence quotes behind them are kept as the decision record until the customer deletes the candidate or the account.
Keeping a candidate for future roles beyond that period needs the candidate’s consent, which the customer is responsible for obtaining.

14Audits and information

We make available the information needed to show that we meet this agreement, including this page, the annex and the sub-processor list.
The customer, or an auditor it appoints who is bound by confidentiality, may audit our compliance once a year with 30 days’ written notice. More often is allowed after a breach, or when a data protection authority requires it.
Each party pays its own costs. Send audit requests to contactus@hireoss.io.

15International transfers

Candidate documents are stored in the EEA. Text from them is sent to an AI service in the United States for evaluation, and some other providers are in the United States too, as the sub-processors page shows.
For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses.
The customer authorises these transfers by accepting this agreement.

16Annex: technical and organisational measures

Blind screening, which the customer can turn on, removes identifying details from candidate text before AI evaluation.
With blind screening on, identity is revealed only after a person shortlists the candidate, by an administrator, and the reveal is recorded.
Separation between organisations, and between departments within one.
Encryption at rest and in transit.
Two-factor authentication, which the customer can require for all members.
An audit trail of significant actions, including every identity reveal.
AI requests are routed only to providers that do not store prompts or use them for training.
Scheduled purging of raw candidate text and uploaded files.
Daily encrypted backups, with restore testing.