Data Processing Addendum

1. Parties, scope and relationship to the Terms

This Data Processing Addendum (DPA) is between Confeti, Co., a Delaware corporation (Confeti or Processor), and the business Customer accepting the Confeti Terms of Service or identified in an applicable order (Customer). It applies when Confeti processes personal data on behalf of Customer in providing the Services and is incorporated into the Terms upon acceptance of those Terms by a business Customer. If the parties have signed a separate DPA, that DPA replaces this public DPA for the covered relationship.

This DPA supplements the Terms and applies only to Customer Personal Data processed on behalf of Customer. If it conflicts with the Terms about that processing, this DPA prevails. Mandatory cross-border transfer clauses prevail over conflicting provisions to the extent required by law. Other defined terms have their meanings in the Terms or applicable data-protection law.

2. Definitions and roles

Applicable Data Protection Law means privacy or data-protection laws applicable to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and applicable Israeli data-protection law. Customer Personal Data means personal data that Confeti processes on behalf of Customer through the Services, including personal data in Customer Data. A Subprocessor is a third party engaged by Confeti to process Customer Personal Data.

Customer is a Controller, or a Processor acting for another Controller, and Confeti is respectively its Processor or Subprocessor. The parties may separately act as independent Controllers of account, billing, business-contact, security and legal-compliance information for their own purposes.

3. Instructions and responsibilities

Confeti will process Customer Personal Data only on Customer’s documented instructions, including these Terms, this DPA, Customer’s product settings and authorized requests, or as otherwise required by law. Confeti will inform Customer if an instruction appears to infringe Applicable Data Protection Law, unless prohibited from doing so by law. Confeti may suspend affected processing while an unlawful instruction is resolved.

Customer is responsible for its own compliance with Applicable Data Protection Law, establishing an appropriate lawful basis, providing required notices, obtaining required recording permissions or consents, and ensuring it has authority to disclose and instruct processing of all submitted personal data. Customer must ensure that recordings, sensitive information and automated assessments are used lawfully.

4. Confidentiality and personnel

Confeti will ensure that persons authorized to process Customer Personal Data are subject to confidentiality obligations and access the data only where necessary for their duties. Access will be reasonably limited by role and removed or adjusted when no longer needed.

5. Technical and organizational safeguards

Confeti will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful loss, destruction, alteration, unauthorized disclosure or access, taking account of processing risks, available technology and implementation costs. The measures are described in Annex II.

Confeti will not materially reduce the overall level of contractual security protections during the applicable service term. Customer remains responsible for securing its own devices, users, permissions and downloaded or locally recorded files.

6. Security incidents

Following awareness of a confirmed personal-data security breach affecting Customer Personal Data, Confeti will notify Customer without undue delay, provide reasonably available information about the incident and its effects, and cooperate in investigation, containment and mitigation. Information may be provided in stages as it becomes available.

Incident notification does not, by itself, constitute an admission of fault or liability. Customer is responsible for determining and making any notices to regulators or individuals required of it as Controller, with reasonable assistance from Confeti.

7. Subprocessors and change notices

Customer grants Confeti general authorization to engage the Subprocessors listed in Annex III and additional or replacement Subprocessors subject to this Section. Confeti will impose written data-protection obligations on each Subprocessor that are materially consistent with those imposed on Confeti, and Confeti remains responsible for their performance of delegated processing.

Confeti will give at least 30 days’ prior notice of a material addition or replacement of a Subprocessor, ordinarily by email to Customer’s registered legal or account contact. Customer may submit a reasonable, documented objection on data-protection grounds within 15 days after notice. The parties will work in good faith to address the objection. If no reasonable mitigation is available, Customer may terminate the affected Service without penalty for the affected future period, with a proportional refund of unused prepaid fees for that Service if applicable.

Customer-directed integrations such as Google Calendar, Google Drive, Microsoft identity services, Comeet or Slack are ordinarily independently selected by Customer and are not Confeti Subprocessors solely because they interoperate with the Services.

8. AI providers and permitted use

Approved AI and transcription providers may process Customer Personal Data solely to deliver requested Services under appropriate confidentiality, security and processing restrictions. Confeti will not use Customer Personal Data, identifiable AI inputs or identifiable AI outputs to train a general-purpose AI model, a model offered to unrelated third parties or another provider’s model for that provider’s independent benefit without Customer’s prior written authorization.

Confeti may analyze effectively de-identified or aggregated service and usage data for maintenance, security, reliability, evaluation and improvements, provided it cannot reasonably identify or reconstruct any Customer or individual and is not used to override the foregoing training restrictions.

9. Individual rights and customer assistance

Considering the nature of the processing and information available to it, Confeti will provide reasonable assistance enabling Customer to respond to legally valid personal-data access, correction, deletion, restriction, portability and objection requests. Where Confeti receives a request about Customer-controlled candidate or interview data directly, it may refer the requester to Customer unless legally required to respond independently.

Confeti will reasonably assist Customer with required privacy-impact assessments, consultations and information concerning processing security, subject to reasonable advance notice and the proportionality of the request.

10. International data transfers

The primary hosting and application-processing region is in the United States, principally Google Cloud us-central1. Some approved providers use other locations or distributed services. The parties will use a legally recognized transfer mechanism where Applicable Data Protection Law requires one.

For restricted transfers from the European Economic Area to Confeti that are not otherwise covered by an adequate protection mechanism, the European Commission Standard Contractual Clauses adopted under Decision (EU) 2021/914 are incorporated by reference and apply as follows: Module Two for controller-to-processor transfers and Module Three for processor-to-processor transfers; Clause 7 docking applies; the option for general authorization of subprocessors under Clause 9 applies with 30 days’ advance notice; the optional independent dispute body under Clause 11 does not apply; the governing Member State and courts for Clauses 17 and 18 are Ireland. Annex I and Annex II below supplement the applicable modules. The SCCs govern to the extent of any conflict.

Where UK GDPR requires it, the parties will implement the applicable UK Addendum or other lawful mechanism. No provision of this DPA limits rights or obligations that must remain unrestricted under mandatory transfer terms.

11. Deletion and return

Upon Customer’s deletion of interview content, Confeti will ordinarily remove it from active application access within 24 hours and delete substantive content from primary production systems within 30 days. Subject to a timely export request, Confeti will delete remaining Customer Personal Data from primary production systems within 60 days after the end of the Services.

Exceptions apply where retention is required by law, necessary to preserve evidence of a documented legal dispute, or limited to audit, security, fraud-prevention and deletion records, which may remain for up to 24 months and must not contain the complete substantive recording, transcript or resume. Recoverable versions in managed-provider backups, transaction logs and soft-deletion mechanisms are isolated from ordinary access and expire under those systems’ lifecycles.

Local files created by a desktop recorder, files downloaded by Customer and copies held by Customer-directed third-party integrations remain under Customer’s control; Confeti cannot remotely erase those files.

12. Demonstrating compliance and audits

Confeti will make reasonably necessary information available to demonstrate compliance with this DPA and, where required by Applicable Data Protection Law, permit and contribute to proportionate audits by Customer or an independent auditor bound by confidentiality. Audits require reasonable prior written notice, must avoid disruption, protect other customers and security-sensitive information, and should rely first on available security documentation or third-party assessments. On-site inspections, if legally required and not reasonably replaced by documentation, must be mutually coordinated.

Nothing in this Section restricts regulatory authority rights established by law or applicable SCCs.

13. Liability and duration

This DPA remains in effect while Confeti processes Customer Personal Data for Customer. Liability relating to this DPA is subject to the applicable limits in the Terms or any separately signed services agreement, to the maximum extent permitted by law. This does not limit statutory data-subject rights, liability prohibited from limitation by law, or liabilities under applicable SCCs that cannot lawfully be limited.

Annex I — Processing details and parties

Data exporter: Customer identified in the account, accepted order or services agreement, acting as Controller or Processor. Its registered business address and privacy contact are those designated in its account or order. Data importer: Confeti, Co., 131 Continental Dr, Suite 305, Newark, DE 19713, United States; legal contact admin@confeti.co; security and privacy contact security@confeti.co; acting as Processor or Subprocessor.

Subject matter: provision, operation, security, support and maintenance of the Confeti recruiting platform. Purpose and nature of processing: collecting, recording, hosting, storing, organizing, transcribing, analyzing, retrieving, sharing on Customer’s instructions, exporting and deleting hiring-related data. Frequency: continuous or event-driven. Duration: the service term and limited post-termination periods in Section 11.

Categories of individuals: candidates, applicants, interviewees, interviewers, recruiters, hiring managers, Customer employees and contractors, account users and administrators, and other hiring-process participants. Categories of personal data: names, contact details, job and career histories, resumes, applications, audio and voice data, transcripts, speaker identifiers, interview notes, summaries, feedback, scorecards, communications, calendars, meeting metadata, integration identifiers, credentials or tokens, IP addresses, device information, usage records and technical logs.

Special-category data is not required to use the Services and should not be intentionally submitted unless Customer has a lawful basis and necessary safeguards. Transfer frequency follows Customer’s authorized use. For EEA transfers, the competent supervisory authority is determined by Clause 13 of the applicable SCCs; the exporter’s relevant supervisory authority is used where one exists.

Annex II — Technical and organizational measures

Infrastructure and access: managed Google Cloud and Firebase services for application hosting, storage, database services, authentication and AI processing; environment separation; individually assigned administrative identities; least-privilege access; and adjustment or removal of access when no longer needed. Core primary-region workloads are located in us-central1.

Encryption and credentials: transport encryption for data in transit; managed-service encryption at rest; protection of integration secrets and tokens; production credentials kept outside application source code using appropriate secrets-management controls.

Operations: monitoring, logging where supported, security-incident triage and response, change controls, personnel confidentiality obligations, and appropriate access restrictions for production systems. Managed cloud infrastructure may retain isolated recovery copies during its standard recovery lifecycle.

Desktop recorder: depending on configuration, local recordings may exist as files on a user’s own device. Confeti does not automatically encrypt or delete files held in the user’s local filesystem; Customer must secure and delete them using its own device controls. These local files are not covered by remote deletion from primary production storage.

Annex III — Authorized subprocessors (September 2026 baseline)

Google LLC and applicable affiliates (Google Cloud and Firebase): application hosting, authentication, data storage, databases, AI and document processing, logging and infrastructure. Primary application processing is in the United States, principally us-central1, with some distributed services.

AssemblyAI Inc.: interview audio transcription, diarization and language detection using its United States processing endpoint. Audio may be accessed through a temporary signed URL; model-improvement participation is disabled and the processing job is requested for deletion after successful transcript retrieval.

Plus Five Five, Inc. (Resend): transactional email delivery, account notices, invitations and collaboration notifications. Processing may occur in the United States and other locations under its applicable terms.

Google LLC and applicable affiliates (Google Workspace): business email and support communications, including information voluntarily included in support requests. Processing occurs through Google’s distributed infrastructure.

A current list and notices of subsequent material changes are available on request at security@confeti.co. A Customer-enabled connector does not by itself make its third-party operator a Confeti Subprocessor.

Contact and notices

Data-processing, security and Subprocessor questions: security@confeti.co. Legal notices: admin@confeti.co. Confeti, Co., 131 Continental Dr, Suite 305, Newark, DE 19713, United States. This public DPA is a standard form; a later separately executed DPA controls for the parties to that agreement.