Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the agency customer (“Customer”) and Kyrolane, an Ontario business, at Kyrolane, Ontario, Canada.

It is part of the Partner Terms. If they conflict on privacy, this DPA wins. It applies when Customer’s organization record stores an acceptance of this version, or when the parties sign a copy, or when Customer uploads Customer Data after receiving this DPA.

Customer is the controller of Customer Data, or the business responsible for it under Canadian law. Kyrolane is the processor, and a service provider and contractor under the California Consumer Privacy Act as amended by the CPRA.

Kyrolane is an independent controller of job-seeker accounts, the talent pool, the company directory it compiles, its own sales mail, and its own accounts and analytics. That processing is described in the Privacy Policy, not instructed by Customer.

When Customer contacts an opted-in job seeker, Customer is an independent controller of that outreach. A copy Customer then stores in the portal is Customer Data.

Customer Data is personal information about candidates, clients, and business contacts that Customer uploads, types, or generates in the Partner Portal, plus messages sent from Customer’s mailbox through the portal.

Kyrolane will process Customer Data only on Customer’s documented instructions, which are these terms, the portal features Customer uses, and any written ticket we accept. We will tell Customer if an instruction appears to break EU, UK, or Canadian data-protection law, unless the law forbids that notice.

We will make sure our people who handle Customer Data are bound to confidentiality.

We will keep the measures in the security annex. They describe what the product does today. They are not a certification such as SOC 2 or ISO 27001.

• Encrypted connections (HTTPS) for the web application.
• Account passwords stored as hashes, not as plain text.
• Mailbox passwords, OAuth tokens, and optional API keys encrypted with AES-256-GCM when an encryption key is configured for the service.
• Sign-in cookies are httpOnly. In production they are marked secure.
• Partner Portal records are scoped to the organization. Admin tools require an admin session.
• Partner outreach requires a postal address on the organization and, for Recruiter Assistant, an approved message before send.
• Directory opt-out addresses are suppressed on send paths that check the suppression list.
• Access to production systems is limited to people who operate the service.

We will notify Customer without undue delay, and in any event within 72 hours after we become aware of a personal-data breach affecting Customer Data. The notice will describe, as far as we know them, the nature of the breach, the categories and approximate number of people and records, the likely consequences, the measures we have taken or propose, and a contact at privacy@kyrolane.com.

We will update that notice as we learn more. Customer is responsible for notices to regulators and to individuals, except where the law requires us to notify them directly. We send the notice by email. It is not a control inside the portal.

Customer authorizes the subprocessors on the subprocessors page for Customer Data. We will impose data-protection terms on them that are no less protective than this DPA in substance.

We will update that page before a new subprocessor processes Customer Data. An administrator emails the organization contact and organization admins at least 30 days before the effective date. Editing the list does not send that email by itself. Customer may object on reasonable data-protection grounds within that period. We will look for a reasonable alternative. If we cannot, Customer may end the licence and we will refund prepaid unused fees for the portal.

Kyrolane is established in Ontario, Canada. Customer Data may be processed in Canada, in the United States (including Vercel, MongoDB Atlas on AWS us-east-1, AWS S3, Stripe, and OpenAI), and in the European Union on the Contabo server used for backend services.

Where EU or UK law requires a transfer tool, the clauses in the next section are the tool. For Canadian private-sector law, we remain accountable for processing handled by these providers. For Quebec, a privacy impact assessment may be required before information leaves Quebec. That assessment is not stored in the product. Ask us for the status.

Where Customer Data is transferred from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 are incorporated into this DPA.

The intended module for a transfer from Customer as controller to Kyrolane as processor is Module Two. The intended module for a transfer from Kyrolane as processor to a subprocessor is Module Three. The docking clause is included so subprocessors can accede. Optional clauses are not used unless we agree them in writing. The governing law and forum of the clauses, if not mandated, follow the Partner Terms.

Where UK GDPR requires a transfer tool, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner, is incorporated. The approved EU clauses it refers to are the 2021 clauses above. Tables of the Addendum are completed by the details in this DPA and the subprocessors page.

Counsel must confirm the module, the annexes, and any transfer assessment before the parties rely on a transfer that needs them. Until a signed annex exists, email privacy@kyrolane.com before sending special-category data or a bulk candidate export from the EEA or the UK.

Module choice is a counsel item. This page states the intended modules. It is not a completed signature block.

We will, taking into account the nature of the processing, assist Customer with access, correction, deletion, and objection requests about Customer Data, by providing the portal tools that already exist and by email support. We will pass on a request we receive directly, unless we are allowed to respond ourselves.

We will assist with a data-protection impact assessment and with prior consultation, to the extent the portal’s processing requires it and Customer cannot reasonably do it alone. We will charge only if the request is unreasonable in scope, and we will say so first.

We will make available the information reasonably needed to show compliance with this DPA. Once a year, or after a confirmed breach of Customer Data, Customer may send a written questionnaire. We will answer it within 30 days, subject to confidentiality and to redacting other customers’ information.

We do not offer an on-site audit portal. A broader audit is available only if the questionnaire shows a material gap, on reasonable notice, during business hours, and under a confidentiality duty. Customer bears its own costs unless the audit finds a material breach of this DPA.

At the end of the licence, Customer may ask for return or deletion as the Partner Terms describe. The in-product delete action removes the organization, its candidates, client companies, client jobs, dashboards, and match embeddings for its data. It keeps email suppression entries, which is a legal requirement. Collections the button does not cover are deleted on request, except records we must keep, such as invoices and proof of instructions.

We may retain backups until they age out. We will not use those copies for production.

Where the CCPA applies to Customer Data, Kyrolane is a service provider. We will not sell or share Customer Data. We will not retain, use, or disclose it except to provide the Partner Portal, for the purposes this DPA allows, or as the law requires. We will not combine it with personal information we receive from other customers, except as the CCPA allows for security, debugging, and the service itself.

We certify that we understand these restrictions and will comply with them. We will tell Customer if we decide we can no longer meet them.

Where PIPEDA or a substantially similar provincial law applies, we will protect Customer Data with safeguards appropriate to its sensitivity and use it only for the purposes Customer instructs. Quebec Law 25 duties that fall on a person who processes information for another enterprise are part of this DPA. Customer remains responsible for its own consent, transparency, and assessment duties.

Liability under this DPA follows the cap and the exclusions in the Partner Terms, except that nothing in those terms limits a party’s liability further than applicable data-protection law allows, and except that each party remains responsible to authorities for its own role.

Privacy contact for this DPA: privacy@kyrolane.com. Commercial contact: info@kyrolane.com. Version 2026-10-12. Effective October 12, 2026.