Recruiti AI

Recruiti AI

Data Processing Agreement

See also our Terms of Service and Privacy Policy.

Last Updated: October 3, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Recruiti AI ("Recruiti AI", "Processor") and the customer entity that has accepted those Terms ("Customer", "Controller"), and governs the processing of personal data by Recruiti AI on behalf of the Customer in connection with the Services.

This DPA is effective from the date on which the Customer accepts the Terms of Service and remains in force for the duration of those Terms. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail in relation to the processing of personal data.

In this DPA, "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council; "personal data", "data subject", "processing", "controller", and "processor" have the meanings given in the GDPR; "Standard Contractual Clauses" or "SCCs" means the clauses adopted by the European Commission in Decision 2021/914; and "sub-processor" means any processor engaged by Recruiti AI to process personal data on behalf of the Customer.

1. Roles of the Parties

The Customer is the data controller and determines the purposes and means of processing personal data of candidates, interviewers, and other interview participants in connection with its recruitment activities. Recruiti AI is the data processor and processes such personal data only on behalf of and under the instructions of the Customer for the purpose of providing the Services.

2. Subject Matter, Nature, and Purpose of Processing

Recruiti AI processes personal data on behalf of the Customer as needed to provide, maintain, secure, and support the Services, including:

  • recording and transcribing meetings at the Customer's direction;
  • generating summaries, searchable content, and related AI-assisted outputs;
  • hosting, organising, and delivering Customer content and related metadata; and
  • operating integrations and workflows that the Customer chooses to enable.

The categories of personal data may include identity and contact details, account and meeting metadata, recordings, transcripts, summaries, integration data, and other personal data contained in content submitted to or generated through the Services. Data subjects may include candidates, Customer personnel, meeting participants, and other people whose personal data appears in Customer content.

Processing continues for the duration of the Services and any applicable retention or return period, subject to the Customer's instructions, the Terms of Service, and applicable law.

3. Processor Obligations

Recruiti AI shall, in its capacity as data processor:

  • process personal data only on documented instructions from the Customer, including as set out in the Terms of Service and this DPA, unless required to do so by applicable law, in which case Recruiti AI shall inform the Customer of that legal requirement before processing unless prohibited by law;
  • ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
  • implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures described in Section 5 of this DPA;
  • not engage a sub-processor without prior specific or general written authorisation of the Customer, and where general authorisation is given, inform the Customer of any intended changes and give the Customer the opportunity to object;
  • assist the Customer, by appropriate technical and organisational measures, in fulfilling the Customer's obligation to respond to requests for exercising data subjects' rights;
  • assist the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 of the GDPR, including in relation to security, breach notification, data protection impact assessments, and prior consultation;
  • at the Customer's choice, delete or return all personal data to the Customer after the end of the provision of Services relating to processing, and delete existing copies unless applicable law requires storage of the personal data; and
  • make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in this DPA, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

4. Customer Obligations

The Customer represents, warrants, and undertakes that:

  • it has a lawful basis under applicable law for all personal data it submits to the Services for processing, including appropriate consent from interview participants where required;
  • it has provided or will provide all required notices to data subjects regarding the processing of their personal data, including notice of recording where applicable;
  • it is responsible for ensuring that its instructions to Recruiti AI comply with applicable data protection law; and
  • it will promptly notify Recruiti AI if it becomes aware that any processing instruction infringes applicable data protection law.

5. Security Measures

Taking into account the state of the art, implementation costs, the nature and scope of processing, and the risks to data subjects, Recruiti AI shall implement and maintain appropriate technical and organisational measures designed to protect personal data in accordance with GDPR Article 32.

Those measures may include, as appropriate, encryption, access controls, logical separation of customer data, resilience and recovery measures, security monitoring, and periodic assessment of safeguards. Recruiti AI may update these measures as technology, risks, and the Services evolve, provided that the overall level of protection is not materially reduced.

Recruiti AI shall notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf and shall provide information reasonably available to assist the Customer in meeting its applicable notification obligations.

6. Sub-Processors

The Customer hereby grants general authorisation to Recruiti AI to engage sub-processors. Recruiti AI maintains a current list of sub-processors and will provide it on request at privacy@recruiti.io. Recruiti AI will inform the Customer of any intended changes to that list before a new or replacement sub-processor begins processing the Customer's personal data, giving the Customer a reasonable opportunity to object on data protection grounds. The parties will work in good faith to resolve any such objection.

Recruiti AI shall impose data protection obligations on all sub-processors that are equivalent to those set out in this DPA. Recruiti AI shall remain fully liable to the Customer for the performance of a sub-processor's obligations to the extent that Recruiti AI is required to perform those obligations under this DPA.

7. International Data Transfers

Recruiti AI shall comply with applicable restrictions on international transfers of personal data. Where personal data is transferred from the EEA to a country not covered by an adequacy decision, Recruiti AI shall use an appropriate transfer mechanism, such as the relevant Standard Contractual Clauses, and implement supplementary safeguards where required by applicable law. To the extent the Standard Contractual Clauses apply and conflict with this DPA, those clauses shall prevail.

8. Data Subject Rights

Recruiti AI shall, to the extent reasonably practicable, assist the Customer in responding to requests from data subjects exercising their rights under the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection). Where Recruiti AI receives a request directly from a data subject in relation to data processed on behalf of the Customer, Recruiti AI shall promptly notify the Customer and shall not respond to the request without the Customer's prior written authorisation, unless required to do so by law.

9. Data Retention and Deletion

Recruiti AI shall retain personal data processed on behalf of the Customer only for as long as needed to provide the Services, follow the Customer's documented instructions and retention settings, or comply with applicable law.

On expiry or termination of the Terms of Service, Recruiti AI shall, at the Customer's choice, delete or return personal data processed on the Customer's behalf, subject to any retrieval period described in the Terms of Service and unless applicable law requires continued retention.

10. Audits

Recruiti AI shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA. At the Customer's reasonable written request, Recruiti AI shall cooperate with proportionate audits or inspections required under GDPR Article 28. The parties shall agree reasonable scope, timing, confidentiality, and security arrangements, taking into account available independent reports or certifications and the need to avoid unnecessary disruption to the Services or other customers.

11. Liability

Each party's liability under or in connection with this DPA is subject to the limitations of liability set out in the Terms of Service. Nothing in this DPA limits either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any liability that cannot be excluded or limited under applicable law, including obligations arising under the GDPR.

12. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the Republic of Lithuania and, where applicable, the law of the European Union. Any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the courts of the Republic of Lithuania, without prejudice to the mandatory jurisdiction of any supervisory authority.

13. Contact

Questions regarding this DPA or data processing activities should be directed to:

Recruiti AI
Email: support@recruiti.io
Website: recruiti.io

Recruiti AI · recruiti.io · support@recruiti.io