Data Processing Addendum

The short version

For company and recruiter accounts, this addendum forms part of our Terms of Service. No signature is needed.
For candidate data you source, import or assess, you're the controller and RuneShips is your processor: we use it only to provide the Service on your instructions.
We never sell candidate data, never combine it across customers, and never use it to train AI models.
We'll tell you without undue delay about a security incident, help you answer candidates' requests, and delete the data when you ask or your account ends.
Transfers from Europe are covered by the EU Standard Contractual Clauses and their UK and Swiss equivalents.

1. Parties and scope

This Data Processing Addendum ("DPA") is between the RuneShips team, based in Arizona, United States ("RuneShips," the "Provider"), and the company or organisation that holds a RuneShips company or recruiter account (the "Customer"). It forms part of the Terms of Service (the "Agreement") and applies automatically when the Customer uses the Service to source, import, contact or assess candidates. If the DPA and the Agreement conflict, the DPA controls; if the Standard Contractual Clauses apply and conflict with either, the Clauses control.

This DPA applies to personal data that RuneShips processes on the Customer's behalf in providing the Service ("Customer Personal Data"): candidates the Customer sources through the extension, applicants imported from the Customer's applicant tracking system, people the Customer invites to assessments, and their assessment work and records. It doesn't cover the Customer's own account data or students' own accounts, for which RuneShips is a controller under its Privacy Policy. This DPA lasts as long as RuneShips processes Customer Personal Data, even after the Agreement ends.

2. Processing details

Item	Details
Roles	Customer: controller (or processor for its own client, in which case RuneShips is a subprocessor). RuneShips: processor
Data subjects	Job candidates and applicants the Customer sources, imports or invites, and people who take the Customer's assessments
Categories of data	Name, profile link, headline, title, employer, location, work and education history and public links as shown in the Customer's sourcing tools; application and résumé text from the Customer's applicant tracking system (read, not stored as files); email address used once to send an invite (not stored); fit scores, reasons and rankings; invite records; assessment answers, grades, feedback and activity records
Sensitive data	None. The Customer won't submit restricted data (Section 6)
Nature and purpose	Sourcing, ranking, inviting and assessing candidates for the Customer's own open roles, on the Customer's instructions
Frequency	Continuous, as the Customer uses the Service
Duration	For as long as the Customer uses the data for the role, and then as set out in Section 10
Subprocessors	As listed in Section 7

3. Instructions

RuneShips processes Customer Personal Data only on the Customer's documented instructions, which are the Agreement, this DPA, and the Customer's use and configuration of the Service, unless the law requires otherwise (in which case RuneShips will tell the Customer first, unless the law forbids it). The Customer instructs RuneShips to process Customer Personal Data to provide the Service. Instructions beyond the Service's scope need a written agreement. RuneShips will tell the Customer if, in its reasonable opinion, an instruction infringes data protection law.

4. Confidentiality and security

RuneShips requires everyone authorised to access Customer Personal Data to keep it confidential, and maintains technical and organisational measures designed to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. They currently include:

Encryption in transit (HTTPS) and at rest, and encryption of stored credentials for connected accounts
Logical separation of each customer's data, enforced by row-level access controls in our database
Access on a need-to-know, least-privilege basis, with individual credentials
Contact details blanked out of profiles before they leave the recruiter's browser, and profile text and résumé files not stored
Hosting with reputable infrastructure providers, and logging of system activity
Prompt investigation of, and response to, suspected security incidents

RuneShips may update these measures as long as overall protection isn't materially reduced. The Customer is responsible for its own use of the Service, including securing its accounts, devices and connected tools, and has assessed that these measures are appropriate for its needs.

Incidents. RuneShips will notify the Customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Customer Personal Data, with the details then known, the steps taken to contain it and any steps the Customer should take, and will reasonably cooperate in the investigation. Notifying isn't an admission of fault. The Customer is responsible for any notices it must give to authorities or individuals, and will consult RuneShips in advance on any notice that names it, where the law allows.

5. Data subject requests and assistance

Taking into account the nature of the processing, RuneShips will give the Customer reasonable assistance in responding to requests from individuals to exercise their rights, and with data protection impact assessments and consultations with authorities that the law requires of the Customer. If RuneShips receives a request about Customer Personal Data, it will tell the Customer (unless the law forbids it) and may direct the individual to the Customer; it may also honour a request to delete the individual's data or stop contacting them, and will tell the Customer when it does. The Customer is responsible for responding to requests it receives. Assistance that goes beyond the Service may be charged at reasonable rates, agreed in advance.

6. Customer responsibilities

The Customer has a valid legal basis for the processing it instructs, including under Articles 6, 9 and 10 of the GDPR where they apply, and has given any notices and obtained any consents the law requires (including under Articles 13 and 14 of the GDPR). RuneShips' candidate notice and the information in every invite help with this, but don't replace the Customer's own obligations.
The Customer will only process candidates' data for genuine roles, in line with the Agreement and with employment, anti-discrimination, anti-spam and privacy laws.
The Customer won't submit restricted data to the Service: government identification numbers, health or medical information, biometric data, financial account or payment card data, passwords for third-party accounts, personal data of anyone under 18, or any special category of personal data.

7. Subprocessors

The Customer generally authorises RuneShips to engage subprocessors. RuneShips binds each subprocessor by written terms that protect Customer Personal Data at least as well as this DPA, to the extent relevant to its services, and stays responsible for its subprocessors' performance. Current subprocessors:

Subprocessor	Location	What it does
InsForge	United States	Database, authentication and file storage
Vercel	United States	Hosting and server logs
OpenAI	United States	AI models for ranking, invites, grading and feedback
TypeSafe (Jev)	United States	Scoring profiles and applications against the Customer's criteria; names are removed before data is sent
Resend	United States	Sending invites in the Customer's name
Google	United States	Sending invites from the Customer's own Gmail, when connected

RuneShips will give the Customer at least 15 days' notice of a new subprocessor by email and by updating this list. If the Customer objects on reasonable data-protection grounds within that time, the parties will try in good faith to resolve it; if they can't, the Customer may, as its sole remedy, terminate the Agreement by written notice.

8. AI and automated processing

RuneShips won't use Customer Personal Data to train, fine-tune or develop any AI or machine-learning model, its own or a third party's, unless the Customer authorises it in writing. RuneShips uses AI subprocessors only to provide the Service. RuneShips doesn't make decisions about candidates: rankings, grades and activity notes are advisory, and the Customer makes every hiring decision. On request, RuneShips will give the Customer meaningful information about the logic involved in rankings and grades, without disclosing trade secrets, and will cooperate where the law gives individuals rights about automated decision-making.

9. Information and audits

RuneShips will make available the information reasonably necessary to demonstrate its compliance with this DPA, usually by answering a written security questionnaire. If the law or a supervisory authority requires more, the Customer may audit RuneShips' compliance up to once a year, at its own cost, on at least two weeks' written notice with a proposed scope and plan, during business hours, without unreasonably disrupting RuneShips, and with any third-party auditor bound by confidentiality and not a competitor. Audit reports may be used only to confirm compliance.

10. Return and deletion

The Customer can remove candidates and lists, and export data, through the Service at any time. When the Customer's account ends, RuneShips will stop processing Customer Personal Data except to return or delete it. On written request within 30 days, RuneShips will return a copy or delete it, as the Customer chooses; otherwise RuneShips will delete or anonymise it within a reasonable time after that period. Data in backups is deleted when the backups expire and isn't used in the meantime. RuneShips may keep data the law requires it to keep, protected and used only for that purpose, and will certify deletion on written request.

11. International transfers

EU. Where processing involves a transfer of personal data subject to the EU GDPR from the Customer to RuneShips in a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, with: Clause 7 (docking) not used; Clause 9 Option 2 (general authorisation), with the notice period in Section 7; the optional language in Clause 11 not used; Clause 17 Option 1, governed by the law of Ireland; Clause 18, the courts of Ireland. Annex I is completed by Sections 1, 2 and 7 of this DPA, with the Customer as data exporter and RuneShips as data importer; Annex II by Section 4. The competent supervisory authority is that of the Member State where the Customer is established or, if it isn't established in the EU, where its EU representative is, or otherwise the one the Customer tells RuneShips in writing.
UK. For transfers subject to the UK GDPR, those Clauses apply as varied by the UK International Data Transfer Addendum issued by the Information Commissioner, with its tables completed by this DPA, and "Importer" chosen in Table 4.
Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, those Clauses apply with references to the GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and individuals in Switzerland able to bring claims there.
RuneShips may replace these mechanisms with any newer lawful transfer mechanism, on notice, if it doesn't materially reduce the protection given.

12. US state privacy laws

For personal information covered by US state privacy laws, RuneShips is the Customer's service provider, contractor or processor. RuneShips won't sell or share it; won't retain, use or disclose it for any purpose other than providing the Service, including any commercial purpose, or outside its direct business relationship with the Customer; and won't combine it with personal information it receives from or for anyone else, or collects itself, except as those laws allow and the Service requires. RuneShips will comply with those laws, give the same level of protection they require, and tell the Customer if it can no longer meet its obligations. The Customer may take reasonable steps to ensure the information is used consistently with its obligations and to stop and remediate unauthorised use. RuneShips certifies that it understands and will comply with these restrictions.

13. General

Each party's liability under this DPA and the Standard Contractual Clauses is subject to the limitations in the Agreement, except that nothing limits an individual's rights under the third-party-beneficiary provisions of those Clauses. RuneShips may update this DPA on notice to keep it compliant with data protection law, without materially reducing the protection it gives or materially increasing the Customer's obligations. RuneShips' access to Customer Personal Data isn't part of the consideration under the Agreement. Notices under this DPA go to the Customer's account email, and to RuneShips at hello@runeships.com.

Parts of this document are adapted from legal templates published by General Legal, PC under CC0 1.0. General Legal hasn't reviewed this document.