Data Processing Agreement

1. Parties and roles

This Data Processing Agreement ("DPA") is between the Customer (the Organisation using the Platform) and Magellanix Technology Solutions Private Limited, registered office 2/534, Sundeep Road, Neelangarai, Chennai - 600115, Tamil Nadu, India ("BlinkCV"). BlinkCV is a product operated by Magellanix Technology Solutions Private Limited, a company incorporated in India.. It forms part of the Recruiter Terms & Conditions.

For Candidate Data processed for the Customer's recruitment, the Customer is the controller (data fiduciary) and BlinkCV is the processor. For account, billing and security data about its own Users, BlinkCV acts as an independent controller as described in the Privacy Policy.

2. Processing instructions

BlinkCV processes Customer personal data only on the Customer's documented instructions, which include using the Platform's features and these Terms, unless the law requires otherwise; in that case BlinkCV will tell the Customer unless the law forbids it.

3. Details of processing

Categories of data subjects:

• Candidates who apply to the Customer's jobs
• The Customer's Users (Owners, Recruiters, Hiring Managers)

Categories of personal data:

• Identity and contact details
• CVs, employment and education history, skills
• Career Snapshots and screening answers
• Recruitment stage, interview details, notes, Hiring Scores and Candidate Intelligence outputs
• Technical and audit log data

Purposes: hosting and operating recruitment workflows, AI-assisted evaluation, communications, security and support.

4. Responsibilities

Customer responsibilities:

• Have a lawful basis and give candidates any required notices
• Use Candidate Data only for recruitment
• Control who in its organisation has access
• Make final hiring decisions with human review

BlinkCV responsibilities:

• Process data only on the Customer's instructions
• Keep each Customer's data separate and secure
• Bind its personnel to confidentiality
• Assist with data subject requests and breach notification

5. Confidentiality

Anyone authorised by BlinkCV to process Customer personal data is bound by confidentiality obligations.

6. Security

BlinkCV maintains appropriate technical and organisational measures, including tenant isolation, role-based access control, encryption in transit, audit logging and rate limiting. BlinkCV currently does not represent that the Recruiter Platform is certified or attested against a specific security or compliance standard unless expressly stated by BlinkCV.

7. Subprocessors

The Customer authorises BlinkCV to use subprocessors for hosting, database, email delivery, payments and AI processing. Currently confirmed providers: Razorpay (payments), Google (Google Sign-In authentication), Cloudflare (security, traffic management and content delivery) and OpenAI (gpt-6-astra, AI processing). The Recruiter Platform's production database is hosted on managed cloud PostgreSQL deployed on dedicated cloud infrastructure in the AWS Asia Pacific (ap-northeast-1) region. BlinkCV will bind subprocessors to data protection obligations no less protective than this DPA and will give notice of material changes.

8. Incident and breach notification

If BlinkCV becomes aware of a confirmed personal data breach affecting Customer Data, BlinkCV will notify the Customer without undue delay and provide information reasonably available to BlinkCV that is necessary to assist the Customer in meeting applicable legal obligations.

Where notification to authorities or affected individuals is legally required, BlinkCV will comply with applicable law.

9. Data subject rights assistance

BlinkCV will forward requests it receives about Customer data to the Customer and will reasonably assist the Customer in responding.

10. Deletion, return, retention and backups

At the Customer's written request to info@blinkcv.ai, BlinkCV will return Customer personal data where reasonably practicable, subject to applicable law.

Following termination or expiry of the applicable Customer subscription, BlinkCV will retain applicable Customer Data for up to 6 years where required under BlinkCV's applicable retention policy, contractual obligations, legal requirements, dispute resolution, security or legitimate business requirements. After the applicable retention period, data will be deleted, anonymized or otherwise disposed of in accordance with BlinkCV's retention and deletion procedures.

• Recruiter account data: 6 years
• Candidate/Application data: 6 years
• Closed jobs: 1 year
• Logs/Security records: 1 year
• Billing/Payment records: 6 years

Backup copies may be retained for up to 90 days as part of normal backup, disaster-recovery and business-continuity processes. Backup retention does not mean deleted data remains actively available to users.

11. Government requests

If a public authority requests Customer data, BlinkCV will, where legally permitted, notify the Customer and disclose only what is legally required.

12. International transfers

The Recruiter Platform's production database is hosted on managed cloud PostgreSQL deployed on dedicated cloud infrastructure in the AWS Asia Pacific (ap-northeast-1) region. Where Customer data is processed outside India, BlinkCV will use safeguards required by applicable law. Third-party services may process data according to their applicable infrastructure and contractual arrangements.

13. Audits and cooperation

BlinkCV will make available information reasonably necessary to show compliance with this DPA and cooperate with reasonable audits, subject to confidentiality and reasonable notice.

14. Liability

Liability under this DPA is subject to the limitations in the Recruiter Terms & Conditions, except where the law does not allow them.

15. Term

This DPA lasts for as long as BlinkCV processes Customer personal data.

16. Precedence

If this DPA conflicts with the Recruiter Terms & Conditions on data protection, this DPA prevails. A signed customer agreement prevails over both where it says so.

17. Contact

DPA questions and requests: info@blinkcv.ai.