Data processing agreement (GDPR art. 28)
Governs the processing of candidates' CVs that an agency uploads to Passform. The agency is the controller; Hyperion S.r.l. processes them on its behalf as processor.
Parties
Controller: the company named at acceptance, holder of the Operator account (the "Customer").
Processor: Hyperion S.r.l., registered at Piazza Santo Stefano 6, 20122 Milano (MI), Italy, VAT 14450290961, business register MI - 2784883, certified email hyperionsrl@pecaruba.it.
This agreement supplements the Terms of service. It is concluded by electronic acceptance on the Account page; we keep the date, time, account, company named and version of the text.
Subject and duration
The Processor processes the data only to provide Passform: extracting the text of the CV, structuring it as a Europass, anonymising it at the level the Customer chooses, generating the documents, archiving them and matching them against open positions.
The agreement lasts as long as the service is used. Confidentiality and deletion obligations remain until the data has been erased.
Data and data subjects
Data subjects: the candidates whose CVs the Customer uploads, and the Customer's staff who use the account.
Data: identity and contact details, job title, experience, education, skills, languages and anything else the CV contains. The service does not ask for special categories of data; they may appear if the CV contains them.
Retention: the uploaded file is deleted right after conversion; generated documents are kept for 180 days on a paid plan and 30 days on the free plan; a log line with no name or contact details remains afterwards; backups rotate after 30 days.
Customer's obligations
The Customer warrants that it has a legal basis for every CV it uploads and has informed the candidates, including about the use of service providers.
It uploads only the data needed for recruitment, chooses the anonymisation level suited to how the document will be used, and handles candidates' requests itself.
Processor's obligations
The Processor processes the data only on the Customer's documented instructions: this agreement, the Terms and the settings chosen in the service. If an instruction appears to breach the GDPR, it says so.
It does not use the data for its own purposes, does not sell it and does not use it to train models. A Customer's data is visible only from its own account, except for the expressions of interest the Customer chooses to send.
Only people bound by confidentiality are authorised to process the data, and the record required by GDPR art. 30.2 is kept.
Security
The Processor applies measures appropriate to the risk (GDPR art. 32), including: HTTPS only; data on Microsoft Azure in the European Union, encrypted at rest; Google, Microsoft or verified-email sign-in and signed sessions; API tokens stored only as a hash; separation between accounts checked by automated tests; automatic deletion; usage limits; verified nightly backups.
Measures may be updated provided overall protection does not decrease.
Sub-processors
The Customer authorises: Anthropic PBC (United States), which structures the CV text with the Claude model; Microsoft Ireland Operations Ltd (Azure, European Union), which hosts the application and data and, for staff who choose it, provides Microsoft sign-in; Google Ireland Ltd, for Google sign-in by the Customer's staff; Supabase Inc. (United States, data in the European Union), which runs sign-in for the Customer's staff and receives only their email and name.
Any change is announced by email at least 30 days in advance. The Customer may object on data protection grounds and, if no solution is found, terminate without penalty with a refund of the unused fee.
Each sub-processor is bound by equivalent obligations; the Processor remains liable to the Customer for them.
Transfers outside the EU
The only transfer outside the European Economic Area is sending the CV text to Anthropic in the United States. It relies on the EU–US Data Privacy Framework or, failing that, on the European Commission's Standard Contractual Clauses. Supabase keeps sign-in data in the European Union; any access from the United States by the company is covered by the Standard Contractual Clauses.
Anthropic does not use data received through its API to train its models.
Candidates' requests
The Customer can delete a CV and its documents, and download its data, from the archive on its own.
If a candidate writes to the Processor, the request is forwarded to the Customer within 5 working days. For anything the Customer cannot do itself, the Processor assists within 10 working days.
Personal data breaches
The Processor notifies the Customer of any breach affecting its data within 36 hours of becoming aware of it, with the information available, and assists with the notifications required by GDPR arts. 33 and 34.
Impact assessment and audits
On request the Processor provides the information needed for a data protection impact assessment. Match scores are a sorting aid, not an automated decision under GDPR art. 22.
The Customer may ask for documentation of the measures in place and carry out one audit a year, with 30 days' notice, without access to other customers' data.
End of the relationship
When the account is closed the Customer has 30 days to download its documents; the Processor then deletes all the data, except what the law requires it to keep. Copies in backups are deleted as they rotate, within 30 days.
On request the Processor confirms the deletion in writing.
Final provisions
Each party is liable for damage caused by breaching its own obligations, under GDPR art. 82. On data protection this agreement prevails over the Terms.
Italian law applies. Court of jurisdiction: Milan.