Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service between Catalyst AI & Tech, LLC ("Catalyst," the processor) and the organisation that holds an organisation account on Catalyst Interviews ("Customer," the controller). It applies to the processing of Customer Personal Data that Catalyst carries out on Customer's behalf and forms part of the agreement between the parties.

The DPA applies automatically when Customer accepts the Terms, creates an organisation account or subscribes, without a separate signature. A countersigned copy is available on request at privacy@catalystai.llc. If the DPA and the Terms conflict on the processing of Customer Personal Data, the DPA prevails.

This DPA does not apply to personal data for which Catalyst is a controller in its own right, such as a candidate's own account and practice data, and Catalyst's billing, security and service-improvement records. Those are described in the Privacy Policy.

In this DPA:

• Customer Personal Data means personal data that Customer or its members submit to the Service, or that the Service generates for Customer, in order to recruit. It includes candidate names and email addresses, CVs that Customer uploads, job and assignment records, pipeline stages, invitation records and Customer's member details. It also includes, only for a candidate who has agreed to share their result with Customer, that candidate's interview result, integrity signals and recording.
• Data Protection Law means the laws on the protection of personal data that apply to the processing, including Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and Egypt's Law No. 151 of 2020 on the Protection of Personal Data.
• Subprocessor means a third party that Catalyst engages to process Customer Personal Data.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• The terms controller, processor, data subject, personal data and processing have the meanings given in Data Protection Law.

Customer is the controller of Customer Personal Data and Catalyst is its processor. Customer's instructions are this DPA, the Terms and Customer's use and configuration of the Service. Catalyst will process Customer Personal Data only on those documented instructions, unless the law requires otherwise, and will tell Customer if it believes an instruction infringes Data Protection Law.

Annex A describes the processing. A candidate decides whether to take an interview and whether to share its result. When a candidate shares a result, Customer receives it as controller from that point. For a candidate's own account and practice data, Catalyst decides the purposes and means as controller, as set out in the Privacy Policy.

Customer will:

• have a lawful basis for instructing the processing of Customer Personal Data, and give candidates the notices that Data Protection Law requires about its own use of their data;
• not upload data it has no right to upload, and not upload special categories of data (such as health data or political opinions) unless it is necessary and lawful;
• respect the choices the Service records for candidates, including a candidate's decision to decline recording, monitoring or coaching, and not treat that decision as adverse;
• configure retention for its candidate records and keep its members' access appropriate to their role;
• answer requests from candidates about its own use of their data.

Catalyst will:

• process Customer Personal Data only on Customer's documented instructions;
• ensure that people authorised to process it are bound by confidentiality;
• apply the security measures in Annex B;
• engage Subprocessors only under section 7;
• help Customer respond to data-subject requests (section 6) and, on request and taking into account the nature of the processing, with data protection impact assessments and prior consultation;
• tell Customer without undue delay if it receives a request or complaint about Customer Personal Data directly from a data subject, and not respond to it except on Customer's instructions or as the law requires;
• make available the information reasonably needed to show compliance with this DPA (section 11).

Catalyst provides tools in the Service for organisation administrators to export or erase a candidate's record and to set retention periods. Customer should use them to answer data-subject requests. If a data subject contacts Catalyst about Customer Personal Data, Catalyst will direct them to Customer.

Candidate-initiated erasure. When a candidate erases their own Catalyst account, the records that every Organisation holds about that candidate are erased too, as described in the Privacy Policy. Customer acknowledges that Catalyst will carry out that erasure without asking Customer first, and that the Service keeps only de-identified scores, timings and codes, and the financial and audit records described in the Privacy Policy.

Customer gives Catalyst general authorisation to engage Subprocessors. The current list, with each Subprocessor's purpose, the data it receives and its region, is on the subprocessors page.

Catalyst will give Customer at least 30 days' notice of any addition or replacement of a Subprocessor, by email to the organisation's administrators and by updating that page. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected subscription by written notice, and Catalyst will refund fees prepaid for the period after termination.

Catalyst imposes on each Subprocessor data-protection obligations no less protective than this DPA and remains responsible for their performance.

Catalyst stores Customer Personal Data in Frankfurt, Germany, and uses Subprocessors in the countries listed on the subprocessors page, including the United States. Customer authorises those transfers.

Where Customer Personal Data subject to the GDPR or the UK GDPR is transferred to a country without an adequacy decision, the SCCs apply and are incorporated by reference: Module Two (controller to processor), or Module Three (processor to processor) where Customer acts as a processor. The options are: clause 7 (docking clause) included; clause 9(a) Option 2 (general authorisation) with the notice period in section 7; clause 11 optional language not included; clause 17 the law of an EU Member State (to be confirmed); clause 18 the courts of an EU Member State (to be confirmed). Annex I of the SCCs is Annex A, Annex II is Annex B, and Annex III is the subprocessors page. For transfers subject to the UK GDPR the UK Addendum applies, with these terms as its tables. If the SCCs conflict with this DPA, the SCCs prevail.

Transfers of Customer Personal Data out of Egypt are made only in line with Law No. 151 of 2020, including its conditions on the level of protection and any authorisation it requires.

Catalyst implements and maintains the technical and organisational measures in Annex B and reviews them as the Service changes. Catalyst may update them if the update does not reduce the overall level of protection.

Catalyst will notify Customer's organisation administrators without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Catalyst will keep Customer informed, help it meet its own notification duties to regulators and data subjects, and take reasonable steps to contain and remediate the breach.

On request, Catalyst will give Customer the information reasonably necessary to show compliance with this DPA, including a summary of its security measures. Customer may audit Catalyst's compliance once a year, and additionally after a Personal Data Breach or where a regulator requires it, on at least 30 days' written notice, during business hours, subject to confidentiality, without unreasonable disruption and at Customer's cost. Catalyst may satisfy an audit request with a recent independent report or certification where one is available.

Customer can export candidate records and results from the Service at any time. When the agreement ends, or on Customer's written request, Catalyst will delete Customer Personal Data within 30 days, or return it in a common format first if Customer asks, unless the law requires it to be kept. Backups are overwritten in the ordinary course. Recordings are deleted automatically no later than 90 days after the interview, whatever else happens.

Each party's liability under this DPA is subject to the limitation of liability in the Terms, to the extent the law allows. Nothing in this DPA limits liability that cannot be limited by law, or a data subject's rights under the SCCs.

This DPA is governed by the law that governs the Terms, except that the SCCs are governed as stated in section 8. Disputes are resolved as the Terms provide, subject to mandatory Data Protection Law and to the forum stated for the SCCs. This DPA stays in force for as long as Catalyst processes Customer Personal Data.

Questions about this DPA, requests for a countersigned copy and notices under it: privacy@catalystai.llc.

Catalyst AI & Tech, LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr, Suite 305, Newark, Delaware 19713, County of New Castle

• Subject matter and duration: hosting and processing Customer Personal Data to provide the Service, for as long as Customer uses the Service and until deletion under section 12.
• Nature and purpose: storing, retrieving, displaying and transmitting candidate and member records; sending invitation and reminder emails; running AI-scored interviews and producing reports; where the candidate chooses it, streaming, storing and playing back recordings and recording integrity signals; billing administration.
• Data subjects: candidates whom Customer invites or imports, and Customer's members (administrators, recruiters and viewers).
• Categories of personal data: names, email addresses, CVs and their parsed content, job and assignment data, interview scores, reports and per-question feedback (including short quotes from the candidate's answers that support each score), the full transcript of an invited interview where the candidate's consent notice disclosed it, and timings; member roles and email addresses; invitation and email delivery records. With the candidate's consent: integrity signals (codes, times and durations) and audio-video recordings.
• Sensitive data: not intentionally collected. A recording may show a person's appearance and voice. Customer must not use the Service to seek special categories of data.
• Frequency: continuous, for the duration of the subscription.
• Retention: according to Customer's retention settings and section 12; recordings no more than 90 days after the interview; candidate records erased on Customer's request or a candidate's erasure request.
• Subprocessors: as listed on the subprocessors page, including the recording server in Stockholm and storage in Frankfurt.

• Access control: row-level security on every database table with deny by default; role-based access (administrator, recruiter, viewer); recordings limited to administrators and recruiters; least-privilege access for Catalyst staff.
• Encryption: TLS in transit; encryption at rest provided by our infrastructure providers; private storage buckets with short-lived signed links (five minutes at most) for recordings and exports.
• Secrets and keys: service credentials are kept in server-side functions and are never sent to browsers.
• Logging and integrity: a tamper-evident, append-only audit log of organisation actions, an entry written before every recording playback, and a hash computed for each recording on receipt.
• Data minimisation: integrity signals carry only codes, times and counts, never screen images, keystrokes or answer text; camera analysis runs on the candidate's device; self-uploaded CVs are not exposed to organisations; the full transcript of an invited interview is shown only to the inviting organisation's members, only where the candidate's consent notice disclosed it, and every read is recorded in the organisation's audit log.
• Retention and deletion: the recording retention limit is enforced in the database; export and erasure tooling exists for candidate records; export files expire after 7 days.
• Resilience: provider-managed backups and recovery; error monitoring that carries no personal data.
• Development and operations: code review, automated tests including access-control tests against a real database, dependency updates and operational runbooks.
• Personnel: confidentiality obligations for people with access to Customer Personal Data.