Data processing addendum

This data processing addendum (the “DPA”) is between Surf Platforms Inc., a corporation organized under the laws of the State of Delaware with its principal place of business in San Jose, California (“Elsin”) and the customer that has agreed to Elsin's terms of service (the “Customer”). It forms part of those terms (the “Agreement”) and applies automatically from the day the Customer starts using Elsin. A countersigned copy is available on request at contact@surfplatforms.com.

If this DPA conflicts with the Agreement on the processing of personal data, this DPA wins. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses win.

• Data Protection Laws: all laws on the processing of personal data that apply to a party's processing of Customer Personal Data, including the GDPR, the UK GDPR, the California Consumer Privacy Act as amended (“CCPA”), other US state privacy laws, and biometric privacy laws such as the Illinois Biometric Information Privacy Act.
• Customer Personal Data: personal data that Elsin processes on the Customer's behalf in providing the service, as described in Annex I.
• Controller, processor, data subject, personal data, processing, supervisory authority: as defined in the GDPR. “Controller” includes a “business” and “processor” includes a “service provider” under the CCPA.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs: the standard contractual clauses approved by European Commission Decision (EU) 2021/914. UK Addendum: the International Data Transfer Addendum issued by the UK Information Commissioner.
• Sub-processor: a third party Elsin engages to process Customer Personal Data.

For Customer Personal Data, the Customer is the controller (or a processor acting for its own controller) and Elsin is its processor (or sub-processor). Annex I sets out the subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects.

Elsin acts as an independent controller, under its privacy policy, for:

1. candidates' own Elsin accounts, their reusable identity verification and their consent records, which the candidate controls and chooses to share with employers;
2. keyed codes derived from Customer Personal Data and used across customers to detect identity fraud, which return only counts to any customer;
3. Customer users' accounts, billing, security logs and support.

The Customer authorises the processing in point (b), which protects all customers from fraud, and confirms that its notices to candidates allow it.

Elsin processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's use and configuration of the service (including its settings, integrations, API keys and AI agents) are the Customer's complete instructions. Elsin will tell the Customer if it believes an instruction breaks Data Protection Laws, and may suspend that processing until the instruction is changed. If the law requires Elsin to process Customer Personal Data otherwise, Elsin will tell the Customer first unless the law forbids it.

The Customer is responsible for the lawfulness of its instructions, for having a lawful basis and giving the notices Data Protection Laws require, and for the accuracy of Customer Personal Data.

Where the CCPA or a similar US state law applies, Elsin is a service provider or processor and will not:

• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• keep, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with the Customer, except as the CCPA permits, including to detect security incidents and protect against fraud;
• combine it with personal data Elsin receives from or for others, except as the CCPA permits for those purposes.

Elsin will comply with the obligations that apply to it, give the same level of protection the law requires, and tell the Customer if it can no longer meet them. The Customer may take reasonable steps to stop and remedy unauthorised use. Elsin certifies that it understands and will comply with these restrictions.

Elsin ensures that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide, secure or support the service.

Elsin implements and maintains appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to people. The measures in place today are in Annex II. Elsin may update them, but will not materially reduce the overall protection they give.

1. The Customer gives Elsin general authorisation to engage sub-processors. The current ones are in Annex III and on the sub-processors page.
2. Elsin will update that page at least 30 days before a new sub-processor starts processing Customer Personal Data, and will email Customers that ask to be told.
3. The Customer may object on reasonable data protection grounds within those 30 days. The parties will discuss it in good faith. If Elsin cannot offer a reasonable alternative, the Customer may end the affected part of the service and receive a refund of prepaid fees for it.
4. Elsin will put in place, with each sub-processor, written terms that protect Customer Personal Data at least as well as this DPA, and remains responsible to the Customer for each sub-processor's performance.

Services the Customer connects (such as its applicant tracking system, background-check provider, HR system, calendar, video meetings or chat tool) are not Elsin's sub-processors. Elsin exchanges data with them on the Customer's instruction, under the Customer's own agreement with each.

Elsin processes Customer Personal Data in the United States. Elsin is not currently offered to customers in the European Economic Area, the United Kingdom or Switzerland. Where a transfer of Customer Personal Data to Elsin is nonetheless subject to the GDPR or UK GDPR, the parties agree that:

1. the SCCs are incorporated into this DPA: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. The Customer is the data exporter and Elsin the data importer;
2. in the SCCs, Clause 7 (docking) applies; under Clause 9(a), Option 2 (general authorisation) applies with the notice period in section 8; the optional language in Clause 11 does not apply; under Clause 13, the supervisory authority is the one that the Clause identifies for the data exporter, or the Irish Data Protection Commission where none is identified; under Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland;
3. Annexes I, II and III of this DPA complete the corresponding annexes of the SCCs;
4. for transfers subject to the UK GDPR, the UK Addendum applies, completed with the information in this DPA, and either party may end it as its Section 19 allows;
5. for transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

If Elsin receives a request from a data subject about Customer Personal Data, it will pass it to the Customer without undue delay and will not answer it except to say it has been passed on, unless the Customer asks it to.

Taking into account the nature of the processing, Elsin will help the Customer answer requests to access, correct, delete, restrict, port or object, through the following:

• in the product: viewing and editing candidate records; deleting a single candidate, in the app, through the API or through the MCP server, which deletes that candidate's data in the Customer's workspace, stored files included; the per-hire data packet download; the full workspace export; the candidate's own download, consent withdrawal and account deletion; and automatic deletion of candidates whose applications have all been closed for a period the Customer sets;
• on request, for anything the product does not do itself, or if the Customer prefers, including deleting or exporting a single candidate's data: Elsin will do it within 10 business days of the Customer's written instruction to contact@surfplatforms.com.

Elsin will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as Elsin then knows, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. Elsin will update the Customer as it learns more, take reasonable steps to contain and remedy the breach, and help the Customer meet its own duties to notify authorities and people. Notifying a breach is not an admission of fault.

Elsin will give the Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities about the service, using the information in this DPA, the privacy policy, the biometric data policy and, where needed, further information Elsin holds.

1. At any time, a workspace owner can download an export of the workspace's Customer Personal Data, with its stored files, in common machine-readable formats (JSON and CSV), and can delete the workspace. Deletion takes effect after a 30-day grace period, during which any owner can cancel it; Elsin then deletes the workspace's Customer Personal Data, including stored files, from its production systems.
2. For 30 days after the Agreement ends, the Customer may also ask Elsin at contact@surfplatforms.com for an export of Customer Personal Data in a common machine-readable format, and Elsin will provide it.
3. Within 30 days after that period, or sooner if the Customer asks, Elsin will delete Customer Personal Data, including stored files, from its production systems. Deleted data rolls off our database backups within 7 days, inside that 30-day period, as those backups expire, and backups are never restored for use.
4. Elsin may keep Customer Personal Data the law requires it to keep, protected under this DPA, for as long as the law requires.
5. Data Elsin controls itself (section 3) is not part of this deletion and is handled under the privacy policy.

Elsin will make available the information reasonably needed to show that it meets this DPA, including written answers to reasonable security questionnaires. Elsin does not currently hold a third-party security certification or audit report.

If that information is not enough, or a supervisory authority requires it, the Customer (or an independent auditor it appoints, bound by confidentiality and not a competitor of Elsin) may audit Elsin's compliance with this DPA once a year, on at least 30 days' written notice, during business hours, in a way that does not disrupt the service or reveal other customers' data. The Customer bears its own costs. Audits under the SCCs are carried out the same way.

Each party's liability under this DPA is subject to the limits and exclusions in the Agreement, except where Data Protection Laws or the SCCs do not allow it. This DPA lasts as long as Elsin processes Customer Personal Data, and the duties that by their nature should survive do so. It is governed by the law that governs the Agreement, except that the SCCs are governed as section 9 says. Surf Platforms Inc. may update this DPA to reflect changes in law or the service, without reducing its protection, by publishing a new version here.