Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (the “Customer”) and OLOG N Solutions Technology LLP (“LessRounds”). It applies whenever LessRounds processes personal data on your behalf. It takes effect automatically when you accept the Terms; if you need a countersigned copy, email privacy@lessrounds.ai.

1. Roles

For candidate personal data collected through your interviews, and personal data about your team inside your workspace, you are the controller (or data fiduciary) and LessRounds is your processor. Each party will comply with the data protection laws that apply to it, including, where relevant, the EU GDPR, UK GDPR, India’s DPDP Act 2023 and US state privacy laws.

2. What we process

• Data subjects: candidates who take your interviews; your team members.
• Categories: names, email addresses, phone numbers, screening answers, uploaded documents (such as résumés), audio and video recordings, transcripts, AI evaluations, notes and status history, technical and log data.
• Purpose: to provide LessRounds under the Terms: hosting interviews, transcribing, evaluating and displaying results, and supporting and securing the service.
• Duration: for the term of the Terms, then until deleted under section 9.

We don’t intend to process special categories of data. Please don’t ask candidates for them unless the law allows it and it’s necessary for the role.

3. Our commitments

LessRounds will:

1. process personal data only on your documented instructions, which are the Terms, this DPA and your use of the product, unless the law requires otherwise (and we’ll tell you if so, where allowed);
2. ensure people authorized to process the data are bound by confidentiality;
3. apply the security measures in section 6;
4. use subprocessors only as set out in section 5;
5. help you respond to data subject requests, taking into account the nature of the processing;
6. help you with security, breach notification, impact assessments and prior consultations, as far as reasonably possible;
7. delete or return personal data at the end of the service, as set out in section 9;
8. make available the information needed to show compliance with this DPA, and allow for reasonable audits as set out in section 10.

We won’t sell the personal data, use it to train AI models, or combine it with data from other customers.

4. Your commitments

You’re responsible for having a lawful basis to collect candidate data, giving candidates the notices the law requires, and making sure your instructions to us are lawful.

5. Subprocessors

You authorize us to use the subprocessors listed on our subprocessors page. We will give at least 30 days’ notice of a new subprocessor by updating that page and emailing account admins. You may object on reasonable data-protection grounds; if we can’t address the objection, you may stop using the affected part of the service and close your account. We impose data-protection terms on each subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

6. Security

We maintain technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS) and at rest;
• passwordless sign-in with hashed, expiring one-time codes, and session tokens stored only as hashes;
• logical separation of each customer’s data, enforced on every database query;
• private object storage for recordings and documents, reachable only through short-lived signed links;
• role-based access within your workspace, and restricted, logged access for our own staff;
• monitoring, logging and regular updates of our systems.

More detail is on our security page.

7. Personal data breaches

We’ll notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data. We’ll give you the information we reasonably can to help you meet your own obligations, and take reasonable steps to contain it.

8. International transfers

Your data is primarily hosted in India. Some subprocessors process data in the United States. Where personal data subject to the EU GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module Two, controller to processor, or Module Three where applicable) and, for UK data, the UK International Data Transfer Addendum, are incorporated into this DPA by reference.

9. Deletion and return

Recordings, transcripts and evaluations are kept for up to 3 years unless you ask for earlier deletion. When your account closes, or at your request, we’ll delete your personal data within 90 days, unless the law requires us to keep it. Before then, you can ask for an export.

10. Audits

On written request, no more than once a year, we’ll answer a reasonable security questionnaire and provide information needed to demonstrate compliance with this DPA. Further audits can be agreed in writing, at your cost, with reasonable notice and confidentiality.

11. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms, this DPA wins for matters of data protection.

12. Contact

Privacy questions: privacy@lessrounds.ai. OLOG N Solutions Technology LLP, Vaishali, Ghaziabad, Uttar Pradesh, India.