The DPA (Data Processing Agreement) can be viewed and printed from /b2b/dpa. A version signed by both parties is provided on request at legal@cvpass.fr.

CVpass acts as a processor within the meaning of Article 28 of the GDPR. Your organisation remains the controller with respect to the data subjects (students, supported candidates, employees).

Authorised subprocessors (full list in the DPA): Vercel, Supabase, Clerk, OpenAI (no model training), Stripe, Brevo. Any change to this list is notified to you by email with 30 days' notice.

If a data subject sends you a GDPR request (access, rectification, erasure, portability, objection), you are responsible for responding. To carry out the request technically in CVpass, contact dpo@cvpass.fr with the email address concerned. We process requests within 5 business days.

Breach notification: we notify you of any data breach within 48 hours of its discovery, by email to the contacts designated in /b2b/settings.

Data retention: OpenAI keeps the data sent to it for 30 days maximum (abuse monitoring), then deletes it. The CVs and job postings analysed are never used to train models.