Data Processing Agreement (DPA)

This data processing agreement (hereinafter the “DPA”) governs the processing of personal data carried out by CVpass (hereinafter “the Processor”) on behalf of the business customer that has subscribed to a B2B plan (hereinafter “the Controller”), in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

It supplements the B2B General Terms of Use and prevails over them in the event of any discrepancy concerning data protection.

• Nature and purpose: CV analysis, ATS scoring, AI-assisted rewriting, PDF generation, management of member accounts and aggregated usage statistics.
• Categories of data: identification data (last name, first name, work email), CV content (career history, skills, education), content of uploaded job postings, usage metadata.
• Categories of data subjects: members of the client organisation (employees, students, candidates receiving support).
• Duration: for the entire term of the contract, plus a maximum retention period of 30 days after termination for technical data and 6 months for billing data, in accordance with legal obligations.

CVpass undertakes to:

• Process the data only on documented instructions from the Controller, unless otherwise required by law.
• Guarantee the confidentiality of the data and ensure that authorised persons are bound by an obligation of confidentiality.
• Implement the technical and organisational measures described in Article 6.
• Assist the Controller in complying with its obligations (responses to data subject rights, impact assessments, breach notifications).
• Upon expiry of the contract, delete or return all data within 30 days, and destroy backup copies within a reasonable period not exceeding 90 days.

The Controller authorises CVpass to engage the following subprocessors:

• Vercel Inc. (United States, DPF framework) — application hosting, delivery and serverless functions.
• Supabase Inc. (Germany, Frankfurt) — PostgreSQL database and file storage.
• Clerk Inc. (United States, DPF framework) — authentication and organisation management.
• OpenAI, LLC (United States, DPF framework) — semantic analysis and AI rewriting. No data is used for training purposes; retained by OpenAI for 30 days maximum (abuse monitoring).
• Stripe Inc. (United States / Ireland) — payment processing and billing.
• Brevo (formerly Sendinblue) (France) — transactional email delivery.

Any change to this list will be notified to the Controller by email with 30 days' notice, allowing it to object on legitimate grounds.

Data transfers to the United States are governed by the European Commission's Standard Contractual Clauses (SCCs) and by the Data Privacy Framework where the subprocessor is certified under it.

• TLS 1.2+ encryption in transit and encryption at rest on the database.
• Strict separation of data by organisation (org_id).
• Strong multi-factor authentication available for administrators.
• Logging of administrator access, and access only through an encrypted tunnel.
• Encrypted daily backups with 7-day retention.
• CV or job posting data sent to OpenAI is not used for training and is deleted by OpenAI within 30 days maximum.

CVpass will notify the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, by email to the designated contacts in the organisation.

Once a year and with reasonable notice, the Controller may request an audit report or documentation of the security measures. An on-site audit may be carried out at the Controller's expense, while respecting the confidentiality of other customers.

CVpass provides the Controller with the tools needed to respond to requests from data subjects (access, rectification, erasure, portability, objection). Requests received directly by CVpass will be forwarded to the Controller within 5 business days.

Data Protection Officer: dpo@cvpass.fr.

This DPA is accepted by default upon subscription to a B2B plan. A bilaterally signed version can be provided on request at legal@cvpass.fr.