1. The parties and what this covers

This Data Processing Agreement ("DPA") is between:

DIGITSOLUTIONS, a société par actions simplifiée registered with the RCS of Rennes under number 977 519 586, whose registered office is at 2 Allée des Terrasses, 35230 Noyal-Châtillon-sur-Seiche, trading as HireCall ("HireCall", the Processor); and

the Customer identified in the order form or account ("Customer", the Controller).

It forms part of the HireCall Terms of Service and applies whenever HireCall processes personal data on the Customer's behalf. Where it conflicts with the Terms of Service on the subject of personal data, this DPA prevails.

"Data Protection Law" means Regulation (EU) 2016/679 (GDPR), the French loi n° 78-17 du 6 janvier 1978 as amended, and any other data protection law applicable to the processing — including, where the Customer processes data about candidates in the United States, applicable US federal and state law.

Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the GDPR.

2. Who is what

The Customer is the controller. It decides which candidates are interviewed, for which roles, against which criteria, and what happens to them afterwards.

HireCall is the processor. It processes candidate personal data only to provide the service, on the Customer's instructions.

HireCall is a controller in its own right for a limited and separate set of data: the Customer's account and billing records, and its own security and service logs. That processing is not governed by this DPA but by HireCall's own privacy notice.

3. Processing on documented instructions

HireCall processes candidate personal data only on the Customer's documented instructions, including as to transfers to a third country, unless required to do otherwise by EU or member state law — in which case HireCall will tell the Customer before processing, unless that law prohibits it.

The Customer's instructions are:

1. this DPA;
2. the Terms of Service;
3. the configuration the Customer chooses in the product — including the region, the roles, the criteria, the questions and the retention period; and
4. any further written instruction the parties agree.

HireCall will tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend the affected processing until it is resolved (Article 28(3), final paragraph, GDPR).

HireCall will not:

• use candidate personal data for its own purposes;
• use candidate personal data to train, fine-tune or evaluate any AI model, whether its own or a third party's;
• sell, rent or share candidate personal data;
• combine candidate personal data with data from other customers, except to produce genuinely anonymous aggregate statistics from which no individual and no customer can be identified.

4. Instructions specific to this service

Because of what the service does, the following are recorded as standing instructions from the Customer and commitments by HireCall.

4.1 Data residency

Candidate recordings, transcripts and briefs are stored in the European Union, and HireCall will not move them outside it without the Customer's written instruction.

4.2 Retention and deletion

Unless the Customer instructs otherwise in writing:

• HireCall deletes candidate audio recordings 90 days after the interview, automatically, by a scheduled purge job that writes a deletion record distinguishing a scheduled purge from an erasure request;
• HireCall deletes candidate transcripts and briefs 12 months after the interview.

HireCall also deletes a candidate's data promptly — and in any event within 30 days — where the Customer instructs it, or where the candidate asks HireCall directly and the Customer does not object within 30 days of being told.

The Customer may agree different retention periods in an order form. Where it does, the periods are recorded in Annex I and are shown to candidates in the candidate privacy notice.

4.3 No scoring, no ranking, no automated decisions

HireCall will not produce, and will not make available to the Customer:

• a score, rating or index representing a candidate's overall suitability;
• a ranking or ordering of candidates against one another;
• a recommendation, classification or label that determines or is intended to determine a candidate's outcome;
• any inference about a candidate's emotional state, personality, accent or tone;
• any inference about a characteristic protected under applicable non-discrimination law.

The Customer undertakes that every decision about a candidate is taken by an identified natural person who has the competence and authority to reach a different conclusion from the one the brief suggests, and who takes other information into account. The Customer will not configure its process, or instruct its staff, so that a HireCall brief determines an outcome without genuine human assessment.

4.4 The Customer's own obligations

The Customer confirms that it will:

• have a lawful basis for the processing, and be able to demonstrate it;
• inform candidates before the interview, and make the candidate privacy notice available to them in a language they understand;
• offer any candidate who does not wish to take an AI interview an alternative route, without disadvantage;
• carry out a data protection impact assessment where required, and consult employee representatives where required — in France, the comité social et économique;
• meet any local requirement applying to it as an employer, including bias auditing and advance notice where an automated employment decision tool is regulated, and biometric consent requirements where voice is treated as a biometric identifier;
• not submit special category data, and not set criteria that seek or proxy for protected characteristics.

5. Confidentiality

HireCall ensures that everyone authorised to process candidate personal data is bound by an appropriate duty of confidentiality, whether by contract or by statute, and that the duty survives the end of their engagement. Access is limited to those who need it to provide the service.

6. Security

HireCall implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as Article 32 GDPR requires. Those measures are described in Annex II, and HireCall will not reduce them materially during the term.

HireCall takes into account, in particular, the risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to candidate personal data — including voice recordings, which are more revealing than the text of what was said.

7. Sub-processors

The Customer gives general written authorisation for HireCall to engage sub-processors. Those engaged at the date of this DPA are listed in Annex III.

Before adding or replacing a sub-processor, HireCall will give the Customer at least 30 days' notice — 30 days is suggested — by email and on https://hirecall.ai/legal/dpa (Annex III), which the Customer may subscribe to.

The Customer may object on reasonable data protection grounds within that period. The parties will discuss it in good faith. If it cannot be resolved, the Customer may terminate the affected service without penalty and receive a pro rata refund of unused, unexpired credits.

HireCall imposes on each sub-processor, by contract, data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for a sub-processor's performance (Article 28(4) GDPR).

8. Helping the Customer with data subject requests

Candidates exercise their rights against the Customer, as controller. HireCall will:

• promptly pass on any request it receives directly from a candidate, and not respond to it substantively itself, except to acknowledge and redirect — subject to the standing erasure instruction in clause 4.2;
• provide, within 10 days, the technical means for the Customer to answer a request for access, rectification, erasure, restriction, portability or objection;
• where the product does not expose the necessary function, act on the Customer's written instruction to do so.

This assistance is included in the fees. HireCall will not charge for it.

9. Helping with security, breaches and impact assessments

Taking into account the nature of the processing and the information available to it, HireCall will assist the Customer in meeting its obligations under Articles 32 to 36 GDPR — security, breach notification, data protection impact assessment and prior consultation.

HireCall will make available the information the Customer needs to complete an impact assessment for the use of the service, including the information required of it as the provider of the AI system.

10. Personal data breaches

HireCall will notify the Customer without undue delay, and in any event within 48 hours — 48 hours is suggested — after becoming aware of a personal data breach affecting candidate personal data.

The notification will describe, as far as known: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where the information is not all available at once, HireCall will provide it in phases without undue delay.

HireCall will not notify a supervisory authority or any data subject on the Customer's behalf unless instructed to, and will not make any public statement identifying the Customer without its consent, except where legally required.

11. Deletion or return at the end

On termination, and at the Customer's choice, HireCall will delete or return all candidate personal data and delete existing copies, unless EU or member state law requires it to be kept.

Unless the Customer instructs otherwise, HireCall will:

• make the data available for export for 30 days after termination; and
• delete it within 30 days after that.

HireCall will certify deletion in writing if asked.

12. Audits

HireCall will make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

In practice, and to keep this workable for both sides:

• HireCall holds no security certification and no third-party audit report: there is no SOC 2, no ISO 27001 and no penetration test to date. Annex II states the measures that are in place, and HireCall will answer questions about them;
• the Customer may conduct an on-site or remote audit once a year, on 30 days' notice, during business hours, subject to confidentiality, and more often where a supervisory authority requires it or following a personal data breach;
• each party bears its own costs, save that the Customer bears HireCall's reasonable costs for audits beyond the annual one, unless the audit reveals material non-compliance.

13. International transfers

HireCall will not transfer candidate personal data outside the European Union except as permitted by this DPA and Data Protection Law.

Where candidate personal data originating in the EEA is transferred to a country without an adequacy decision, the transfer is made under:

• the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated into this DPA by reference and completed by the annexes below; or
• the EU–US Data Privacy Framework, where the recipient is certified under it and the certification covers the data in question.

Where the Data Privacy Framework is relied on and it ceases to be valid, or the recipient's certification lapses, the standard contractual clauses apply automatically without further action, and HireCall will tell the Customer.

Where the standard contractual clauses apply, HireCall will carry out and document a transfer impact assessment and make it available to the Customer.

14. Liability, term and law

This DPA takes effect when the Terms of Service do and continues for as long as HireCall processes candidate personal data for the Customer.

Liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not permit it. Nothing here limits a data subject's rights under Article 82 GDPR.

This DPA is governed by French law, and disputes fall to the exclusive jurisdiction of the courts of Paris — save that, where the standard contractual clauses apply, the governing law and forum they specify prevail for matters within their scope.

Annex I — Details of the processing

Subject matter. Provision of AI-conducted first-screen interviews for the Customer's job applicants.

Duration. The term of the Terms of Service, plus the retention period in clause 4.2.

Nature and purpose. Inviting candidates; conducting a structured interview by AI — by voice, or in the text-only mode in writing; capturing and transcribing speech (in the text-only mode, speech is transcribed in real time and no audio recording is retained); producing a written brief of evidence against the Customer's criteria; making that brief, and where configured the transcript and recording, available to the Customer; deleting the data at the end of the retention period.

Categories of data subject. Job applicants of the Customer. Users of the Customer's account (recruiters, hiring managers).

Categories of personal data.

Special category data. None is requested and none is required. The service does not ask about protected characteristics.

Frequency. Continuous, as candidates take interviews.

Retention. Audio recordings, 90 days from the interview; transcripts and briefs, 12 months from the interview. Where an order form agrees a different period, that period governs and is shown to the candidate on the consent screen.

Region. European Union — see the note at clause 4.1.

Annex II — Technical and organisational measures

Annex III — Sub-processors

Sub-processors for the interview service

Every provider above is engaged under its own data processing terms, which provide for transfers outside the EEA on Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. The exception is Deepgram, whose contracting route is unresolved — see the note below.

Sub-processors for the marketing website only

Three, and they are described in the website privacy policy. This is a separate, shorter list than Annex III above — do not conflate the two.

• Cloudflare — hosting, cookieless analytics, inbound email, and, on the /demo page only, the Turnstile anti-bot challenge (live since 25 August 2026).
• Resend — the demo-request email and the newsletter.
• Google — Google Analytics 4, and only for a visitor who accepts the consent banner. A visitor who refuses, or who never answers, does not contact Google at all. Live since 3 September 2026.

All three are listed here for completeness. None processes candidate data or plays any part in the interview service this DPA governs: they see only a visitor of the public marketing site, and in Google's case only one who chose to be counted.

Annex IV — Contacts

HireCall privacy contact: privacy@hirecall.ai HireCall security contact: security@hirecall.ai Sub-processor notifications: https://hirecall.ai/legal/dpa (Annex III) Customer contact: as given in the order form.

Version 1.0 — 26 August 2026