DPA.

1. Parties and incorporation

This general contract version governs the processing of personal data on behalf of the controller between the customer named in the main contract as controller and Reclyra – Ömer Salmaz, sole proprietorship, Philippsburger Straße 83a, 68753 Waghäusel, Germany, as processor. The main contract identifies the customer, the agreed services and its authorised contact persons.

The agreement becomes part of the main contract if the parties demonstrably incorporate it, stating this version, or agree on it separately in text form. Merely publishing or reading this page does not result in the conclusion of a contract or a retroactive approval of any processing. Incorporation must take place before the processing concerned begins.

Reclyra's data protection contact is privacy@reclyra.app. The customer names the persons authorised to issue instructions and its data protection contact in the main contract or notifies Reclyra of them in text form. Permissions within the workspace additionally determine which product actions the respective users may carry out.

2. Subject matter, duration and order of precedence

The subject matter is the provision of the agreed recruiting and applicant management functions. The scope and details result from this agreement, the description of processing in section 3, the incorporated technical and organisational measures and the overview of service providers designated for the engagement.

The agreement applies for the duration of the commissioned processing and beyond for as long as Reclyra still processes data on behalf of the customer or copies that are to be deleted. Confidentiality, assistance, return and deletion obligations continue to apply until they have been fulfilled.

In the event of contradictions, this agreement takes precedence over the main contract with regard to the processing on behalf of the customer. Mandatory data protection law, data subject rights and applicable statutory requirements for switching providers remain unaffected.

Reclyra's own processing, such as contract administration, billing and its own security or legal records, is subject to the privacy policy. Such processing does not become processing on behalf of the customer merely because it is stored in the same system.

• Privacy policy

3. Nature, purpose and scope of the processing

The processing serves the receipt, management and human handling of applications for the customer's jobs. It takes place continuously during use and in connection with events such as applications, user actions, messages, activated analyses, appointments, exports and deletions. Only the functions actually agreed and usable are covered.

The functional scope of the engagement is limited to ordinary identification and contact data and the professional, recruiting and process data described below that are required for the specific job. The category CV or attachment is not a release of data unlimited in content. For special categories of data and data under Art. 10 GDPR, the additional requirements in section 6 apply.

Data subjects are applicants and former applicants within the permissible retention period, contact persons or referees named in submitted documents, interview participants as well as users, administrators, recruiters and other authorised members of the customer workspace.

• Processing activities: receipt, storage, organisation, display and transmission; structuring and criteria-specific analysis where AI is activated; communication and appointment management; rectification, export, deletion and handling of justified restriction instructions.
• Identification and contact data: names, email addresses, telephone numbers, postal addresses contained in documents as well as user, job and organisation assignments.
• Professional data: CV, cover letter, supplementary documents, career history, education, qualifications, skills, languages and job-related information requested by the customer.
• Recruiting data: receipt of application, form answers, status, internal notes and mentions with read status, messages, interview information and decisions entered by the customer.
• Analysis data: extracted text, job-related criteria, structured results, evidence, source references, uncertainties as well as model, prompt and criteria versions and human criteria corrections.
• Technical records on behalf of the customer: necessary user and process identifiers, timestamps, access, export and deletion events as well as engagement-related delivery and error information.

4. Documented instructions

Reclyra undertakes to process personal data only on documented instructions from the customer, including with regard to transfers to third countries. Processing on the basis of an obligation under Union or Member State law remains possible; Reclyra informs the customer of that legal requirement in advance, unless that law prohibits such information on important grounds of public interest.

The agreed services and settings constitute the initial instruction. Authorised persons can issue further instructions via the platform functions provided for this purpose or in text form to privacy@reclyra.app. Oral instructions must be confirmed in text form for the purposes of evidence.

If Reclyra considers that an instruction infringes data protection law, Reclyra informs the customer without undue delay. Execution of the instruction concerned may be suspended until it has been clarified in a legally sound manner. Confirmation by the customer alone does not make an unlawful instruction permissible.

Additional services outside the agreed scope are agreed in advance. Protection and assistance obligations owed by law are not restricted by this.

5. Responsibility of the customer

The customer determines and is responsible for the purposes, legal bases, information provided to applicants, job-related selection criteria, roles, retention and personnel decisions. It is responsible for any required data protection impact assessments and for the participation of employee representative bodies within its area of responsibility.

The customer grants access rights only to the extent necessary and keeps its contact persons and authorisations up to date. It informs Reclyra without undue delay of data protection requests, errors, unauthorised access and compromised accounts relevant to the engagement.

AI results require human review. Reclyra does not make any automatic hiring or rejection decision with the analysis described. A different integration into other systems is not covered by a general instruction to analyse CVs.

6. Special categories of data and limits of the service

Health information, religious affiliation or other data under Art. 9 GDPR may be contained unintentionally in freely submitted application documents. The fact that an applicant uploads a file themselves replaces neither the required legal basis nor the review of the service providers used. An ordinary application photo is not, merely by its existence, biometric data for the purpose of uniquely identifying a person.

This general contract version does not grant a blanket release for special categories of data or for data relating to criminal convictions and offences. Such a scope of processing requires a sound legal basis, agreed protective measures and the use of service providers that is permissible for this purpose. This also applies to information contained by chance; a contractual restriction alone does not prevent its technical receipt.

Reclyra must ensure the permissibility of the processing chain it uses. Responsibility for this is not shifted to the customer. Processing outside the permissible scope of services requires a prior documented solution; the publication of this agreement does not replace this clarification.

7. Confidentiality and obligations of Reclyra

Reclyra undertakes to process data on behalf of the customer only to the agreed extent and to make it accessible only to authorised persons. Persons authorised to process the data must have committed themselves to confidentiality or be under an appropriate statutory obligation of confidentiality. Confidentiality also applies after the end of the engagement.

Reclyra undertakes to implement the measures required under Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context, purposes and risks of the processing. The published description of measures names the application functions actually implemented and their limits. It does not claim any certifications or operational guarantees beyond this.

Reclyra provides the records and evidence required by law, cooperates with lawful requests from supervisory authorities and appoints a data protection officer insofar as this is required by law.

• Technical and organisational measures

8. Measures and changes

The version of the technical and organisational measures designated at incorporation forms part of this agreement. Reclyra may adapt measures to technical developments provided that the agreed level of protection is not reduced overall. Material changes relevant to the engagement are communicated to the customer.

If a processing purpose requires additional controls not previously documented, these must be defined and implemented before this scope of processing begins. Neither an available user interface nor a general description of features replaces this evidence.

9. Sub-processors

Upon valid incorporation, the customer grants a general written authorisation for the sub-processors specifically named in the incorporated overview of service providers and designated for its engagement. The assignment to a service provider is based on the actual processing. The mere mention of a model does not authorise an undetermined selection of further inference providers.

Reclyra informs the customer in text form, at its stored contract or data protection contact, before an intended addition or replacement of a sub-processor. The information names the provider, the task, the data concerned, the main processing locations and the intended start of use. It must be given in sufficient time for the customer to have a real opportunity to object on data protection grounds before use; a mere subsequent update of the website is not sufficient for this.

In the event of a justified objection, the parties examine an alternative compliant with data protection law. If no such solution exists, the additional processing concerned must not be commenced solely on the basis of the general authorisation. Rights to suspend and to terminate a materially affected service remain unaffected.

Reclyra contractually imposes on each sub-processor the same data protection obligations within the meaning of Art. 28(4) GDPR, in particular sufficient guarantees for appropriate technical and organisational measures. Reclyra remains responsible to the customer for the performance of these obligations.

• Service providers and sub-processors

10. Transfers to third countries

Processing outside the European Economic Area requires a documented instruction and compliance with Art. 44 et seq. GDPR. Depending on the recipient and the processing, a relevant adequacy decision or appropriate safeguards such as standard contractual clauses and, where applicable, supplementary measures are required in particular.

Reclyra provides the customer with the information relating to its processing about recipients, processing locations and transfer mechanisms. Public provider terms describe the providers' standard offering; they do not by themselves prove either the effective incorporation in the specific account or the permissibility of a particular scope of data.

In the case of legally permissible requests from authorities, Reclyra examines their scope, limits any disclosure to the necessary extent and informs the customer insofar as this is legally possible.

11. Data subject rights and assistance

Taking into account the nature of the processing, Reclyra assists the customer by appropriate technical and organisational measures in fulfilling data subject rights. This includes in particular access, rectification, erasure, restriction and data portability. Existing export and deletion functions can be used for this purpose; a technical export is not yet a reviewed response to an access request.

If a request attributable to the customer is received directly by Reclyra, Reclyra informs the customer without undue delay. A substantive response is given only on the customer's instruction or on the basis of a statutory obligation. Where the attribution is unclear, only the additional information necessary for this is requested.

Taking into account the nature of the processing and the information available, Reclyra also assists the customer with its obligations under Art. 32 to 36 GDPR, in particular in the case of personal data breaches, impact assessments and prior consultations. The customer-specific legal assessment and approval remain with the customer.

12. Personal data breaches

If Reclyra becomes aware of a personal data breach relating to data processed on behalf of the customer, Reclyra informs the customer without undue delay. The notification is not postponed until all technical investigations have been completed.

Insofar as available, the initial notification contains the nature and time of the incident, the systems and categories of data concerned, the approximate number of data subjects and records concerned, the likely consequences, the remedial measures already taken or proposed and a contact point. Missing information is added without undue delay.

Reclyra takes appropriate measures for containment, investigation and remediation and assists the customer with its risk and notification assessment. The decision on notifications to authorities and data subjects concerning the data processed on behalf of the customer lies with the customer. Reclyra's own statutory obligations remain unaffected.

13. Return, deletion and retention

After completion of the commissioned processing, Reclyra, at the customer's choice, returns or deletes the data processed on its behalf and deletes existing copies, unless there is an obligation under Union or Member State law to store them. Reclyra agrees the execution with the customer and communicates any obstacles and necessary next steps. Return, switching and deletion rights owed by law are not restricted by this coordination process.

The current product functions enable a structured export and the expressly confirmed deletion of individual applications. A configured applicant retention period merely produces a preview from the documented rejection, not an automatic deletion. A preview exception is not a complete legal hold or general blocking process.

The data processed on behalf of the customer that is to be deleted includes the associated applications, private files, analyses, notes, mentions, communication and process data. For other applications by the same person that continue to be lawfully stored, their separate purpose must be taken into account. Files may be removed via a retryable clean-up job; a database deletion event alone does not confirm complete deletion of the files.

A technical backup copy must not postpone deletion indefinitely. Insofar as copies are removed with a time delay for technical reasons, the systems concerned, access restriction, expiry and handling of a restoration must be documented for the specific engagement. This general version does not specify any unreviewed backup rotation or automatic workspace deletion period.

Reclyra may retain a necessary, limited record of the instruction and deletion without application content. Downloaded files, emails already delivered and copies held by the customer lie outside the platform's direct technical ability to recall them; statutory assistance obligations remain in place.

14. Evidence and audits

Reclyra makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the customer or another auditor mandated by the customer.

The parties agree on reasonable organisational conditions that protect operations, confidentiality, security and the rights of other customers. Suitable documents and controlled inspection can support the audit, but do not replace any further audit right required by law. A specific security incident or a request from an authority may require an audit at short notice or an additional audit.

Bearing the costs of additional services requires a separate agreement and must not frustrate rights and assistance required by law. Certifications or audit reports that do not exist are not promised as evidence.

15. Liability, termination and final provisions

Art. 82 GDPR, the other statutory provisions and validly agreed liability provisions of the main contract apply. Claims of data subjects and powers of the supervisory authorities are not restricted.

In the event of a material breach of data protection, the statutory and contractual rights to remedy, suspension and, where applicable, extraordinary termination exist. Necessary immediate protective measures remain possible. Reclyra may refuse to carry out an obviously unlawful instruction.

Amendments and additions require at least text form, unless mandatory law requires a stricter form. Replacing this web page does not automatically change a contract version already agreed. Invalid provisions are replaced by the statutory provisions. The law agreed in the main contract applies unless mandatory data protection law provides otherwise.