Agency DPA

1. Status of this Addendum and how it is accepted

1.1 This Agency Data Processing Addendum (this "Addendum") forms part of, and is incorporated by reference into, the RecruitiFi Permanent Placement Terms and the RecruitiFi Temp Terms (together, the "Terms") between RecruitiFi, Inc. ("RecruitiFi") and the agency, staffing firm, or recruiter accepting the Terms ("Agency"). Agency and RecruitiFi are each a "Party" and together the "Parties."

1.2 The Parties agree that this Addendum satisfies the requirement for a written contract under Article 28(3) of the EU GDPR, and that acceptance in electronic form is sufficient under Article 28(9).

1.3 Agency accepts this Addendum by accepting the Terms, or by continuing to use the Services after being notified of this Addendum in accordance with the Terms.

1.4 RecruitiFi may update this Addendum. RecruitiFi will give Agency at least 30 days notice of any change that materially reduces Agency's rights or RecruitiFi's obligations under it.

2. Definitions

2.1 Capitalized terms used but not defined in this Addendum have the meanings given in the Terms. The following definitions apply to this Addendum. The terms "Business", "Service Provider", "Contractor", "Sell", "Share", "Sale", and "Sharing" have the meanings given in the CCPA. "Agency Personal Data" means Personal Data that RecruitiFi Processes on behalf of Agency under the Terms and this Addendum, including Candidate submissions and related workflow records, and excludes Personal Data that RecruitiFi Processes as an independent Controller under Section 3.2.

"CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (Cal. Civ. Code section 1798.100 et seq.).

"Controller" means the natural or legal person that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For CCPA purposes, "Controller" includes a "Business", and for the purposes of Canadian data protection laws includes an "organization" that is accountable for Personal Data.

"Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under this Addendum, including, as applicable: (a) the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"); (b) the EU GDPR as incorporated into the law of the United Kingdom (the "UK GDPR"); (c) the Swiss Federal Act on Data Protection ("Swiss FADP"); (d) the CCPA and other US State Privacy Laws; (e) the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial legislation including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25 ("Quebec Law 25"); and (f) any successor, amendment, or replacement of the foregoing.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"EU SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to the EU GDPR, as set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

"Personal Data" means any information relating to a Data Subject that is Processed by RecruitiFi in connection with the Services, and includes "personal information" and "personal data" as defined under applicable Data Protection Laws.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.

"Process" or "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

"Processor" means the entity that Processes Personal Data on behalf of the Controller. For CCPA purposes, "Processor" includes a "Service Provider" or "Contractor", and for Canadian data protection laws includes a "service provider" or "third party" engaged to Process Personal Data.

"Restricted Transfer" means a transfer of Personal Data to, or access to Personal Data from, a country or recipient not benefiting from an adequacy decision or equivalent recognition under the applicable Data Protection Law, where such transfer would be prohibited absent an appropriate safeguard.

"Sub-processor" means any third party engaged by RecruitiFi (or by a RecruitiFi affiliate) to Process Agency Personal Data on behalf of Agency.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, in force since 21 March 2022.

"US State Privacy Laws" means all US state comprehensive consumer privacy laws applicable to the Processing, including the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, the Florida Digital Bill of Rights, the Delaware Personal Data Privacy Act, and comparable laws of other states as and when they take effect.

3. Scope, roles, and instructions

3.1 Roles

As between the Parties, Agency is the Controller (and, where applicable, the Business) and RecruitiFi is the Processor (and, where applicable, the Service Provider or Contractor) with respect to Agency Personal Data.

Agency acknowledges that the Employer is a separate and independent Controller of Candidate Personal Data for its own purposes, and that RecruitiFi acts as Processor for the Employer under separate terms in respect of that Processing. The Parties are not joint controllers.

3.2 Activities in which RecruitiFi is Controller

This Addendum does not apply to Processing for which RecruitiFi is an independent Controller, being: platform account administration; platform security, fraud prevention, and service-integrity monitoring; the handling of data subject requests addressed to RecruitiFi; the evaluation and scoring of Agency users; payment administration, being RecruitiFi's records of the amounts owed and paid to Agency for placements and Resource engagements, and the account reference it holds with its payment provider; and analytics on RecruitiFi's marketing website. RecruitiFi determines the purposes and means of those activities independently of Agency and relies on its own lawful basis for them. They are described in the RecruitiFi Privacy Policy, are not performed on Agency's instructions, and nothing in this Addendum makes Agency a Controller of them.

Where the same personal data is Processed both on Agency's instructions under this Addendum and by RecruitiFi as independent Controller under this Section 3.2, RecruitiFi applies the technical and organizational measures in Annex II to it in either case.

3.3 Instructions

RecruitiFi shall Process Agency Personal Data only on Agency's documented instructions, including with regard to Restricted Transfers, unless required to do so by applicable law to which RecruitiFi is subject. The Terms, this Addendum, and Agency's documented use and configuration of the Services constitute Agency's complete and final documented instructions for Processing.

RecruitiFi shall inform Agency if, in its opinion, an instruction infringes Data Protection Laws. RecruitiFi is not obligated to conduct a legal review of the lawfulness of Agency's instructions.

Agency is responsible for the lawfulness of its collection of Agency Personal Data and its instructions to RecruitiFi, for establishing a lawful basis for the submission of each Candidate, and for the accuracy, quality, and legality of the Agency Personal Data it provides.

3.4 Conflicting instructions

Where RecruitiFi receives instructions from Agency and from an Employer in respect of the same Candidate record that cannot both be complied with, RecruitiFi shall notify both Controllers without undue delay and shall give effect to the instruction that RecruitiFi reasonably determines is required to comply with applicable law. Where neither instruction is legally required, RecruitiFi shall give effect to the instruction of the Controller on whose behalf the record was created, being Agency in respect of a Candidate submission.

3.5 Aggregate and de-identified data

Agency acknowledges that RecruitiFi creates anonymized aggregate data, industry reports, and statistics as described in the Terms. Such data is created and used only in a form that does not identify, and cannot reasonably be used to identify or be linked to, any Data Subject, Agency, or Employer, and does not constitute Personal Data. Where Personal Data subject to US State Privacy Laws is used to create de-identified data, RecruitiFi maintains technical safeguards and business processes that prohibit reidentification, publicly commits to maintain and use the data only in de-identified form, and does not attempt to reidentify it except as permitted to test the effectiveness of de-identification. Nothing in this Addendum restricts RecruitiFi's creation or use of that data, and nothing in the Terms authorizes RecruitiFi to use Agency Personal Data in identifiable form for its own purposes. This Section 3.5 applies only to Agency Personal Data; it does not extend to Personal Data that RecruitiFi Processes as an independent Controller under Section 3.2, whose aggregation is governed by RecruitiFi’s own policies.

3.6 Special categories of personal data.

Agency instructs RecruitiFi not to collect or Process Special Categories of Personal Data (as described in Article 9 of the EU GDPR) or criminal offence data (as described in Article 10 of the EU GDPR) through the Services, except through fields the Services expressly provide for that purpose, and Agency shall not otherwise submit such data. For roles based in the United States, the Services present optional equal opportunity fields (racial and ethnic background, disability status, and veteran status) so that the Employer can meet EEOC and OFCCP recordkeeping obligations. Completion is optional, these fields are keyed to the location of the role and are not presented for roles based in the EEA, the UK, or Switzerland, and RecruitiFi Processes the responses solely for that recordkeeping purpose.

3.7 The details of the Processing, being the subject matter, duration, nature and purpose, types of Personal Data, and categories of Data Subjects, are set out in Annex I.

4. Confidentiality and personnel

4.1 RecruitiFi shall ensure that persons authorized to Process Agency Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. RecruitiFi personnel execute confidentiality agreements as part of onboarding.

4.2 RecruitiFi shall limit access to Agency Personal Data to personnel who require it to perform the Services, in accordance with the least-privilege controls in Annex II.

4.3 RecruitiFi shall ensure its personnel receive appropriate data protection and security awareness training.

4.4 The obligations in this Section 4 survive termination of the Terms and this Addendum.

5. Security measures

5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to Data Subjects, RecruitiFi shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the EU GDPR and comparable requirements of the other Data Protection Laws.

5.2 The measures maintained by RecruitiFi are described in Annex II. RecruitiFi may update the measures provided that such updates do not materially reduce the overall level of security of Agency Personal Data.

5.3 Where the Terms describe security obligations of RecruitiFi in respect of Agency Personal Data, Annex II prevails to the extent of any inconsistency.

6. Sub-processing

6.1 Agency grants RecruitiFi general written authorization to engage Sub-processors to Process Agency Personal Data, subject to this Section 6. The Sub-processors authorized as of the date of this Addendum are those identified in Annex III, which incorporates the RecruitiFi Sub-Processor List published at https://www.recruitifi.com/legal/sub-processors.

6.2 RecruitiFi shall inform Agency of any intended addition or replacement of a Sub-processor at least 30 days in advance, giving Agency the opportunity to object. RecruitiFi shall provide notice by publishing an updated RecruitiFi Sub-Processor List with a revised effective date and notifying Agency through the Services or by email to Agency's designated contact. Agency may subscribe to notifications of changes to the list at the address in Annex III.

6.3 If Agency has a reasonable, data-protection-based objection to a new Sub-processor, Agency shall notify RecruitiFi in writing within the notice period. The Parties shall work in good faith to resolve the objection. If the objection cannot be resolved, Agency may, as its sole and exclusive remedy, cease submitting Candidates through the affected portion of the Services.

6.4 RecruitiFi shall engage each Sub-processor under a written contract imposing data protection obligations that are substantially the same as, and in any event no less protective than, those set out in this Addendum, and shall ensure each Sub-processor is bound by the obligations required under Article 28(4) of the EU GDPR and the equivalent provisions of the EU SCCs.

6.5 RecruitiFi remains fully liable to Agency for the performance of each Sub-processor's data protection obligations.

7. Data subject rights assistance

7.1 Taking into account the nature of the Processing, RecruitiFi shall assist Agency by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Agency's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.

7.2 If RecruitiFi receives a request from a Data Subject relating to Agency Personal Data, RecruitiFi shall not respond substantively, other than to acknowledge receipt or to direct the Data Subject to Agency where permitted, and shall promptly forward the request to Agency, unless legally required to respond.

7.3 Section 7.2 does not apply to requests concerning Processing for which RecruitiFi is an independent Controller under Section 3.2, which RecruitiFi handles directly.

8. Impact assessments and consultation

8.1 RecruitiFi shall assist Agency in ensuring compliance with Agency's obligations under Articles 32 to 36 of the EU GDPR, and comparable provisions of other Data Protection Laws, taking into account the nature of Processing and the information available to RecruitiFi.

8.2 This assistance includes reasonable cooperation with data protection impact assessments and prior consultations with a supervisory authority where required. RecruitiFi's platform Data Protection Impact Assessment is available to Agency on request under confidentiality obligations.

9. Personal data breach notification

9.1 RecruitiFi shall maintain the incident response plan and documented playbooks described in Annex II.

9.2 RecruitiFi shall notify Agency of a Personal Data Breach affecting Agency Personal Data without undue delay and in any event no later than 24 hours after RecruitiFi becomes aware of the Personal Data Breach.

9.3 Such notification shall, to the extent then known and available, describe the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where the information is not all available at once, it may be provided in phases without undue further delay.

9.4 RecruitiFi shall take reasonable steps to mitigate the effects of the Personal Data Breach and shall reasonably cooperate with Agency in relation to Agency's own breach notification obligations.

10. International transfers

10.1 RecruitiFi shall not make a Restricted Transfer of Agency Personal Data except in compliance with this Section 10 and applicable Data Protection Laws.

10.2 EU transfers. To the extent Processing involves a Restricted Transfer of Agency Personal Data subject to the EU GDPR to RecruitiFi or a Sub-processor in a country without an adequacy decision, the EU SCCs are incorporated by reference and deemed executed, as follows: Module Two (controller to processor) applies where Agency is a Controller; Module Three (processor to processor) applies where Agency acts as a Processor on behalf of a third-party controller; in Clause 7 the optional docking clause applies; in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 6.2; in Clause 11 the optional independent dispute resolution language does not apply; in Clause 17 the EU SCCs are governed by the law of Ireland; in Clause 18 disputes are resolved before the courts of Ireland; and Annexes I, II, and III of the EU SCCs are populated by Annexes I, II, and III of this Addendum, the sub-processor list required by Annex III of the EU SCCs being the RecruitiFi Sub-Processor List as published at the relevant time.

10.3 UK transfers. To the extent Processing involves a Restricted Transfer subject to the UK GDPR, the UK Addendum is incorporated by reference, appended to and amending the EU SCCs, with Tables 1 to 3 populated by this Addendum and its Annexes.

10.4 Swiss transfers. To the extent Processing involves a Restricted Transfer subject to the Swiss FADP, the EU SCCs apply with references to the EU GDPR read as references to the Swiss FADP, the competent authority being the Swiss Federal Data Protection and Information Commissioner, "Member State" interpreted to allow Data Subjects in Switzerland to enforce their rights in their place of habitual residence, and the EU SCCs extended to protect the data of legal entities to the extent required.

10.5 Onward transfers. RecruitiFi discharges its Clause 8.8 onward-transfer obligation by engaging each Sub-processor under a DPA binding it to protection no less than the Clauses. Where a Sub-processor holds a current EU-US Data Privacy Framework certification (including its UK Extension and the Swiss-US Data Privacy Framework), the onward transfer takes place within the corresponding adequacy decision under the adequacy limb of Clause 8.8 while that certification and decision remain valid, with the contractual route standing behind the transfer and engaging automatically if either ceases to be valid.

10.6 Canadian transfers. Where RecruitiFi Processes Agency Personal Data of Data Subjects in Canada, RecruitiFi shall provide a comparable level of protection to that required under PIPEDA and applicable provincial law through the contractual and security measures in this Addendum and Annex II.

11. CCPA and US state privacy laws

11.1 This Section applies to Processing of Agency Personal Data subject to the CCPA or other US State Privacy Laws. Agency is the "Business" and RecruitiFi is the "Service Provider" or "Contractor".

11.2 RecruitiFi shall Process Agency Personal Data solely for the purpose of performing the Services and for the business purposes specified in Annex I, and shall not retain, use, or disclose it for any other purpose except as permitted by the CCPA.

11.3 RecruitiFi shall not Sell or Share Agency Personal Data; retain, use, or disclose it outside the direct business relationship between the Parties; or combine it with Personal Data received from another person or collected from its own interaction with a Data Subject, except as permitted under the CCPA or as provided in Section 3.5.

11.4 RecruitiFi certifies that it understands the restrictions in this Section and will comply with them. The Parties acknowledge that no Sale or Share of Personal Data occurs under this Addendum.

12. Audits and information rights

12.1 RecruitiFi shall make available to Agency the information reasonably necessary to demonstrate compliance with Article 28 of the EU GDPR and equivalent obligations.

12.2 Attestation first. Agency agrees that RecruitiFi's compliance and security assurance documentation, including its most recent SOC 2 report where available, independent penetration test summary reports, and responses to reasonable security questionnaires, shall in the first instance satisfy Agency's audit and inspection rights. RecruitiFi shall provide such documentation on reasonable request under confidentiality obligations.

12.3 Escalation to audit. Where the documentation in 12.2 is insufficient to address a specific, reasonable, and documented concern, or where an audit is required by a supervisory authority with jurisdiction over Agency, Agency or its mandated auditor may conduct an audit on at least 30 days prior written notice, during normal business hours, no more than once per 12-month period except where required by a regulator or following a Personal Data Breach, with the auditor bound by confidentiality and not a competitor of RecruitiFi, and with scope limited to Processing of Agency Personal Data.

12.4 Nothing in this Section grants any regulator a direct right of audit of, or direct access to, RecruitiFi's systems, facilities, or records.

13. Deletion and return

13.1 At Agency's choice, RecruitiFi shall delete or return Agency Personal Data after the end of the provision of the Services, and shall delete existing copies unless applicable law requires storage.

13.2 Deletion and return are performed in accordance with RecruitiFi's Data Deletion Policy and Agency's documented instructions, subject to Section 3.4 where an Employer retention obligation applies to the same record. Where Personal Data is retained because required by law, RecruitiFi shall protect its confidentiality and Process it only to the extent and for the period required.

13.3 Backup copies remain encrypted and access-restricted and expire under their assigned retention periods. Backups are held in immutable storage, so a backup copy cannot be altered or deleted before its assigned retention period expires; on expiry it is deleted in the ordinary course. Agency Personal Data deleted under Section 13.1 is removed from active use immediately, and a record deleted on Agency's instruction is re-suppressed if a backup is ever restored. Records relating to hiring decisions that are retained on a legal basis, and Personal Data subject to a legal hold, remain retained for the required period notwithstanding this Section 13.

14. Records, liability, and general

14.1 RecruitiFi shall maintain records of the categories of Processing carried out on behalf of Agency as required by Article 30(2) of the EU GDPR and make them available to Agency or a supervisory authority on reasonable request.

14.2 Each Party's liability arising out of or related to this Addendum is subject to the limitations and exclusions of liability in the Terms. Any reference to a Party's liability in the Terms means the aggregate liability of that Party under the Terms and this Addendum together.

14.3 In the event of a conflict between this Addendum and the Terms regarding the Processing of Agency Personal Data, this Addendum prevails. In the event of a conflict between this Addendum and the EU SCCs or the UK Addendum, those instruments prevail with respect to the relevant Restricted Transfer.

14.4 This Addendum takes effect on acceptance and remains in force for as long as RecruitiFi Processes Agency Personal Data. Obligations that by their nature should survive termination, including confidentiality, deletion and return, and liability, survive.

14.5 This Addendum is governed by the laws of the State of New York, and the Parties submit to the exclusive jurisdiction of the state and federal courts located in New York, New York, except that the EU SCCs, the UK Addendum, and the Swiss amendments are governed by the laws and subject to the jurisdictions specified within those instruments.

Annex I: Description of processing

A. List of parties

Data exporter (Controller or Business): the Agency accepting the Terms. Contact: the data protection contact in Agency's account profile. Role: Controller, or Processor where Agency acts on behalf of a third-party controller.

Data importer (Processor or Service Provider): RecruitiFi, Inc., a Delaware corporation, 21 West 46th St., New York, NY 10036. Contact: dpo@recruitifi.com. Role: Processor, or sub-processor under Module Three where applicable.

B. Categories of data subjects

• Candidates submitted by Agency through the Services.
• Resources, being Candidates submitted by Agency and engaged on assignment with an Employer under a Statement of Services, for whom Agency acts as Employer of Record.
• Agency recruiters and other authorized Agency users of the Services.

C. Categories of personal data

• Candidate data: name, contact details, employment history, education history, and other resume or curriculum vitae content submitted through the Services.
• Screening question responses, where an Employer requires them.
• Per-job Candidate confirmation records and submission and hiring workflow status.
• Temporary engagement data: Statement of Services terms (start date, anticipated length of engagement, bill rates, description of work), weekly timesheet records of hours worked submitted by Agency and approved by the Employer, and assignment status.
• Usage and log data: platform activity records generated through Agency's use of the Services and made available to Agency through the Services, including submission and workflow audit trails. Security event telemetry, being authentication events, IP addresses, request metadata, and device and browser metadata processed for security, fraud prevention, and service-integrity monitoring, is not Processed on Agency's behalf and is addressed in Section 3.2.

D. Special categories of personal data

For roles based in the United States, the Services present optional equal opportunity fields (racial and ethnic background, disability status, and veteran status) so that the Employer can meet EEOC and OFCCP recordkeeping obligations. Completion is optional. These fields are keyed to the location of the role and are not presented for roles based in the EEA, the UK, or Switzerland. No other special category or criminal offence data is collected by design. RecruitiFi applies the measures in Annex II uniformly to all Personal Data.

E. Frequency, nature, and purpose

Frequency: continuous, for the duration of Agency's use of the Services. Nature and purpose: provision, operation, support, and maintenance of the RecruitiFi platform for the candidate submission and hiring workflow, being the distribution of Employer job requisitions to Agency, the receipt of Candidate submissions from Agency, Candidate confirmation of each submission, presentation of confirmed Candidates to the Employer, and management of the resulting evaluation and hiring workflow, together with the hosting, storage, transmission, and display of Personal Data necessary for those purposes. Where Agency participates in the temporary staffing service, the processing additionally comprises the administration of Resource engagements on the Platform, being the recording of Statements of Services and the receipt, storage, and transmission of timesheet records for approval, invoicing, and payment. Assignment-duration data derived from those records, including tenure alerts generated for the Employer in support of the Employer’s own workforce policies, is Processed on the Employer’s documented instructions under RecruitiFi’s client Data Processing Agreement and is noted here for transparency only. The candidate submission and hiring workflow is the processing described under that name in RecruitiFi’s Data Protection Impact Assessment and Record of Processing Activities; the temporary staffing service is currently offered for roles based in the United States and its processing falls outside the territorial scope of that register.

F. Duration and retention

For the duration of Agency's use of the Services, and thereafter deleted or returned in accordance with Section 13, RecruitiFi's Data Deletion Policy, and Agency's documented instructions. Records relating to hiring decisions are retained for two years where retention is legally required.

G. Competent supervisory authority

For EU SCC purposes, the supervisory authority of the EU Member State in which Agency is established, or where Agency is not established in the EU, the Irish Data Protection Commission. For UK transfers, the Information Commissioner's Office. For Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex II: Technical and organizational measures

The measures in Annex II of the RecruitiFi client Data Processing Agreement apply to Agency Personal Data without modification, and are reproduced in summary below. RecruitiFi may update these measures provided the overall level of security is not materially reduced.

• Hosting: Heroku (Salesforce) platform-as-a-service, production in the United States (Virginia) with disaster recovery in the United States (Oregon); Heroku Postgres and Redis; Amazon S3 object storage with cross-region replication, CloudFront, KMS, CloudTrail, GuardDuty, and IAM Identity Center.
• Edge security: Cloudflare web application firewall on the OWASP Core Rule Set, distributed denial of service protection, bot management, and OFAC-aligned geographic blocking.
• Encryption: AES-256 at rest, TLS 1.2 or higher in transit.
• Identity and access: Google Workspace single sign-on with multi-factor authentication for corporate access; least-privilege access to production systems; secrets managed in 1Password.
• Endpoint: macOS-only fleet managed with Jamf Pro; Bitdefender endpoint detection and response with Device Control blocking removable media; FileVault encryption.
• Logging and monitoring: Datadog centralized logging and security monitoring, with AWS CloudTrail and GuardDuty.
• Secure development: GitHub source control with CodeQL static analysis, Dependabot dependency management, and GitGuardian secret scanning. Vulnerability remediation service levels: Critical 7 days, High 30 days, Medium 90 days, Low 180 days. Annual third-party penetration testing.
• Resilience: disaster recovery capability tested annually; backup immutability via S3 Object Lock.
• People security: security awareness training; background checks and confidentiality agreements administered through onboarding.
• Incident response: documented incident response plan and playbooks covering detection, triage, containment, eradication, recovery, notification, and post-incident review.

Annex III: Authorized Sub-Processors

The Sub-processors authorized as at the effective date of this Addendum are those listed in the RecruitiFi Sub-Processor List published at https://www.recruitifi.com/legal/sub-processors, which is incorporated into this Addendum by reference. The list states, for each Sub-processor, its legal entity name, the service it provides, the location of processing, and the transfer safeguard relied on, and carries a version number, an effective date, and a change log. Superseded versions are retained and provided on request to the RecruitiFi Data Protection Officer at dpo@recruitifi.com, or by post to RecruitiFi, Inc., 21 West 46th St., New York, NY 10036.

Processing locations. All platform processing takes place in the United States. Requests to the platform transit Cloudflare’s global edge network and may be inspected at an edge location outside the United States before reaching the platform, as described in the Sub-Processor List’s edge-processing note.

Notice of changes. RecruitiFi gives at least 30 days’ notice before a new Sub-processor begins Processing Agency Personal Data, by publishing an updated version of the list with a revised effective date and notifying agency users through the platform or by email to the designated contact. To subscribe to change notifications, contact dpo@recruitifi.com. Objections are handled in accordance with Section 6 of this Addendum.