The terms on which Novatree processes personal data for its customers, as required by Article 28 of the GDPR and the UK GDPR. It forms part of our Terms of Service.
Draft — pending legal review
This document is published for transparency and is not yet final. Highlighted items are still to be completed.
This Data Processing Agreement (“DPA”) forms part of the Terms of Service or other agreement (the “Agreement”) between [COMPANY LEGAL NAME] (“Novatree”, the “Processor”) and the Customer (the “Controller”). It applies whenever Novatree processes Customer Personal Data in providing the Service, and takes effect on the date the Agreement does — no separate signature is needed. A countersigned copy is available on request at legal@novatree.ai.
The Customer is the controller of Customer Personal Data and Novatree is its processor. Where the Customer is itself a processor for another controller, Novatree is its sub-processor, and the Customer warrants that its instructions are authorized by that controller.
“Data Protection Laws” means all laws on the processing of personal data that apply to a party’s processing under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act. “Customer Personal Data” means personal data within Customer Data. “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR.
Novatree processes Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless the law requires otherwise — in which case Novatree informs the Customer before processing, unless that law forbids it. The Agreement, this DPA, and the Customer’s configuration and use of the Service are the Customer’s complete instructions. Novatree will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws.
Novatree does not sell Customer Personal Data, does not use it to train foundation models, and does not use it for its own purposes beyond what the Agreement permits (such as securing the Service and producing de-identified aggregate statistics).
Novatree ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality obligations, and limits access to those who need it to provide, secure or support the Service.
Novatree implements and maintains the technical and organizational measures in Annex 2, appropriate to the risk as Article 32 GDPR requires. Novatree may update those measures, provided it does not reduce the overall level of protection.
The Customer gives general authorization for Novatree to engage sub-processors. The current list is published at novatree.ai/subprocessors. Novatree imposes data-protection obligations on each sub-processor by written contract that are no less protective than this DPA, and remains liable to the Customer for each sub-processor’s performance.
Novatree will give at least 30 days’ notice of a new sub-processor by updating that page and emailing customers who have subscribed. If the Customer objects on reasonable data-protection grounds within that period, the parties will discuss it in good faith; if they cannot resolve it, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.
The Service lets the Customer access, correct, export and delete Customer Personal Data. To the extent the Customer cannot do so itself, Novatree will help it respond to requests from data subjects exercising their rights. If Novatree receives such a request directly, it will refer the person to the Customer and will not respond itself except to do so.
Novatree will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Novatree will update the Customer as it learns more and will take reasonable steps to contain and remedy the breach. Notification is not an admission of fault.
Taking into account the nature of the processing and the information available to it, Novatree will give the Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that concern the Service.
Customer Personal Data is stored and processed in the United States. To the extent a transfer from the European Economic Area, the United Kingdom or Switzerland to Novatree is a restricted transfer, the parties agree that:
If the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.
The Customer can export Customer Personal Data at any time during the term. After the Agreement ends, Novatree deletes Customer Personal Data from its active systems within 30 days, and it expires from backups within a further 35 days, unless the law requires its retention — in which case Novatree keeps it confidential and processes it only for that purpose.
Novatree will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including completed security questionnaires and a description of its controls. Where that is not sufficient, or a supervisory authority requires it, the Customer may audit Novatree’s compliance once a year on at least 30 days’ notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and without access to other customers’ data.
Where the California Consumer Privacy Act or a similar US state law applies, Novatree is a “service provider” or “processor”. It will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than the business purposes in the Agreement, will not combine it with personal data from other sources except as those laws permit, and will notify the Customer if it can no longer meet its obligations.
If this DPA conflicts with the Agreement, this DPA prevails as to the processing of Customer Personal Data. Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it.
Data exporter: the Customer, as identified in its account or order form; controller (or processor, under Module Three). Data importer: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]; processor. Contact for data protection: privacy@novatree.ai.
Hosting and processing Customer Data to provide the Service: managing requisitions, candidates and interviews; scheduling; communicating with candidates and employees; recording and transcribing interviews where the Customer enables it; organizational charts, workforce analytics and planning; and AI-assisted drafting, summarization and recommendations — all on the Customer’s instructions.
Continuous, for the term of the Agreement and the deletion period in section 11.
The Service is not designed to require special-category data. The Customer may choose to process some — for example, voluntary diversity information or accommodation requests — in which case it is protected by the role-based restrictions and measures in Annex 2, and the Customer is responsible for having a lawful basis.
The authority determined under Clause 13 of the Standard Contractual Clauses.
The technical and organizational measures are described on the Security & Trust page, which forms part of this Annex. They include:
This page is provided for general information and to support customer due diligence. It is not legal advice. Novatree.ai should have this document reviewed by qualified privacy counsel before it is relied upon, particularly regarding GDPR/UK GDPR, CCPA/CPRA, and jurisdiction-specific employment-data obligations.