Data Processing Agreement
Template. Last updated: October 2026.
⚠️ Not yet legal advice or a finished contract. This template describes how Rezumz handles candidate data on a customer's behalf. It has not been reviewed by a lawyer, and the operating entity is not yet incorporated. If you need a signed DPA, email firststonelabs@gmail.com and we will agree the final wording with you.
1. Roles
The customer (the recruiter or organisation using Rezumz) is the controller of the personal data in candidate CVs, interview feedback and related records. Rezumz (First Stone Labs) is the processor and handles that data only to provide the service.
2. What is processed
- Subjects: job candidates, interviewers invited by the customer, and the customer's own users.
- Data: names, contact details and career history in CVs; AI-generated match scores and summaries; interview feedback and recommendations; scheduling choices and email logs.
- Purpose and duration: recruitment screening and coordination, for as long as the customer keeps the data in Rezumz.
3. Our commitments
- Process the data only on the customer's documented instructions, which include using the product's features.
- Keep it confidential, and limit access to people who need it to run and support the service.
- Apply the measures described on the security page.
- Use only the sub-processors listed on that page, and update the list before adding a new one that handles customer content.
- Help the customer answer requests from candidates (access, correction, deletion) using the product's export and delete tools or by email.
- Tell the customer without undue delay after becoming aware of a breach affecting their data.
- On request, or when the account is deleted, delete the customer's data. Deleting a job removes its candidates, rounds and feedback.
- Provide the information reasonably needed to show compliance.
4. The customer's responsibilities
The customer confirms it has a lawful basis for the candidate data it uploads, has given candidates the notices the law requires, and uses AI output as an aid to a person's decision, not as an automatic decision.
5. International transfers
Data is stored and processed in the United States. For transfers from the EU/EEA or UK, the parties will rely on the safeguards the law provides, such as standard contractual clauses, to be confirmed in the signed version.
6. Liability and term
Liability follows the Terms of Service. This agreement lasts as long as Rezumz processes the customer's data.