Data Processing Addendum (GDPR)

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (“Agreement”) between:

Controlshift Talent Private Limited, the owner and operator of Yuruka (“Processor”, “Yuruka”, “Controlshift”, “we”, “our”, or “us”),

and

the Customer using the Services (“Controller” or “Customer”).

This DPA applies where Yuruka processes Personal Data on behalf of the Customer and such processing is subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, or any other applicable data protection law.

Unless otherwise defined in this DPA, capitalized terms have the meanings given in the Terms of Service.

For purposes of this DPA:

Controller means the entity determining the purposes and means of processing Personal Data.

Processor means the entity processing Personal Data on behalf of the Controller.

Personal Data, Processing, Data Subject, Personal Data Breach, Supervisory Authority, and Special Categories of Personal Data have the meanings assigned to them under applicable data protection laws.

This DPA applies whenever Yuruka processes Personal Data on behalf of the Customer while providing the Services.

Where Yuruka processes Personal Data for its own purposes (such as billing, account management, fraud prevention, or legal compliance), Yuruka acts as an independent Controller and this DPA does not apply to that processing.

Yuruka provides an AI-powered recruitment platform including:

• Applicant Tracking System (ATS)
• AI Candidate Sourcing
• Resume Parsing
• Resume Matching
• AI Interviews
• AI Assessments
• AI Calling
• Standard Calling
• Interview Reports
• Offer Letter Generation
• Employee Onboarding
• Vendor Management
• Recruitment Analytics
• Calendar Integrations
• API Services

This DPA remains effective for as long as Yuruka processes Personal Data on behalf of the Customer.

Yuruka processes Personal Data solely to provide the Services requested by the Customer, including:

• Hosting
• Storage
• Resume Processing
• Recruitment Workflows
• Interview Processing
• Assessments
• AI Analysis
• Communication
• Reporting
• Technical Support
• Security
• Platform Administration

Yuruka shall process Personal Data only on documented instructions from the Customer unless otherwise required by applicable law.

Depending on Customer use, Personal Data may include:

• Name
• Email address
• Telephone number
• Resume information
• Employment history
• Education
• Skills
• Certifications
• Interview recordings
• Assessment responses
• AI-generated reports
• Candidate communications
• Offer documentation
• Identity documents uploaded by Customers
• Technical log information

Data Subjects may include:

• Job Applicants
• Candidates
• Recruiters
• Hiring Managers
• Customer Employees
• Administrators
• Vendors
• Customer Representatives
• Platform Users

The Customer represents and warrants that it:

• Has a lawful basis for processing Personal Data.
• Has provided required privacy notices.
• Has obtained required consents where applicable.
• Will comply with GDPR and other applicable laws.
• Will not instruct Yuruka to process Personal Data unlawfully.
• Will respond to Data Subject requests unless otherwise agreed.

Yuruka shall:

• Process Personal Data only on documented instructions.
• Maintain confidentiality.
• Implement appropriate technical and organizational measures.
• Assist the Customer where reasonably possible.
• Notify the Customer of Personal Data Breaches without undue delay after becoming aware of a confirmed breach affecting Customer Personal Data.
• Delete or return Personal Data upon termination where applicable.
• Maintain records where required by law.

Yuruka maintains commercially reasonable technical and organizational safeguards, which may include:

• Encryption in transit
• Encryption at rest where appropriate
• Role-based access controls
• Authentication controls
• Security monitoring
• Backup procedures
• Incident response processes
• Employee confidentiality obligations
• Access logging
• Vulnerability management

Security measures may evolve over time provided they do not materially diminish the protection of Personal Data.

The Customer authorizes Yuruka to engage subprocessors to provide the Services.

Subprocessors may include providers supporting:

• Cloud Infrastructure
• Payment Processing
• Telephony
• Calendar Integration
• Video Conferencing
• Identity Management
• Email Delivery
• Analytics
• Security Monitoring
• Customer Support

Yuruka shall ensure that subprocessors are bound by written obligations that provide a level of protection for Personal Data substantially similar to this DPA.

Yuruka may update its list of subprocessors from time to time.

Where Personal Data is transferred outside the European Economic Area, the United Kingdom, or another jurisdiction requiring transfer safeguards, Yuruka shall implement an appropriate transfer mechanism recognized under applicable law, such as:

• Standard Contractual Clauses (SCCs)
• UK International Data Transfer Addendum
• Adequacy Decisions
• Other lawful transfer mechanisms

To the extent legally permitted and technically feasible, Yuruka shall reasonably assist the Customer in responding to requests from Data Subjects relating to:

• Access
• Correction
• Deletion
• Restriction
• Portability
• Objection
• Withdrawal of consent

Where Yuruka receives a request directly relating to Customer-controlled Personal Data, Yuruka may, unless prohibited by law, direct the request to the Customer.

Upon becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data, Yuruka shall notify the Customer without undue delay.

Such notification shall include, where reasonably available:

• Nature of the breach
• Categories of affected Personal Data
• Likely consequences
• Measures taken or proposed
• Contact information for follow-up

Yuruka shall cooperate with the Customer in responding to the breach where reasonably necessary.

Upon reasonable written request, and subject to appropriate confidentiality obligations, Yuruka shall make available information reasonably necessary to demonstrate compliance with this DPA.

Where additional audits are requested, the parties shall cooperate in good faith regarding scope, timing, confidentiality, and reasonable costs.

Yuruka is not required to disclose information that would compromise the security, confidentiality, or privacy of other customers.

Upon termination of the Services, and subject to applicable law and the Terms of Service, Yuruka shall, upon Customer request and where technically feasible:

• Return Customer Personal Data; or
• Securely delete Customer Personal Data,

unless retention is required by law or reasonably necessary for backup, dispute resolution, fraud prevention, security, or legal compliance.

The liability of each party under this DPA shall be subject to the limitations of liability set forth in the Terms of Service, except where such limitations are prohibited by applicable law.

This DPA shall be governed by the governing law specified in the Terms of Service, except to the extent that applicable data protection laws require otherwise.

In the event of a conflict between this DPA and the Terms of Service with respect to the processing of Personal Data, this DPA shall prevail solely to the extent of that conflict.

Questions regarding this DPA may be directed to:

Controlshift Talent Private Limited

Registered Office:

944, Block C Sushant Lok Phase 1 Gurugram, Haryana – 122001 India

Email: support@yuruka.com

Website: https://yuruka.com

Version: 1.0

© Controlshift Talent Private Limited. All Rights Reserved.