Data Processing Agreement
How we process candidates’ personal data on your organisation’s behalf.
01Parties and roles
This Data Processing Agreement ("DPA") is between the organisation using Cohort (the controller) and Protocol AB (the processor). It applies whenever we process personal data on the organisation’s behalf and forms part of the Terms of Service. It is intended to meet Article 28 of the GDPR.
02Subject matter and duration
We process personal data to provide Cohort: receiving applications, storing CVs, analysing them against job requirements and showing the results to the organisation. Processing lasts for as long as the organisation uses Cohort and ends as described under Deletion.
03Data and data subjects
Data subjects are candidates who apply to the organisation’s jobs and members of the organisation. Personal data includes names, contact details, CVs and their contents (such as work history, education and skills), cover letters, analysis results, notes and application status. The organisation should not ask candidates for special category data.
04Instructions
We process personal data only on the organisation’s documented instructions, which are these terms and the organisation’s use of Cohort’s features, unless the law requires otherwise; in that case we will tell the organisation first where the law allows. We will tell the organisation if we believe an instruction breaks data protection law.
05Confidentiality and security
Everyone authorised to process the data is bound by confidentiality. We apply appropriate technical and organisational measures, including encryption in transit and at rest, per-organisation access controls enforced in the database, encrypted session cookies, least-privilege access for staff and logging of access to the system.
06Sub-processors
The organisation authorises us to use sub-processors for hosting and storage (Scaleway, EU), sign-in (Zitadel), AI analysis (Mistral AI, EU), error reporting and product analytics (PostHog, EU; analytics only for people who accept it, and never CV contents) and payments (Polar, which does not receive candidate data). We impose data protection obligations on each sub-processor equivalent to this DPA and will notify organisation owners before adding or replacing one, giving them the opportunity to object.
07International transfers
Where personal data is transferred outside the EU/EEA, we ensure a lawful transfer mechanism is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.
08Assistance
Taking into account the nature of the processing, we help the organisation respond to data subjects exercising their rights, and with security, breach notification, data protection impact assessments and prior consultation where required.
09Personal data breaches
We notify the organisation without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its data, with the information the organisation needs to meet its own obligations.
10Deletion
When the organisation stops using Cohort, we delete or return its personal data at its choice, and delete remaining copies within 90 days unless the law requires us to keep them. CVs and analyses are deleted earlier when the organisation deletes them.
11Audits
We make available the information needed to demonstrate compliance with this DPA and allow for reasonable audits, with reasonable notice and no more than once a year unless required by a supervisory authority or after a breach. Requests can be sent to legal@cohort.example.