RolePark Data Processing Agreement

1. Parties and roles

The Customer is the controller of the personal data it puts into RolePark or receives through it (applications, candidate records, employee records). The processor is RolePark (the service operator at rolepark.com); hereinafter “RolePark”. RolePark processes this data only on behalf of the Customer.

This DPA does not cover processing for which RolePark itself is the controller: candidate cabinet accounts, public talent-pool profiles, accounts of company users as customers of the service, billing, the website, security of the service and its own analytics. That processing is described in the Privacy Policy.

2. Subject, duration, nature and purpose

• Subject and purpose: providing the RolePark service — an applicant tracking system, the candidate cabinet, HR modules the Customer enables, and the integrations the Customer connects.
• Nature of processing: collecting through careers pages, forms, imports and integrations; storing; organising; searching; showing to authorised users; sending emails and notifications; exporting; deleting.
• Duration: while the Customer uses the service, and after that until the data is deleted as described in section 10.
• Data subjects: candidates and applicants, referees and referred persons, the Customer’s employees and users, interviewers.
• Categories of data: identification and contact details, photos; CVs, experience, education, skills and expected salary; application answers, stages, notes, assessments and scorecards with scores, interviews and offers; messages in the candidate chat, the internal chat and the support chat; documents and e-signature evidence; HR records the Customer enables: position, manager, absences including sick leave with a supporting document (health data), HR Desk requests including anonymous ones, performance reviews, pulse answers, salary, personal documents and military registration data (salary, personal documents and the military registration document are encrypted; military reservation records are not field-encrypted); technical identifiers, IP addresses and browser identifiers in the audit log and in signing evidence.
• Special categories of data: the Customer decides whether to process them (for example health data in sick-leave documents) and is responsible for the legal basis and for limiting access through roles and field-level privacy. RolePark processes them only on the Customer’s instructions and with the measures in section 5.

3. Instructions

RolePark processes personal data only on the Customer’s documented instructions. These Terms, this DPA, the Customer’s settings and the actions of its authorised users in the service are those instructions. The Customer also instructs RolePark to act on the requests that candidates make through the service’s self-service tools — withdrawal of consent, the “That wasn’t me — delete my data” link and deletion of a cabinet account — which restrict or delete the related candidate records in the Customer’s workspace.

If RolePark believes an instruction infringes data-protection law, it will tell the Customer without delay. If the law requires RolePark to process data otherwise, it will inform the Customer first unless the law prohibits that.

4. Confidentiality

Only people who need access to provide or support the service may access the Customer’s data, and they are bound by confidentiality. RolePark staff do not open a Customer’s workspace except to provide support the Customer asked for, to investigate an incident, or where the law requires it. Changes made by RolePark staff are recorded in the Customer’s audit log as made by the RolePark platform; viewing is recorded in RolePark’s technical logs, not in the Customer’s audit log.

5. Security measures

• Encryption in transit (HTTPS/TLS 1.2 or higher, HSTS) and encryption at rest (AES-256-GCM) of integration tokens and of salary, personal-document and military-registration-document fields; passwords stored as bcrypt hashes; AI-assistant tokens stored only as hashes.
• Isolation of each Customer’s data, role-based permissions and field-level privacy; files available only to authenticated users of the Customer.
• Optional two-factor authentication, password policy and lockout after repeated failed sign-ins; single sign-on (SAML) and provisioning (SCIM) for Customers who use them.
• Audit log of changes in the Customer’s workspace; access log for sensitive HR data.
• Content Security Policy and other security headers; protection of outgoing requests from reaching private networks.
• Daily database backups kept for 30 days; monitoring and alerts; technical logs without IP addresses or request content.
• RolePark reviews these measures as the service and risks change and does not reduce the overall level of protection.

6. Subprocessors

The Customer gives a general authorisation for RolePark to engage the subprocessors listed at https://rolepark.com/subprocessors. RolePark imposes on each subprocessor data-protection obligations equivalent in substance to this DPA and remains responsible to the Customer for them.

RolePark informs the Customer in advance of material changes to subprocessors, as described on that page; the Customer may object on reasonable data-protection grounds.

7. Requests from data subjects

If a person contacts RolePark about data the Customer controls, RolePark forwards the request to the Customer and does not answer it on the Customer’s behalf, except for the self-service actions described in section 3. RolePark helps the Customer answer requests for access, rectification, erasure, restriction, portability and objection, mainly through the service’s tools: search, editing, export and deletion.

8. Personal data breaches

RolePark notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, and provides the information it has: what happened, which data and people are likely affected, the likely consequences, and the measures taken or proposed. RolePark updates the information as it becomes available and helps the Customer with notifications to supervisory authorities and data subjects.

9. Impact assessments and consultations

On request, RolePark provides the information it reasonably has to help the Customer carry out data-protection impact assessments and prior consultations with supervisory authorities about the service.

10. Return and deletion

During use of the service the Customer can export its data at any time; the export excludes chats, import source records, signing links and technical service tables. When the Customer stops using the service and asks for deletion, RolePark deletes the Customer’s data and files, except the PDF files of electronically signed documents, which currently remain, and pseudonymises its users (email, phone, photo and sign-in details are removed; first and last names remain in the history), as described at https://rolepark.com/data-retention. Copies remain in database backups for up to 30 days and in the pre-deletion archive until the Customer asks to delete it, unless the law requires longer storage.

11. Information and audits

RolePark makes available the information needed to demonstrate compliance with this DPA. Where that is not enough, audits by the Customer or an independent auditor bound by confidentiality are possible by prior agreement, under reasonable conditions that do not expose other customers’ data.

12. International transfers

RolePark is operated from Ukraine, and some subprocessors process data in other countries, including the United States. Where the Customer is subject to the GDPR and personal data is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, are incorporated into this DPA by reference; for the United Kingdom, the UK International Data Transfer Addendum to them applies. The details required by their annexes are taken from sections 1, 2 and 5 of this DPA and from the subprocessor list.

13. Liability and precedence

Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow them. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data; the Standard Contractual Clauses prevail over both. Questions: help@rolepark.com.