Data Processing Agreement (DPA)

Processor: InteliWeb, MB (Lithuania), company code 306407244, email: [email protected], operating the TalentSense platform. Controller: The customer using TalentSense (employer, recruiter, or organization) that uploads or otherwise provides candidate personal data.

Subject matter: Provision of the TalentSense SaaS platform and related support. Duration: For the term of the customer's use of the service and as long as personal data is processed under the customer's instructions.

Nature: Collection, storage, organization, analysis, and retrieval of recruitment-related content provided by the customer. Purpose: To provide the TalentSense service, including AI-assisted analysis of CVs, job descriptions, and related materials as instructed by the customer.

Types of personal data may include: candidate identification and contact details, CV content, employment history, education, skills, and other information included by the customer. Data subjects: candidates, applicants, and customer's authorized users.

The customer (Controller) is responsible for: • ensuring a lawful basis for processing candidate data • providing required notices to candidates • obtaining consents where required • ensuring the data provided is accurate and appropriate

InteliWeb, MB (Processor) shall: • process personal data only on documented instructions from the Controller • ensure persons authorized to process data are bound by confidentiality • implement appropriate technical and organizational measures to protect data • assist the Controller, where applicable, in responding to data subject requests • assist with GDPR compliance obligations relating to security, breaches, and impact assessments where applicable

TalentSense may engage subprocessors (e.g., hosting, authentication, payment, AI providers) to deliver the service. Subprocessors are contractually bound to data protection obligations consistent with this DPA.

Personal data is stored and processed within the European Union. If a transfer outside the EU/EEA becomes necessary, appropriate GDPR safeguards will be used.

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller, and will provide information reasonably required for the Controller to meet its obligations.

Upon termination of the service, the Processor will delete personal data within a reasonable timeframe, unless retention is required by law or otherwise agreed for support, dispute, or compliance purposes.

Upon reasonable request, the Processor will provide information necessary to demonstrate compliance with this DPA and allow for audits in a proportionate manner, taking into account security and confidentiality obligations.

Email: [email protected] Company: InteliWeb, MB (company code 306407244)