Data Processing Agreement

1 · Parties and roles

The Controller is the company that founded the hiring workspace (the customer under the Terms for Teams). The Processor is Erioun, operated by Loukas Tzekos, sole proprietorship, Thessaloniki, Greece (details on the Company details page). For the personal data of applicants processed in the workspace, the Controller determines the purposes and means and the Processor acts on the Controller's documented instructions. Erioun is separately a controller of its own account data about the Controller's members (their sign-in identity, billing contact and usage records) and of job seekers' own accounts — those are covered by the Privacy policy, not by this agreement.

2 · Subject matter, duration, nature and purpose

Subject matter: the personal data of people who apply to the Controller's roles, or whom the Controller adds to its pipeline. Duration: for as long as the workspace exists, plus the deletion period in section 9. Nature: collecting applications through the Controller's apply pages and imports; storing, displaying and searching them; ranking them with AI screening on the Controller's instruction; sending mail on the Controller's behalf; filing replies and bookings; producing offer letters and recording signatures; analytics; erasure. Purpose: enabling the Controller to run its recruitment.

3 · Data subjects and categories of data

Data subjects: applicants and candidates, including people the Controller imports. Categories:

• Identity and contact: name, email address, and whatever the applicant writes into the form.
• Application content: CV text and files, answers to the Controller's questions, cover text.
• Process data: pipeline stage and its history, notes and tags written by members, scorecards, screening scores and reasons, messages sent and received, interview bookings, offer letters, signature records (typed name, time, one-way fingerprints of connection and device).
• Special categories are not requested by the product; if an applicant volunteers such data in free text, the Controller is responsible for its lawful handling and may erase it.

4 · Controller's obligations

The Controller undertakes:

• To have a lawful basis for the processing and to inform applicants (the apply page carries a notice the Controller can extend).
• To give instructions only through the product's functions and the Terms; to use the product lawfully and without discrimination.
• To answer data-subject requests; the workspace provides export, erasure, and the timeline needed to answer an access request.
• To use AI screening as decision support only, keep the disclosure shown to members, and — as the deployer of a high-risk AI system in recruitment — to fulfil its own AI Act duties, with the Processor's assistance under section 6.

5 · Processor's obligations

The Processor undertakes (Art. 28(3) GDPR):

• Process only on the Controller's documented instructions — the product's functions and the Terms — including for transfers; inform the Controller if an instruction seems to infringe the law.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures in Annex 2.
• Engage sub-processors only under section 7.
• Assist the Controller with data-subject rights through the product (export, erasure, the record) and, where needed, by hand within ten working days.
• Assist the Controller with security, breach notification, impact assessments and consultations, taking into account the nature of the processing.
• Delete or return the data at the end of the service (section 9).
• Make available the information needed to demonstrate compliance and allow audits under section 10.

6 · AI screening

Screening is performed on the Controller's instruction (a member's click, or the Controller's own automation setting) by sending the CV text and the role to Mistral AI SAS, Paris, France, through Mistral's commercial API, whose terms exclude the use of API data for training. Erioun stores the score, the reasons and the model identifier as part of the application record; it never rejects, ranks people out of sight, or acts on a score. The disclosure required by Art. 50 AI Act is displayed on every screening surface. The Processor is the provider of this AI system and the Controller its deployer; each side cooperates with the other's obligations under Regulation (EU) 2024/1689 as those obligations apply in time.

7 · Sub-processors

The Controller authorises the sub-processors listed on the Third parties page under "Sub-processors for Erioun for Teams" (identity, location, purpose and safeguard for each). The Processor will announce any addition or replacement on that page at least 30 days before it takes effect and by notice in the workspace; the Controller may object on reasonable data-protection grounds within that period, in which case the parties will look for a solution and, failing one, the Controller may terminate the affected workspace without penalty. The Processor remains liable for its sub-processors' performance.

8 · Location of processing and transfers

Applicant data is stored and processed on servers operated for Erioun by OVHcloud in Warsaw, Poland (EU). Mail is delivered by Lettermint B.V. from servers in the EU. AI screening is performed by Mistral AI in France. Network delivery for erioun.com passes through Cloudflare, Inc.'s global edge, where connections are terminated and re-encrypted; no applicant data is stored there. Product analytics (PostHog, EU cloud, Frankfurt) never run on applicant-facing pages, so no applicant data reaches them. Where a sub-processor's contracting entity is outside the EEA (Cloudflare, Inc.; PostHog, Inc.), transfers rest on the Commission's Standard Contractual Clauses and, where the entity is certified, the EU-US Data Privacy Framework.

9 · Deletion, retention and return

Every path by which data leaves the workspace:

• The Controller can erase any applicant at any time with one action; the erasure cascade removes name, contact details, CV, notes, tags, scorecards, screening verdicts, message text and offer letters, and hollows the reply alias, leaving the anonymous counts. A signed offer letter is mailed to the applicant and to the Controller's admins as a last copy immediately before.
• The Controller can set a retention policy (6 to 36 months after a process ends); the applicant is warned by mail with the date, and the erasure runs 30 days later through the same cascade. Applicants who were hired are never swept by that policy.
• Export is available from the workspace at any time.
• When a workspace is deleted, its data is removed from the live systems within 30 days and from backups on their normal rotation; the Processor keeps only what the law requires (billing records).

10 · Audit and information

The Processor answers written information requests about this processing within 30 days and provides its current security measures and sub-processor list on request. Once per year, or after a breach affecting the Controller, the Controller may audit the Processor's compliance with this agreement by a written questionnaire or, where that is insufficient, by an on-site or remote audit on 30 days' notice, during business hours, at the Controller's cost, by an auditor bound by confidentiality. Erioun does not hold ISO 27001 or SOC 2 reports; the measures in Annex 2 are what is offered.

11 · Personal-data breach

The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware, of a personal-data breach affecting the Controller's data, with what it knows at that time (nature, categories and approximate numbers, likely consequences, measures taken), and supplements as facts become known. Notification goes to the workspace's admins by mail and in the workspace.

12 · Liability, term, law

Liability follows the Terms for Teams. This agreement lasts as long as the Terms and survives for as long as the Processor holds any of the Controller's data. Greek law applies; the courts of Thessaloniki have jurisdiction. Where this agreement and the Terms conflict on data protection, this agreement prevails.

Annex 1 · Description of processing

As in sections 2 and 3. Processing activities, in the order they occur: intake (apply page, manual add, CSV import), storage in the sealed vault, display to members, screening on instruction, messaging (outbound as the Controller's identity on Erioun's domain; inbound filed to the timeline), interview scheduling through the Controller's own booking page, offers and signatures, analytics on anonymous counts, retention and erasure.

Annex 2 · Technical and organisational measures

The measures in force, each one implemented in the product or its operation:

• Encryption at rest of applicant identity data in a cryptographic vault with per-workspace data keys; erasure includes shredding the keys where applicable.
• TLS for every connection; HSTS on erioun.com; signed service-to-service headers.
• EU hosting (OVHcloud, Warsaw) on servers administered only by Erioun; database access restricted to the application and to the operator.
• Access control by workspace membership enforced in the database (row-level security), with roles (owner, admin, member); every state change recorded with its actor; system actions attributed as such.
• Logs carry identifiers, never names or addresses; one-way fingerprints for audit records.
• Daily encrypted backups with limited retention; a documented erasure cascade that reaches every copy in the live systems.
• Retention automation with mandatory prior notice to the data subject.
• Outbound mail through one verified rail (SPF, DKIM, DMARC); inbound webhooks verified by signature; fail-closed on unsigned deliveries.
• Rate limiting on public endpoints keyed on the real client address; no analytics on applicant-facing pages.
• Change control through reviewed commits and automated tests before deployment; a public verification log of product behaviour is maintained.

Annex 3 · Sub-processors

Maintained on the Third parties page, section "Sub-processors for Erioun for Teams", which is the authoritative, dated list and the place where changes are announced.

Annex 4 · The applicant notice

Every apply page states, in the Controller's name: who is hiring; that the application is processed in Erioun on the employer's behalf on EU servers; that an AI system may rank it with reasons that a person reviews and that no decision is automated; how long the data is kept (the Controller's policy, if set); and how to ask for access, correction or erasure — by replying to any message from the employer or writing to the employer's address shown on the page.