GrooveCVSign In

Data Processing Agreement

Version v2 · effective May 25, 2026

Parties

This Data Processing Agreement (the "DPA") is entered into between:

(1) CANARY TECH VENTURES S.R.L., a Romanian limited liability company, fiscal identification code (CUI) 50495119, with registered office in Romania (the "Processor" or "GrooveCV"); and

(2) the Customer - the organization that accepts this DPA by creating an Account and accepting the Terms and Conditions through an authorized representative (the "Controller" or "Customer").

Each a "Party" and together the "Parties". The Customer's identifying details (legal name, registered office, registration number) are those provided by the Customer during Account registration and associated with the Customer's Account. This DPA is accepted electronically; no physical signature is required.

Recitals

(A) The Parties have entered into, or will enter into, an agreement under which GrooveCV provides the Service to the Customer (the "Service Agreement", reflected in our Terms and Conditions accepted at Account creation or in any signed written agreement). In the course of providing the Service, GrooveCV processes personal data on behalf of the Customer in the capacity of processor.

(B) The Parties wish to set out their respective obligations regarding the processing of personal data in compliance with Regulation (EU) 2016/679 (the "GDPR"), Romanian Law No. 190/2018, and other applicable data protection law (together, "Applicable Data Protection Law").

The Parties agree as follows:

1. Definitions

Terms used in this DPA and not defined here have the meanings given in Article 4 GDPR. In addition:

  • "Customer Personal Data" means personal data processed by GrooveCV on behalf of the Customer in the course of providing the Service, as further described in Annex 1.
  • "Data Subject" means an identified or identifiable natural person to whom Customer Personal Data relates.
  • "Personal Data Breach" has the meaning given in Article 4(12) GDPR.
  • "Subprocessor" means any third party engaged by GrooveCV to process Customer Personal Data in the course of providing the Service.
  • "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Article 46 GDPR.

2. Roles of the Parties

In respect of Customer Personal Data:

  • The Customer acts as controller under Applicable Data Protection Law.
  • GrooveCV acts as processor under Applicable Data Protection Law and processes Customer Personal Data exclusively on the documented instructions of the Customer, except where required to do otherwise by EU or Member State law to which GrooveCV is subject (in which case GrooveCV will inform the Customer of that legal requirement before processing, unless prohibited by law).

This DPA does not govern processing for which GrooveCV acts as a controller in its own right (e.g., Account data, billing data, telemetry, security and analytics data). Such processing is described in the GrooveCV Privacy Policy.

3. Processing of Customer Personal Data

3.1 Subject matter, duration, nature, and purpose

The subject matter, nature, purpose, duration, types of personal data, and categories of data subjects are described in Annex 1.

3.2 Customer instructions

GrooveCV will process Customer Personal Data only as instructed by the Customer, including: (i) as set out in this DPA, the Service Agreement, and the configuration of the Service through the Account; (ii) any other documented instructions the Customer provides through email to info@groovecv.com or privacy@groovecv.com.

If GrooveCV considers that an instruction infringes Applicable Data Protection Law, it will promptly inform the Customer in writing.

3.3 Customer warranties

The Customer warrants that (i) it has all necessary rights and legal bases under Applicable Data Protection Law to provide Customer Personal Data to GrooveCV for processing under this DPA; (ii) it has provided all required information to Data Subjects, including in relation to AI-assisted processing where applicable; and (iii) its instructions to GrooveCV comply with Applicable Data Protection Law.

4. Confidentiality and personnel

GrooveCV will (i) take reasonable steps to ensure that any person authorized to process Customer Personal Data is informed of its confidential character; (ii) ensure that such persons are bound by appropriate contractual or statutory confidentiality obligations; and (iii) limit access to Customer Personal Data to persons who need access for the performance of the Service.

5. Security of processing

GrooveCV will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of processing and the risks to the rights and freedoms of natural persons. The current measures are summarized in Annex 3.

GrooveCV will assist the Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to GrooveCV.

6. Subprocessors

6.1 General authorization

The Customer grants GrooveCV a general authorization to engage Subprocessors for the processing of Customer Personal Data, provided that GrooveCV (i) imposes on each Subprocessor data protection obligations no less protective than those set out in this DPA; (ii) lists the Subprocessors in Annex 2 and maintains an up-to-date list available to the Customer; and (iii) remains fully liable to the Customer for the performance of each Subprocessor's obligations.

6.2 Changes to Subprocessors

GrooveCV will give the Customer at least 30 days' prior notice of any intended changes concerning the addition or replacement of Subprocessors, by email to the Customer's Account administrator. The Customer has the right to object to such changes on reasonable grounds related to data protection. If the Parties cannot agree on a solution, the Customer may terminate the affected portion of the Service Agreement by written notice, without penalty.

7. Data Subject rights

GrooveCV will, taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as possible, for the fulfilment of the Customer's obligation to respond to requests by Data Subjects exercising their rights laid down in Chapter III GDPR.

GrooveCV will promptly inform the Customer of any request received directly from a Data Subject relating to Customer Personal Data. Except as required by law, GrooveCV will not respond to such requests without the Customer's documented instructions.

8. Personal Data Breach notification

GrooveCV will notify the Customer without undue delay, and in any event no later than 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent then known:

  • A description of the nature of the breach, including categories and approximate numbers of affected Data Subjects and records.
  • The likely consequences of the breach.
  • The measures taken or proposed to address the breach and to mitigate adverse effects.
  • Contact details for further information.

GrooveCV will cooperate with the Customer and take reasonable steps in line with the Customer's documented instructions to investigate, mitigate, and remediate the breach. GrooveCV will document all Personal Data Breaches affecting Customer Personal Data.

9. Data Protection Impact Assessment and consultation

GrooveCV will provide reasonable assistance to the Customer with any data protection impact assessments and prior consultations with supervisory authorities or other competent authorities that the Customer reasonably considers required by Article 35 or 36 GDPR, in each case in relation to Customer Personal Data and the Service.

10. International transfers

GrooveCV hosts and processes Customer Personal Data in the European Union/European Economic Area by default. Where Customer Personal Data is transferred outside the EU/EEA to a country that is not the subject of an adequacy decision under Article 45 GDPR, the Parties will rely on the Standard Contractual Clauses (Module 2 - controller to processor; Module 3 - processor to processor), together with supplementary technical and organizational measures as appropriate.

Where GrooveCV engages a Subprocessor located outside the EU/EEA in such a country, GrooveCV will impose contractual safeguards equivalent to the SCCs and ensure that the transfer complies with Applicable Data Protection Law.

11. Audits

GrooveCV will make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, subject to the following conditions:

  • The Customer will provide at least 30 days' prior written notice, except in case of a Personal Data Breach.
  • Audits will be conducted during normal business hours, not more than once per calendar year, and in a manner that does not unreasonably interfere with the operation of the Service.
  • The auditor must enter into appropriate confidentiality obligations and may not be a competitor of GrooveCV.
  • GrooveCV may satisfy this obligation by making available existing third-party audit reports (e.g., SOC 2, ISO 27001) where relevant.
  • The Customer is responsible for its own costs and the reasonable costs of GrooveCV in supporting the audit, except where the audit reveals a material breach by GrooveCV.

12. Return or deletion of Customer Personal Data

At the choice of the Customer expressed in writing within 30 days following the end of the provision of the Service, GrooveCV will (i) return all Customer Personal Data to the Customer in a structured, commonly used and machine-readable format, and/or (ii) delete all Customer Personal Data in its possession or control, unless EU or Member State law requires storage of the personal data.

If the Customer does not provide instructions within 30 days, GrooveCV will delete Customer Personal Data without undue delay, except for back-up copies that will be deleted in the normal course of back-up rotation (no later than 90 days).

GrooveCV will ensure that its Subprocessors comply with this Section.

13. AI-assisted processing - additional terms

Where the Service processes Customer Personal Data through AI-assisted features, the following additional terms apply:

  • GrooveCV applies a mandatory PII-stripping layer before sending Customer Personal Data to any AI provider, removing names, age, gender, nationality, and photographs. Only professional information in structured form is sent to AI models.
  • All AI processing of Customer Personal Data occurs on EU/EEA-region endpoints of the relevant AI provider, except where the Parties expressly agree otherwise in writing with supplementary safeguards.
  • GrooveCV contractually prohibits each AI Subprocessor from using Customer Personal Data to train, fine-tune, or improve generally available models.
  • AI outputs are drafts requiring human review by Customer personnel. GrooveCV's AI features do not produce automated decisions with legal or similarly significant effects under Article 22 GDPR.
  • GrooveCV maintains an audit log of AI interactions (model, region, timestamp, prompt template version, references to data processed) for a period of 12 months.

14. Liability

The liability of each Party under this DPA is subject to the limitations and exclusions of liability set out in the Service Agreement, save to the extent prohibited by Applicable Data Protection Law. Nothing in this DPA limits a Data Subject's rights under Articles 79 and 82 GDPR.

15. Term and termination

This DPA enters into force on the later of (i) the date both Parties sign it, or (ii) the date the Customer accepts the Terms and Conditions. It remains in force for the duration of the Service Agreement and any extension thereof. Sections that by their nature should survive termination will survive.

16. General

16.1 Conflict

In the event of any inconsistency between this DPA, the Service Agreement, and any other agreement between the Parties, this DPA prevails in relation to obligations concerning the protection of Customer Personal Data.

16.2 Changes in law

If Applicable Data Protection Law changes in a manner that materially affects the Parties' obligations under this DPA (including the adoption of new Standard Contractual Clauses), the Parties will negotiate in good faith to amend this DPA accordingly.

16.3 Governing law and jurisdiction

This DPA is governed by the laws of Romania. Disputes are subject to the exclusive jurisdiction of the competent courts of Bucharest, Romania.

16.4 Severability

If any provision of this DPA is held invalid or unenforceable, in whole or in part, the remaining provisions remain in full force and effect.

16.5 Counterparts and electronic signature

This DPA may be executed in counterparts and by electronic signature (including click-wrap acceptance), each of which is deemed an original.

Annex 1 - Description of Processing

1. Subject matter of the processing

The processing of Customer Personal Data by GrooveCV acting as Processor on behalf of the Customer acting as Controller, in the course of providing the GrooveCV Service - a software-as-a-service platform that helps the Customer to build, manage, and deliver candidate shortlists to its end clients.

2. Nature and purpose of the processing

  • Storage, transmission, retrieval, organization, structuring, and display of Customer Personal Data within the Service.
  • Automated parsing of CVs/resumes to extract structured profile data.
  • AI-assisted drafting of candidate summaries and side-by-side presentations, with mandatory anonymization of inputs.
  • AI-assisted identification of skill matches between candidate profiles and job descriptions (informational only).
  • Delivery of candidate shortlists to the Customer's end clients via Client Portal and email.
  • Collection of structured client feedback on candidates.
  • Interview scheduling and, where enabled, temporary interview recording.
  • Provision of customer support and operation of the Service.

3. Duration of the processing

For the duration of the Service Agreement, plus the deletion/return period described in Section 12 of this DPA.

4. Categories of Data Subjects

  • Candidates whose data is uploaded to or processed through the Service by the Customer.
  • Customer Authorized Users (recruiters, administrators, agency staff) - but note: processing of Customer Authorized User personal data is generally covered by the GrooveCV Privacy Policy where GrooveCV acts as controller; this DPA covers it only to the extent the Customer instructs us to process such data on its behalf.
  • Customer's end clients (hiring managers, decision makers) who receive and interact with shortlists through the Client Portal.
  • Interview participants including candidates and the Customer's end clients, where interview features are used.

5. Types of Customer Personal Data

  • Identification data: name, email, phone number, location, photograph.
  • Professional data: CV/resume content, experience, employment history, skills, education, certifications, languages, salary expectations (if provided).
  • Document attachments uploaded by the Customer in relation to candidates.
  • Notes, tags, and annotations added by Customer Authorized Users.
  • AI-extracted structured metadata derived from candidate documents.
  • Client feedback: ratings, comments, inline annotations, hiring decisions.
  • Interview scheduling data: proposed and confirmed time slots, attendee details, optional video recordings.
  • Portal access data: access logs, PIN entries, link clicks of the Customer's end clients.

GrooveCV does not intentionally process special categories of personal data within the meaning of Article 9 GDPR. The Customer must not upload such data to the Service except where strictly necessary, with a valid legal basis, and after notice to GrooveCV.

6. Categories of recipients

  • GrooveCV personnel on a need-to-know basis.
  • Subprocessors as listed in Annex 2.
  • Recipients of Customer-shared content (Customer's end clients) through the Client Portal, on the Customer's instructions.

7. Locations of processing

European Union/European Economic Area only by default. International transfers, if any, are governed by Section 10 of this DPA.

Annex 2 - Authorized Subprocessors

As of the effective date of this DPA, the following Subprocessors are authorized to process Customer Personal Data:

Infrastructure and storage

  • Amazon Web Services EMEA SARL - hosting (EC2), object storage (S3), supporting services. Locations: EU regions (Frankfurt, Ireland).
  • Supabase Inc. - managed PostgreSQL database, authentication, storage. EU region.

Communications

  • Resend (Resend.com / Resend Inc.) - transactional email delivery (account, notifications, shortlist delivery).

Billing and payments

  • Lemon Squeezy / Paddle - merchant of record and payment processing. Either may be used depending on subscription region. Card details are handled directly by the processor; GrooveCV does not store card numbers.

Analytics and monitoring

  • PostHog Inc. - product analytics. EU instance. Candidate identifiers are hashed.
  • Functional Software, Inc. (Sentry) - application error monitoring. Best-effort PII scrubbing applied.
  • Google LLC (Google Analytics) - website analytics on marketing site only. IP anonymization enabled.
  • Microsoft Corporation (Clarity) - website behavioral analytics on marketing site only.

AI inference

  • Google LLC / Google Cloud (Gemini, Vertex AI) - EU regions only for Customer Personal Data processing.
  • Mistral AI - AI inference, EU region (France).
  • Anthropic, PBC - via direct EU endpoint or AWS Bedrock EU regions only.

Optional - video interviews

  • Daily.co / Whereby (or equivalent) - real-time video calls and optional recording, where the Customer has enabled this feature. Storage of recordings is in EU regions.

GrooveCV maintains and publishes an up-to-date Subprocessor list at request to info@groovecv.com and via the Service. GrooveCV will notify the Customer at least 30 days in advance of any change to this list, in line with Section 6.2.

Annex 3 - Technical and Organizational Measures

GrooveCV implements the following technical and organizational measures, which it may update from time to time to address evolving threats and best practices:

A. Confidentiality

  • Access control: role-based access (Admin, Recruiter) with least-privilege configuration; production access limited to a small number of trained personnel.
  • Authentication: strong password policy, multi-factor authentication for production system access.
  • Multi-tenancy: strict row-level security and logical isolation between Customer Accounts.
  • Encryption in transit: TLS 1.2 or higher for all network communications.
  • Encryption at rest: AES-256 or equivalent for stored data and backups.
  • Anonymization layer for AI: mandatory stripping of PII (name, age, gender, nationality, photograph) before any data is sent to AI providers.

B. Integrity

  • Audit logging: centralized logging of system, security, and AI interaction events.
  • Change management: code review and approval before production deployment.
  • Backup integrity: regular backups with restore testing.

C. Availability and resilience

  • Redundant hosting: multi-availability-zone deployment within EU regions.
  • Automated backups: daily backups with retention aligned to retention policy.
  • Disaster recovery: documented disaster recovery plan with RTO/RPO targets.

D. Process for regular testing, assessment, and evaluation

  • Security review of code changes affecting authentication, data access, or AI components.
  • Vulnerability monitoring of dependencies; timely patching of high-severity issues.
  • Periodic penetration testing of the Service.
  • Vendor risk reviews for all Subprocessors before onboarding and at least annually.

E. Incident response

  • Documented incident response procedure with named owners and escalation paths.
  • Notification targets: internal escalation within 24 hours of awareness; Customer notification within 48 hours per Section 8; authority notification within 72 hours where applicable.

F. Personnel measures

  • Confidentiality obligations in all employment and contractor agreements.
  • Security and data-protection training for all personnel with access to Customer Personal Data.

17. Acceptance

This DPA is entered into and accepted electronically when the Customer's authorized representative accepts the Terms and Conditions and creates an Account. No physical signature is required. The Customer's acceptance is recorded together with a timestamp and the version of this DPA accepted. A countersigned written copy can be provided on request for Customers whose internal policies require one.