1.Scope and parties
This public Data Processing Addendum ("DPA") is a discussion template for Caspian Solutions ("Processor" or "Caspian") and a customer ("Controller" or "Customer"). It is not effective and does not amend the Terms unless a version is separately agreed in writing and executed by authorized representatives of both parties. Before execution, the parties should review whether its terms satisfy the data protection laws and service-provider obligations that apply to their relationship.
2.Definitions
"Personal Data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR. "Customer Personal Data" means personal data in Customer Data, principally applicant data and data about the Customer's users. "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data, including the GDPR, UK GDPR, CCPA/CPRA and other US state privacy laws. "Subprocessor" means a third party engaged by Caspian to process Customer Personal Data.
3.Roles and details of processing
Customer is the controller (or business) and Caspian is the processor (or service provider) of Customer Personal Data.
- Subject matter: provision of the Apex ATS applicant tracking and messaging service.
- Duration: the period and any transition or deletion period stated in the applicable written Order.
- Nature and purpose: hosting, storage, candidate review, display and any messaging, scheduling, reporting or data transfer features that are enabled for the Customer's workspace.
- Categories of data subjects: job applicants and candidates; the Customer's users and hiring team.
- Categories of data: contact details, resume content and work history, education, skills, screening answers, cover letters, message content and metadata, interview details, notes and evaluations, consent and opt-out records, technical identifiers. Customers should not submit special category data through screening questions.
4.Processor obligations and instructions
Caspian will process Customer Personal Data only on the Customer's documented instructions, which consist of the Terms, this DPA, and the Customer's configuration and use of the Service, unless required to do otherwise by law, in which case Caspian will inform the Customer before processing unless the law prohibits it. Caspian will inform the Customer if it believes an instruction infringes Data Protection Laws.
Caspian will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality, will assist the Customer as described below, and will make available the information necessary to demonstrate compliance with this DPA.
Caspian does not sell or share Customer Personal Data, does not retain, use or disclose it for any purpose other than performing the Service, and does not combine it with personal data from other sources except as needed to provide the Service. Caspian certifies that it understands these restrictions.
5.Security measures
Safeguards and their availability depend on the hosting configuration and the Customer's enabled features. Before live applicant data is processed, the parties should verify the current production controls, including employer access boundaries, authentication, résumé storage, provider secrets, webhook configuration and backup arrangements.
6.Subprocessors
The following providers may process Customer Personal Data when the corresponding feature or customer-authorized transfer is used:
- Supabase, Inc.: database, authentication and file storage for the configured project; confirm hosting region in the active project settings.
- Cloudflare, Inc. (United States): application hosting, content delivery, DDoS protection and edge security.
- Twilio Inc. (United States): SMS transmission, when the Customer connects a Twilio account. Twilio is also engaged directly by the Customer under Twilio's terms.
- Resend (United States): transactional email delivery.
- Zoho Corporation (United States or the region selected for the account): recruitment data sent through an authorized Zoho Recruit action.
The active provider list, applicable provider terms and any notice or objection process must be confirmed in the Order or a separately executed data-processing agreement.
7.International transfers
The hosting and provider regions must be checked for the active deployment and each connected account. Any transfer mechanism required by applicable law must be identified and agreed in writing before the relevant cross-border processing begins.
8.Assistance with data subject requests
The Service does not provide self-service export, correction or deletion controls in every workspace. Requests involving Customer Personal Data should be sent to the Customer's authorized workspace owner. Any assistance, delivery method and timing from Caspian must be agreed under the applicable written data terms.
9.Personal data breach notification
Breach communications and assistance will follow applicable law and the response process stated in the executed Order or data-processing agreement. Contact the privacy address in the Order promptly if you suspect an incident involving Customer Personal Data.
10.Deletion and return
Export, return, retention and deletion are not self-service guarantees. The applicable written terms must identify the available format, authorized requester, timing and deletion process. Do not enter live applicant data until these terms are agreed.
11.Audits
Any compliance evidence or audit process must be scoped and agreed in writing, taking into account applicable law, confidentiality and security requirements.
12.Liability and term
Each party's liability under this DPA is subject to the limitations in the Terms. This DPA lasts as long as Caspian processes Customer Personal Data. Caspian may update this DPA to reflect changes in law or the Service with notice, provided the protections are not reduced.
13.Contact
Privacy contact for the Processor: [email protected]. The Customer's privacy contact is the email address of the Workspace Owner unless otherwise notified.
Last updated: September 2026.