Personal Data Processing Agreement

TalentRiver AB. Version 1.2. Effective date: 1 November 2026

This personal data processing agreement (the "Data Processing Agreement") is entered into between the Client and TalentRiver AB.

1. Introduction

1.1 The Parties have entered into an agreement (the "Agreement") regarding online human resources services to be provided by TalentRiver AB to the Client.

1.2 TalentRiver AB will process personal data on behalf of the Client when providing services under the Agreement and therefore acts as its data processor for such processing. The Client is the data controller.

1.3 This Data Processing Agreement constitutes such agreement between the data controller and the data processor as set out in Art 28.3 of the GDPR.

1.4 This Data Processing Agreement does not apply to processing for which TalentRiver AB is an independent data controller, namely: (i) the collection, structuring and maintenance of TalentRiver AB's database of publicly available professional profiles before a profile is imported by the Client; (ii) account, authentication and billing data of the Client's users; (iii) security, access and audit logs kept to protect the service; and (iv) aggregated or anonymised usage statistics. Such processing is governed by TalentRiver AB's privacy policy, published on talentriver.ai. When the Client imports a profile from the database into a vacancy, project or pipeline, the imported copy becomes Client Personal Data and is processed under this Data Processing Agreement from that moment.

2. Definitions

2.1 Terms defined in Applicable Data Protection Legislation, such as "data controller", "data processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority", shall be interpreted and applied in accordance with Applicable Data Protection Legislation.

2.2 In addition, the definitions below shall have the following meanings:

"Applicable Data Protection Legislation": Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), applicable Swedish data protection law, and, where applicable to the AI features of the service, Regulation (EU) 2024/1689 (the "AI Act").

"Client Personal Data": personal data that is transferred to, stored or otherwise processed by TalentRiver AB on behalf of the Client under the Agreement, as described in Appendix 1 (Specification).

"Sub-processor": a third party engaged by TalentRiver AB to process Client Personal Data.

"The Specification": Appendix 1 to this Data Processing Agreement.

3. Agreement documents and applicability

3.1 This Data Processing Agreement consists of this main document, Appendix 1 (Specification) and Appendix 2 (Security Measures). In the event of any conflict between this Data Processing Agreement and the Agreement, this Data Processing Agreement shall prevail with respect to the processing of Client Personal Data.

4. Processing and instructions

4.1 TalentRiver AB shall process Client Personal Data only on documented instructions from the Client, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by EU or Member State law to which TalentRiver AB is subject; in that case TalentRiver AB shall inform the Client of that legal requirement before processing, unless the law prohibits this. The Client's instructions are set out in this Data Processing Agreement and the Specification. The Client may give further written instructions through the service or by email to TalentRiver AB's privacy contact.

4.2 Both Parties undertake to comply with Applicable Data Protection Legislation to the extent that such legislation applies to the Party's obligations under the Agreement.

4.3 If TalentRiver AB considers an instruction from the Client to be in conflict with Applicable Data Protection Legislation, TalentRiver AB shall immediately notify the Client and may suspend the processing concerned until the Client has confirmed or changed the instruction.

4.4 TalentRiver AB shall not use Client Personal Data for its own purposes, including to train, fine-tune or improve machine learning models, except as anonymised and aggregated statistics that cannot be linked to a data subject or to the Client.

5. Security and personal data breaches

5.1 TalentRiver AB shall implement appropriate technical and organisational measures as set out in Art 32 of the GDPR to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of data subjects. The measures in place are described in Appendix 2 (Security Measures). TalentRiver AB may update Appendix 2 provided that the overall level of security is not reduced.

5.2 The Client has reviewed Appendix 2 and considers the measures appropriate for the processing under this Data Processing Agreement.

5.3 TalentRiver AB shall notify the Client without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting Client Personal Data, including a breach at a Sub-processor. The notification shall be sent to the Client's admin user and any security contact the Client has registered, and shall contain, as far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases. TalentRiver AB shall assist the Client in meeting its obligations under Arts 33 and 34 of the GDPR and shall document all personal data breaches.

6. Transfer of personal data to a third country

6.1 Client Personal Data is stored on servers within the EU/EEA as set out in Appendix 1 (Specification).

6.2 TalentRiver AB may transfer Client Personal Data to, or allow access from, a country outside the EU/EEA only if (i) the country is covered by an adequacy decision under Art 45 of the GDPR, or (ii) a valid transfer mechanism under Art 46 of the GDPR is in place, such as Standard Contractual Clauses, together with a documented transfer impact assessment and any supplementary measures required. Any Sub-processor involving such a transfer is subject to the notice and objection process in clause 9.

6.3 Subject to clause 6.2, the Client authorises TalentRiver AB to enter into Standard Contractual Clauses with the receiving party on the Client's behalf where required.

7. Assistance, information and audit

7.1 TalentRiver AB shall assist the Client, by appropriate technical and organisational measures and to the extent possible, so that the Client can respond to requests from data subjects exercising their rights under Applicable Data Protection Legislation. The service includes self-service functions for export, correction and deletion of candidate records.

7.2 TalentRiver AB shall assist the Client, taking into account the nature of the processing and the information available to TalentRiver AB, in ensuring compliance with Arts 32 to 36 of the GDPR, including by providing the information needed for the Client's data protection impact assessments and prior consultations.

7.3 On termination of the processing, TalentRiver AB shall, at the Client's choice, return or delete Client Personal Data in accordance with clause 15.

7.4 TalentRiver AB shall make available to the Client all information necessary to demonstrate compliance with Art 28 of the GDPR.

7.5 The Client has the right to audit TalentRiver AB's compliance with this Data Processing Agreement, directly or through an independent auditor bound by confidentiality. TalentRiver AB shall first offer its most recent third-party audit report, certification or penetration test summary. If these do not reasonably answer the Client's questions, the Client may conduct a remote or on-site audit on at least 30 days written notice, no more than once per 12-month period unless required by a supervisory authority or following a personal data breach, during normal business hours and in a way that does not disrupt TalentRiver AB's operations or expose other clients' data. The Client bears its own audit costs. If the audit shows material non-compliance by TalentRiver AB, TalentRiver AB shall remedy it without undue delay and bear its reasonable costs of contributing to the audit.

8. Contact with data subjects and supervisory authorities

8.1 If a data subject, a supervisory authority or another third party requests information from TalentRiver AB concerning the processing of Client Personal Data, TalentRiver AB shall without undue delay refer the request to the Client and await instructions, unless TalentRiver AB is required by law to respond directly. In that case TalentRiver AB shall inform the Client before responding where the law permits.

9. Sub-processors

9.1 The Client grants TalentRiver AB general prior authorisation under Art 28(2) of the GDPR to engage Sub-processors for the processing of Client Personal Data. TalentRiver AB shall impose on each Sub-processor, by written contract, data protection obligations equivalent to those in this Data Processing Agreement. The Sub-processors engaged at the date of this Data Processing Agreement are listed in Appendix 1 and on the sub-processor page on talentriver.ai.

9.2 TalentRiver AB shall notify the Client by email to the Client's admin user at least 30 days before adding or replacing a Sub-processor, and shall update the sub-processors page at talentriver.ai/subprocessors at the same time. The Client may object in writing on reasonable data protection grounds within 14 days of the notice. The Parties shall then discuss the objection in good faith. If no solution is found within 30 days of the objection, the Client may terminate the part of the service that depends on the new Sub-processor, or the Agreement if that part cannot be separated, with effect before the change takes place and without penalty. Prepaid fees for the terminated part are refunded pro rata.

9.3 TalentRiver AB remains fully liable to the Client for the performance of each Sub-processor's data protection obligations.

10. Confidentiality

10.1 In addition to the confidentiality obligations in the Agreement, neither Party shall disclose Client Personal Data or other information that emerges under this Data Processing Agreement ("Confidential Information") to third parties, unless required by Applicable Data Protection Legislation or instructed by the Client. Neither Party shall use Confidential Information for any purpose other than performing its obligations under Applicable Data Protection Legislation or this Data Processing Agreement.

10.2 TalentRiver AB shall ensure that persons authorised to process Client Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

11. Compensation

11.1 TalentRiver AB's processing of Client Personal Data is part of the services and is included in the fees under the Agreement. Assistance under clauses 5.3, 7.1, 7.2, 7.4 and 8 is also included. TalentRiver AB may charge a reasonable fee based on administrative cost only where the Client's requests for assistance are manifestly unfounded or excessive, in particular because of their repetitive character, and only after informing the Client in advance of the fee and the reason. Audits under clause 7.5 are at the Client's cost as stated there.

12. Liability

12.1 If TalentRiver AB, or anyone for whom TalentRiver AB is responsible, negligently processes Client Personal Data in violation of this Data Processing Agreement or contrary to lawful instructions of the Client, TalentRiver AB shall reimburse the Client for damages suffered as a result.

12.2 The Client shall reimburse TalentRiver AB with a reasonable amount for damages incurred as a consequence of the Client's, or anyone for whom the Client is responsible, non-fulfilment of its obligations under this Data Processing Agreement.

12.3 A Party shall not be liable for the other Party's loss of revenue, business opportunities, goodwill or other indirect damages.

12.4 A Party's obligation to pay damages under this clause 12 applies only if the non-breaching Party without delay gives written notice of the claim and its grounds.

12.5 The general limitation of liability in the Agreement also applies to this Data Processing Agreement, except that it does not limit either Party's liability for administrative fines imposed on the other Party as a direct result of the first Party's breach of this Data Processing Agreement, to the extent the law allows such allocation.

13. Changes to this Data Processing Agreement

13.1 If Applicable Data Protection Legislation changes, or a supervisory authority or court issues guidance or a decision that requires this Data Processing Agreement to be amended, TalentRiver AB shall make the necessary changes and notify the Client. Such changes take effect 30 days after the notice.

13.2 Other changes, for example for new features, are notified to the Client's admin user by email with a change log at least 30 days before they take effect. If the Client objects in writing within that period, the change does not apply to the Client and either Party may terminate the affected service without penalty.

14. AI features

14.1 The service includes features that use artificial intelligence to search, sort and summarise large volumes of candidate profiles against criteria set by the Client, in the pre-screening phase of recruitment ("AI Features"). AI Features help the Client's recruiters find and prioritise candidates to review. They do not make decisions about candidates and are not used to reject anyone.

14.2 TalentRiver AB, as provider of the AI Features, shall: (i) keep technical documentation describing the intended purpose, data used, known limitations and testing of the AI Features; (ii) design the AI Features so that users can see, understand and overrule their output; (iii) keep logs of AI Feature use sufficient to trace which recommendations were produced for which vacancy; (iv) evaluate the AI Features for bias against protected characteristics before release and after material changes, and make a summary of the latest evaluation available to the Client on request; and (v) not use Client Personal Data to train or improve models, as stated in clause 4.4.

14.3 The Client, as deployer of the AI Features, shall: (i) ensure that a natural person with the competence and authority to overrule the output reviews each candidate before a decision not to progress the candidate is made or communicated; (ii) not configure or use the AI Features to reject candidates automatically; (iii) inform candidates that AI-assisted screening is used, in the Client's candidate privacy notice; (iv) set criteria that describe skills and experience and do not act as proxies for protected characteristics; and (v) respond to candidates who ask for an explanation of a decision.

14.4 The high-risk obligations for AI used to filter or evaluate job applicants under Annex III of the AI Act apply from 2 December 2027 following the Digital Omnibus. The Parties shall cooperate to meet them from that date and any further obligations that apply from time to time.

15. Term and termination

15.1 This Data Processing Agreement applies from its signature and for as long as TalentRiver AB processes Client Personal Data.

15.2 On termination of the Agreement, the Client may export Client Personal Data through the service for 30 days. After that period, or earlier on the Client's written instruction, TalentRiver AB shall delete all Client Personal Data, including copies at Sub-processors, unless storage is required by EU or Member State law. Data in backups is deleted or overwritten within 7 days. TalentRiver AB shall confirm deletion in writing on request.

Appendix 1: Specification

This Appendix forms an integral part of the Data Processing Agreement between TalentRiver AB and the Client.

1. Purpose

1.1 This Appendix sets out the details of the processing of Client Personal Data that TalentRiver AB performs on behalf of the Client, as required by Art 28(3) of the GDPR.

2. Contact information

2.1 The Client (data controller): the Client identified in the Agreement. The Client's admin user is the contact for notices under this Data Processing Agreement unless the Client registers another contact.

2.2 TalentRiver AB (data processor): TalentRiver AB, reg. no. 559455-0005, C/O SSE Business Lab, Box 6501, 113 83 Stockholm, Sweden. Phone +46 73 359 2902. Privacy contact: Tim Tellqvist, CEO, hello@talentriver.ai.

3. Processing of personal data

3.1 Categories of personal data

The service does not require special categories of personal data (Art 9) or criminal conviction data (Art 10), and the Client shall not instruct TalentRiver AB to process them.

3.2 Categories of processing: collection, recording, structuring, storage, back-up, retrieval, consultation, adaptation or alteration, alignment or combination, analysis by AI Features, restriction, erasure or destruction.

3.3 Categories of data subjects

• Candidates who apply to the Client's vacancies

• Candidates sourced by the Client who have not applied

• Referees and other persons named by candidates

• Employees, former employees, consultants and other persons working or who have worked for the Client, including the Client's users of the service

• Persons who send or receive messages processed through the email and messaging integrations connected by the Client's users

3.4 Purpose of the processing: to provide the services to the Client as set out in, and for the duration of, the Agreement, including publishing vacancies, receiving and managing applications, sourcing, screening and ranking with the AI Features, candidate communication and scheduling, collaboration between the Client's users, and reporting.

3.5 Duration of the processing: during the term of the Agreement and for 30 days after termination to allow export, after which Client Personal Data is deleted in accordance with clause 15.2. During the term, the Client controls retention through the retention settings in the service.

4. Security measures

4.1 The technical and organisational security measures are set out in Appendix 2.

5. Sub-processors

The current list is published at talentriver.ai/subprocessors, which is the canonical list. At the date of this Data Processing Agreement:

The Client's users' own email provider (Google or Microsoft), accessed through the email integration, is the Client's own service provider and not a Sub-processor.

Appendix 2: Security measures

TalentRiver AB applies technical and organisational measures appropriate to the risk, as required by Art 32 of the GDPR, including: hosting of all Client Personal Data on Microsoft Azure in Germany; encryption of data in transit (TLS 1.2 or higher) and at rest; role-based access control with single sign-on and multi-factor authentication; access to production data limited to named staff bound by confidentiality; logging of access; encrypted daily backups stored in the EU; and a documented incident response procedure with breach notification as set out in clause 5.3.

The full description of TalentRiver AB's technical and organisational measures (the Security Measures Document) is provided to the Client on request and forms part of this Data Processing Agreement. TalentRiver AB may update the Security Measures Document provided that the overall level of security is not reduced.

Changes from version 1.1

Published with the DPA so customers can see what changed. Every change either strengthens the Client's position or adds a duty that TalentRiver AB already meets in practice.