Data processing agreement

Version 27 October 2026

This data processing agreement ("DPA") is between the company that uses Verso, as identified when this agreement is accepted (the "Customer", controller) and POLIGON TECH S.R.L., Orașul Cajvana, nr. 797, județul Suceava, Romania, trade register no. J2021001011338, CUI/VAT RO44336321 ("Verso", processor). It forms part of the terms of service and applies whenever Verso processes personal data for the Customer. If the DPA and the terms disagree on data protection, the DPA wins.

1. What we process and why

Verso processes candidate and recruiter personal data only to provide the service: receiving applications, reading CVs, running AI interviews, producing evaluations for the Customer's review, and sending related emails. Annex 1 describes the processing. It lasts for as long as the Customer uses Verso, plus the deletion periods in section 9.

2. Instructions

• Verso processes the data only on the Customer's documented instructions. These are the terms, this DPA, and the Customer's settings and actions in the dashboard (for example creating a job, editing a rubric or deleting a candidate).
• If EU or Member State law requires other processing, Verso tells the Customer first, unless that law forbids it.
• Verso tells the Customer straight away if it thinks an instruction breaks data protection law.
• The Customer is responsible for having a legal basis for the processing, for informing candidates, and for the hiring decisions. Verso's AI only recommends; a person at the Customer decides.

3. Confidentiality

Everyone at Verso who can access the data is bound by confidentiality and accesses it only when needed to run, support or secure the service.

4. Security

Verso keeps the technical and organisational measures in Annex 2 in place, appropriate to the risk (Article 32 GDPR). Verso may improve them over time but will not lower the overall level of protection.

5. Sub-processors

• The Customer gives general authorisation for Verso to use the sub-processors in Annex 3.
• Verso tells the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer can object on reasonable data protection grounds; if we cannot resolve it, the Customer can end the service and is refunded any prepaid, unused fees.
• Verso puts the same data protection obligations as in this DPA on each sub-processor by contract, and remains responsible to the Customer for them.

6. Transfers outside the EU

Some sub-processors are in the United States. Transfers rely on the EU-US Data Privacy Framework where the sub-processor is certified, or on the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

7. Helping the Customer

• Candidates' requests: the dashboard lets the Customer find, export on request, and delete a candidate's data. Candidates can also withdraw and delete their own data from their status link. If a candidate contacts Verso directly, Verso passes the request on to the Customer without undue delay.
• Impact assessments: Verso gives the Customer the information it reasonably needs for a data protection impact assessment, including a pre-filled template, and for consulting a supervisory authority.
• Breaches: Verso notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information Article 33(3) GDPR requires as it becomes available.

8. Information and audits

Verso makes available the information needed to show compliance with Article 28 GDPR. The Customer may audit once a year, or after a breach, with 30 days' written notice, during business hours and without access to other customers' data. Each party bears its own costs. Verso may first answer with documentation, which the Customer accepts if it reasonably answers the audit's questions.

9. Deletion

• Candidate data is deleted automatically 12 months after the job closes, or 18 months after the application if the job stays open, unless the Customer deletes it sooner.
• When the Customer deletes its account, Verso deletes all its jobs, candidates and team accounts at once. Backups expire within 30 days.
• When deleting, Verso may keep anonymous statistics that cannot identify anyone (for example scores per criterion, the month of the application and whether the interview was completed) to measure and improve the service. They are no longer personal data.
• Verso keeps a record of this DPA's acceptance as evidence, after the account is deleted.

10. Liability and term

Liability under this DPA follows the limits in the terms, except where the law does not allow it to be limited. This DPA lasts as long as Verso processes personal data for the Customer. It is governed by the law of Romania, and disputes go to the competent courts of Suceava, Romania.

Annex 1: Description of the processing

• Data subjects: job applicants to the Customer; the Customer's recruiters and team members.
• Personal data: name, email, phone, LinkedIn URL; the CV and what it contains; the AI interview transcript (text; voice audio is processed live and not recorded); integrity signals (tab switches, pastes, response delay); the AI evaluation; consent and status records; recruiter account data.
• Special categories: not requested. A CV or an answer may reveal them incidentally; the AI is instructed not to use them in scoring.
• Nature and purpose: collection, storage, analysis by AI models, structuring, display to the Customer, and deletion, to support the Customer's first-round screening.
• Frequency: continuous while the Customer has open jobs.

Annex 2: Security measures

• Data hosted in the European Union (Google Cloud (Google Cloud EMEA Ltd)); encryption in transit (TLS) and at rest.
• Each company's data is separated in the application; every query is scoped to the signed-in company.
• Recruiter access by individual accounts with hashed passwords; team members are invited by the Customer.
• Candidate pages use unguessable private links; public endpoints are rate-limited, with optional CAPTCHA.
• Secrets kept out of the code; production access limited to named Verso staff.
• Automatic deletion on schedule; database backups with limited retention.
• AI providers used under commercial terms that do not allow training on the Customer's data.

Annex 3: Sub-processors

• Anthropic, PBC: AI models that read the CV, run the interview and draft the evaluation. Location: United States.
• Google Cloud (Google Cloud EMEA Ltd): Hosting of the application and the database. Location: European Union.
• Resend, Inc.: Transactional email. Location: United States.
• ElevenLabs: Speech-to-text and voice for voice interviews (no audio recording). Location: United States / EU.