1. Scope and Applicability
This Data Processing Addendum ("DPA") supplements the Terms of Service entered into between Connect VFX ("Platform") and the subscribing Studio, Agency, or Recruiter organization ("Customer" or "Recruiter").
This DPA applies to the processing of personal data accessible via the Connect VFX Platform and Recruiter API relating to candidates located in the European Economic Area (EEA), United Kingdom, or Switzerland.
2. Dual Roles of the Parties
- Controller-to-Controller (C2C) Relationship (API Queries & Profile Search): When the Recruiter queries the Platform or Recruiter API to browse, inspect, or retrieve candidate credits, portfolio links, or professional attributes, Connect VFX and the Recruiter act as Independent Data Controllers. Each party is independently responsible for establishing a lawful basis for its recruitment outreach.
- Controller-to-Processor (C2P) Relationship (In-Platform Lists & Notes): Where the Recruiter uses in-platform features hosted on Connect VFX infrastructure (candidate shortlists, pipeline notes, candidate tags, or custom outreach logs), the Recruiter acts as the Data Controller and Connect VFX acts as the Data Processor.
3. Recruiter Obligations
The Recruiter represents, warrants, and covenants that:
- Lawful Outreach: It possesses a valid lawful basis under GDPR Article 6 for contacting any candidate discovered through the Platform.
- Anti-Spam Compliance: It will not use candidate data for automated mass marketing or unsolicited spam, complying strictly with the EU ePrivacy Directive.
- Deletion Cooperation: If a candidate requests erasure or opts out, the Recruiter shall purge that candidate from internal shortlists within thirty (30) days.
- Human Decision-Making: All hiring, screening, and interview decisions must involve genuine human evaluation and not rely solely on automated algorithms.
- No Data Reselling: The Recruiter shall not sell, license, lease, or syndicate candidate profile data to third-party data brokers.
4. Connect VFX Platform Obligations
- Security Safeguards: Maintained via database Row Level Security (RLS), TLS 1.3 transport encryption, and progressive API rate limiting.
- Subprocessors: All AI subprocessors operate under enterprise zero-retention agreements with zero training on customer or candidate data.
- Deletion Synchronization: Candidate Right to Erasure requests on the Platform are purged from active API endpoints within forty-eight (48) hours.
5. International Data Transfers
Where processing involves cross-border personal data transfers outside the EEA or United Kingdom:
- The parties rely on the EU-U.S. Data Privacy Framework (DPF) where certified.
- In the absence of a DPF certification, European Commission Standard Contractual Clauses (SCCs) Module 1 (C2C) or Module 2 (C2P), supplemented by a Transfer Impact Assessment (TIA), shall apply.