Data processing agreement.

This page summarizes Infyva's Data Processing Agreement (DPA) for customers under GDPR, UK GDPR, or Swiss FADP. The full executable version is available on request.

Summary of terms

1. Roles

Customer is the Controller of personal data of their candidates and recruiters. Infyva is the Processor acting on Customer's documented instructions.

2. Subject matter and duration

Infyva processes personal data only as needed to provide the Services described in the master agreement. Processing continues for the duration of the agreement and any retention period thereafter.

3. Categories of data

• Identification (name, email, role)
• Resume + skills + work history (when uploaded)
• Interview transcripts, audio, and video (Elite Live sessions only)
• Fraud detection signals (face presence, browser events) during interviews
• Usage telemetry (login times, feature use, billing events)

4. Categories of data subjects

• Candidates (job seekers using the platform or invited to screens)
• Recruiters and hiring managers
• Company administrators

5. Subprocessors

Listed at /legal/elite-data-handling. We give 30 days' notice via that page before adding or replacing any subprocessor that processes personal data. Customer may object and terminate the affected service if the change is unacceptable.

6. International transfers

Personal data is hosted in the United States. For transfers from the EU/UK/Switzerland, Infyva relies on Standard Contractual Clauses (EU SCCs, Module 2 — Controller to Processor) supplemented by additional safeguards: encryption in transit (TLS 1.2+), encryption at rest (AES-256), access controls, and the right to audit per Section 8 below.

7. Security measures

Infyva commits to the technical and organizational measures listed in Annex II:

• Encryption in transit and at rest
• Multi-factor authentication for all production access
• Role-based access control with least-privilege defaults
• Continuous logging of access to production data
• Annual third-party penetration testing
• SOC 2 Type II — currently in progress, target Q4 (will be made available to customers under NDA)

8. Audit rights

Customer may, no more than once per year, request a security audit. Infyva will provide its current SOC 2 report, penetration test summary, and answer reasonable security questionnaires within 30 days of request.

9. Personal data breach notification

Infyva will notify Customer without undue delay (within 72 hours of becoming aware) of any personal data breach affecting Customer's data, providing all information required under GDPR Article 33(3).

10. Data subject rights

Customer is responsible for responding to data subject requests (access, rectification, erasure, portability, objection). Infyva will assist Customer in fulfilling these requests:

• Self-serve data export (GDPR Article 20) at GET /api/v1/elite/data-export
• Self-serve session deletion (GDPR Article 17) at DELETE /api/v1/elite/sessions/{'{id}'}
• Bulk deletion or full account erasure: contact privacy@infyva.ai — completed within 30 days

11. Return or deletion of data

On termination, Customer may export all personal data via the API for 30 days. After that window, Infyva deletes Customer's personal data within 90 days, except where retention is required by law (billing records: 7 years).

12. Liability and indemnification

Per the master agreement. The DPA does not increase or decrease liability caps under that agreement.

13. Governing law

For Customers in the EEA, this DPA is governed by the laws of Ireland. For UK Customers, England and Wales. For all others, Delaware (USA).

Change history

• 2026-04-26 — initial DPA published.