Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between the organisation using the Helixon platform to screen candidates (“Customer”, “Controller”) and the operator of Helixon (“Helixon”, “Processor”), and applies whenever Helixon processes personal data on Customer’s behalf in the course of providing the Helixon service under the Terms of Service. Helixon is not yet operated through an incorporated company; this section will be updated with the registered company name once incorporation is complete.

In the event of a conflict between this DPA and the Terms of Service, this DPA governs with respect to the processing of personal data.

“Data Protection Laws” means UK GDPR, EU GDPR (Regulation (EU) 2016/679), the UK Data Protection Act 2018, and any other applicable law relating to the processing of personal data.

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” take the meanings given in the applicable Data Protection Laws.

“Sub-processor” means any third party appointed by Helixon to process personal data on Customer’s behalf, as listed in Annex B.

Helixon processes personal data solely to provide the CV screening and candidate scoring service: parsing uploaded CVs, comparing them against job descriptions, generating match scores, and drafting candidate correspondence at Customer’s instruction.

Processing continues for the duration of the underlying agreement between Helixon and Customer, and ceases (subject to Section 13) on termination.

The nature of processing is automated analysis of candidate documents against role requirements. The purpose is to help Customer’s recruiters identify and prioritise suitable candidates faster. Helixon does not use Customer’s data to train any underlying model, and does not sell or share personal data with third parties for their own purposes.

Data subjects: job candidates whose CVs are uploaded by Customer, and Customer’s own personnel (users of the platform).

Categories of data: name, contact details, employment and education history, skills, and any other information a candidate has chosen to include on their CV. Helixon does not knowingly process special category data and asks Customer not to upload CVs containing it beyond what a candidate has voluntarily disclosed within their own document. Where a CV contains it, it is processed only because it is in the document: the AI is instructed never to base any score or judgement on a protected characteristic, and Customer can screen blind.

Customer personnel: account details, activity history within the workspace, and - only while Customer has team presence switched on - when each person has Helixon open and last used it, plus any status they set. Individuals can hide their presence and Customer can switch the feature off, which deletes what was recorded.

Helixon shall:

• process personal data only on Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by law;
• ensure persons authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures set out in Annex C;
• assist Customer in responding to data subject requests and regulatory inquiries, including by providing in-product tools to export, correct and erase all data held about a candidate;
• record, with each analysis, Customer’s confirmation that it has a lawful basis to screen the CV;
• delete candidate data automatically once it has been inactive for the retention period Customer sets (6, 12, 24 or 36 months; 12 by default), unless Customer chooses to keep it;
• delete or return all personal data at the end of the engagement, at Customer’s election, subject to any legal retention requirement.

Customer provides general authorisation for Helixon to engage the sub-processors listed in Annex B. Helixon will notify Customer of any intended change to that list at least 14 days in advance, giving Customer the opportunity to object on reasonable data protection grounds. Helixon remains liable for the acts and omissions of its sub-processors as if they were its own.

Where Helixon receives a request from a data subject relating to Customer’s data (access, erasure, rectification, or otherwise), Helixon will not respond directly and will instead forward the request to Customer without undue delay, providing reasonable assistance to help Customer fulfil it.

Customer can fulfil most requests itself in Helixon: Export data on a candidate’s profile produces a machine-readable file of everything held about them across every job they were screened for (access and portability); Delete candidate can erase every one of those records, their files included (erasure); and their details can be edited (rectification).

Automated processing. Helixon’s match scores and summaries are decision support. Helixon does not make decisions producing legal or similarly significant effects on candidates; Customer agrees that a person will review an assessment before any such decision, and will meet any request from a candidate for human review or an explanation.

Helixon maintains the technical and organisational measures described in Annex C, including encryption in transit and at rest, access controls, and regular review of its security practices. These measures are designed to ensure a level of security appropriate to the risk.

Helixon will notify Customer without undue delay, and in any event within 48 hours of becoming aware, of any Personal Data Breach affecting Customer’s data, together with the information reasonably necessary for Customer to meet its own notification obligations.

Personal data is hosted in Switzerland (Zurich), which has UK and EU adequacy decisions. Where processing by a sub-processor involves a transfer outside the UK or EEA, Helixon relies on the UK International Data Transfer Addendum or EU Standard Contractual Clauses, as applicable, to ensure an adequate level of protection.

On reasonable written notice, and no more than once per year unless required by a regulator or following a Personal Data Breach, Customer may request evidence of Helixon’s compliance with this DPA. Helixon will make available its most recent security documentation and, where that is insufficient, permit an audit conducted at Customer’s cost during business hours.

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. This DPA remains in effect for as long as Helixon processes personal data on Customer’s behalf.

• Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access control and single sign-on for internal systems
• Database and file storage in Zurich, Switzerland, with every agency’s data kept separate and only reachable through checks on the person asking
• Original CV files held privately and opened only through links that expire after one minute
• Automatic deletion of candidate data after Customer’s chosen period of inactivity, and of all candidate and CV data 90 days after an agency’s subscription is cancelled
• Talent pool entries that lapse after the retention period unless renewed
• A recorded lawful-basis confirmation with every analysis
• Anonymisation of a user’s name, presence and authored history when they delete their account
• Logged, limited access by Helixon staff
• Continuous dependency vulnerability scanning
• Documented incident response process with defined notification timelines