This Data Processing Agreement (“DPA”) forms part of the agreement for the AINA recruitment services (“Main Agreement”) between the employer or business customer (“Controller”) and Senocom Ltd, a company incorporated in Cyprus, registration number HE468429, registered address: Germasogeia, Kapsalion 4, Floor 2, Flat/Office 203, Block B, 4044 Limassol, Cyprus (“Processor”).

This DPA governs only personal data processed by Senocom on behalf of the Controller (“Controller Personal Data”). Personal data that Senocom processes independently as controller, including its direct-to-candidate services, its own billing and its own analytics, is governed by its Privacy Policy and applicable law. Roles are determined by actual processing activities, not solely by contractual labels.

1. Scope and definitions

1.1. “GDPR” means Regulation (EU) 2016/679. Other terms have the meanings assigned under the GDPR. Details of processing are set out in Annex I.

1.2. This DPA applies for the term of the Main Agreement and until Controller Personal Data is returned or deleted in accordance with its terms. In case of conflict relating to processing of Controller Personal Data, this DPA prevails over the Main Agreement.

2. Instructions and responsibilities

2.1. Processor shall process Controller Personal Data only on documented instructions from Controller, including for international transfers, unless processing is required by applicable EU or Member State law; in that case Processor shall give prior notice unless prohibited on important public-interest grounds.

2.2. The Main Agreement, this DPA, documented configuration choices, authorised instructions in the Service and written instructions accepted by Processor together comprise Controller’s instructions. Processor shall promptly inform Controller if, in its opinion, an instruction infringes the GDPR or other applicable EU or Member State data protection provisions.

2.3. Controller determines the lawful purposes, legal basis, scope, notices and retention periods for its recruitment activities, including sourcing, interview recording, profiling, future-vacancy consideration and any special-category data. Controller shall ensure any instructions and disclosure of candidate data to Processor are lawful.

2.4. Processor shall not use Controller Personal Data for its own unrelated purposes, including training general-purpose AI models, except where expressly authorised by Controller on a separate lawful basis and consistent with the applicable vendor arrangements.

3. Confidentiality and security

3.1. Processor shall ensure authorised persons are bound by confidentiality commitments or appropriate statutory obligations, and access is limited to what is necessary.

3.2. Processor shall implement appropriate technical and organisational measures pursuant to Article 32 GDPR, considering the nature, scope, context and purposes of processing and the risks to data subjects. These measures are described in Annex II.

4. Personal data breaches

4.1. Processor shall notify Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data and provide information available to help Controller fulfil its obligations, including relevant facts, categories of affected data and mitigation steps.

4.2. Processor shall reasonably cooperate in containment, investigation and remediation and may provide information in stages as it becomes available.

5. Assistance and requests

5.1. Taking into account the nature of processing and available information, Processor shall assist Controller with requests to exercise data subject rights, security obligations, breach notifications, DPIAs and prior consultations required by Articles 32–36 GDPR.

5.2. Where Processor receives a request relating to Controller Personal Data, it shall promptly refer the request to Controller unless prohibited by law. Processor shall not independently decide the substance of a Controller-controlled request.

6. Sub-processors

6.1. Controller gives general written authorisation to engage sub-processors for the processing described in Annex I, subject to this section and the current register in Annex III.

6.2. Processor shall provide advance notice of intended additions or replacements of sub-processors, sufficient for Controller to object on reasonable data-protection grounds before the change takes effect. The parties shall address objections in good faith; if no reasonable resolution is possible, Controller may terminate the affected processing or Service to the extent provided by the Main Agreement and applicable law.

6.3. Processor shall impose written data-protection obligations on sub-processors that provide materially equivalent protection for Controller Personal Data and shall remain responsible for their performance as required by Article 28(4) GDPR.

6.4. Processor shall maintain an accurate register identifying authorised sub-processors, their processing activities and relevant processing locations, and make it available to Controller. The current register is set out in Annex III. Changes are subject to Section 6.2.

7. International transfers

7.1. For transfers subject to Chapter V GDPR, Processor and Controller shall ensure an applicable transfer mechanism is in place before the relevant transfer, such as an adequacy decision, applicable EU Standard Contractual Clauses or another permitted mechanism, and additional safeguards where needed.

7.2. This Article 28 DPA does not itself constitute international transfer Standard Contractual Clauses and does not independently authorise a restricted transfer. Processor shall provide reasonable information on processing locations and safeguards on request.

8. Retention, deletion and return

8.1. Controller may instruct retention of candidate records after a vacancy closes, including for future recruitment, only where Controller has established a lawful basis, provided required notices and set an appropriate retention period. Processor shall follow Controller’s documented instructions and must not assume indefinite retention.

8.2. Controller may request export or deletion of Controller Personal Data using available administrative functions or written instructions, subject to legal restrictions.

8.3. At the end of Services, Processor shall, at Controller’s choice, delete or return all Controller Personal Data and delete existing copies, unless applicable EU or Member State law requires storage. Backup deletion and evidence of deletion shall follow documented procedures consistent with legal obligations.

9. Information and audit

9.1. Processor shall make available information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, by Controller or its mandated independent auditor. The parties shall coordinate reasonable scheduling, confidentiality and security arrangements without limiting statutory audit rights.

10. Liability and governing law

10.1. Liability is allocated under the Main Agreement to the extent permitted by law; nothing limits non-excludable obligations, statutory data-subject rights or supervisory authority powers.

10.2. This DPA is governed by the laws of the Republic of Cyprus, without prejudice to overriding mandatory laws. Any forum clause in the Main Agreement applies insofar as legally permissible.

11. Changes and contact

11.1. Amendments affecting mandatory data-processing terms shall be implemented by legally effective agreement or another method permitted under the Main Agreement and applicable law, with appropriate notice.

11.2. Processor contact for data protection matters: main@aina-tech.com. Controller’s notices may be sent to the contact information designated in the Main Agreement.

ANNEX I — DESCRIPTION OF PROCESSING

ANNEX II — TECHNICAL AND ORGANISATIONAL MEASURES

Processor shall maintain technical and organisational measures appropriate to the risks under Article 32 GDPR, including the following control categories for the Service:

• Role-based access with least-privilege permissions and access removal when no longer needed.
• Secure authentication for privileged access and appropriate safeguards for credentials.
• Encryption or equivalent protections for data in transit and at rest, appropriate to the processing risks.
• Backup, restoration, availability and business-continuity measures.
• Security logging, vulnerability remediation, system maintenance and incident response procedures.
• Confidentiality obligations, personnel security instructions and sub-processor oversight.
• Procedures supporting retention, data export, deletion, access requests and periodic control review.

ANNEX III — SUB-PROCESSOR REGISTER

This register lists vendors that may process Controller Personal Data on behalf of Senocom when the relevant AINA features are used. Listing a vendor does not mean that every Controller’s data is sent to that vendor. Independent AINA product analytics and billing processing do not, merely by virtue of their use elsewhere on the platform, make those providers sub-processors of an employer.

ANNEX IV — ROLE BOUNDARIES (EXPLANATORY)

Employer-directed ATS, candidate records uploaded by an employer, employer-requested interviews and their derived assessments are generally Controller-directed processing covered by this DPA. Candidate-created AINA profiles, personal career coaching, job searching, independent product analytics and AINA billing may be controlled by Senocom directly and are not automatically subject to this DPA.

For external sourcing and cross-employer visibility, the parties’ actual purposes and means determine their roles. Each party shall ensure relevant transparency notices, lawful bases, data-sharing conditions and access controls are established for its activities.