Data Processing Agreement

Calau processes personal data on behalf of the Client for as long as the contractual relationship between the parties lasts, and only to the extent necessary to provide the service described in the Terms of Service: document analysis, structured extraction of CVs, matching of profiles to requirements, proposal generation, and other platform features.

The personal data processed on the Client's behalf typically concerns the consultants and staff whose profiles the Client uploads, and includes name, contact details, academic background, professional experience, skills and, when the Client uploads them, salary or fee data. The Client is responsible for ensuring it has a legal basis and, where applicable, the consent of the data subjects to upload this data to the platform.

Calau processes data according to the Client's instructions, expressed through the platform's configuration and normal use (for example, which documents to upload, which profiles to make available for matching against requirements, and which layouts and templates to use). Calau does not use this data for its own purposes, nor does it share it with other client organisations.

Calau relies on the following sub-processors to provide the service, each limited to the function indicated:

• Hosting providers for the servers and the database, in the European Union.
• Artificial intelligence model providers (currently Google, and depending on configuration, also Anthropic or OpenAI), for text analysis and generation.
• A transactional e-mail delivery service.
• An off-site backup service.

We will notify the Client with reasonable advance notice before adding or replacing a sub-processor with access to personal data, so that it can raise a reasoned objection.

Calau maintains technical and organisational measures appropriate to the risk, including: encryption of connections in transit and of passwords, isolation of each organisation's data in two independent layers (application-level isolation and row-level security in the database), two-factor verification available for user accounts, an audit log of relevant actions, and daily backups, verified and stored off the main machine.

In the event of a security breach affecting personal data processed on the Client's behalf, we will notify the Client without undue delay after becoming aware of it, with the information available on the nature of the breach, the data and data subjects affected, and the measures taken or proposed, so the Client can meet its own notification obligations.

Calau provides reasonable assistance to the Client in responding to data subject requests (access, correction, deletion) relating to data processed on the platform, and in meeting data protection impact assessment obligations, where applicable.

Once the contractual relationship ends, the Client may export its organisation's data through the platform or request a copy; after the retention period described in the Privacy Policy has elapsed, the data is deleted or anonymised, unless a longer retention period is legally required.

Upon reasonable request and with prior notice, Calau provides the Client with information about the security measures in place, sufficient for the Client to demonstrate compliance with its own regulatory obligations.

For questions about this agreement, write to privacidade@calau.app.