Draft for review, not in force yet. FoundOne s.r.o. publishes the final version before launch. Questions: hello@foundone.io
Data Processing Agreement
The people your agency keeps in FoundOne are your data: you decide, we process them only for you, keep them secure and in the EU, and tell you about any provider who touches them. When you leave, we hand them back and delete them.
1.Parties and scope
This agreement is between the agency using FoundOne (the controller) and FoundOne s.r.o., Evropská 2758/11, 160 00 Praha 6, Czech Republic (the processor). It applies to the personal data the agency keeps in FoundOne and is part of the Terms of Use. It meets Article 28 of the GDPR.
2.What we process, and why
- Purpose: running FoundOne for the agency: storing, organising, searching and presenting candidate profiles, sharing shortlists with the agency’s clients, and the AI features the agency uses.
- People concerned: candidates, the agency’s client contacts and portal guests, and the agency’s own team.
- Data: names and contact details; CVs, work history, education, skills, languages; availability and salary expectations; notes, tasks and pipeline history; client feedback; consent records. FoundOne is not built for special categories of data (health, beliefs and the like); the agency should not add them.
- Duration: as long as the agency uses FoundOne, then until deletion (see “At the end”).
3.Only on your instructions
We process the data only to provide FoundOne as the agency uses it, and on its documented instructions (the settings and actions in the app are such instructions), unless EU or Czech law requires otherwise, in which case we tell the agency first unless the law forbids it. We tell the agency if we think an instruction breaks data protection law.
4.Who at FoundOne can see it
Only staff who need it to run or support the service, bound to confidentiality. We look into a workspace only to fix a problem the agency reports, to keep the service secure, or when the law requires it.
5.Security measures
- Each agency’s data in its own database, separate from every other agency’s.
- Encryption in transit (HTTPS) and at rest (Cloudflare storage).
- No passwords: sign-in by single-use emailed links or Google / Microsoft; sessions expire.
- Roles within the agency (admin, manager, recruiter), checked on the server for every change; client portal guests see only what is shared with them, presented as the agency chose (anonymised profiles never leave the server with names).
- Rate limits and daily caps against abuse; optional bot checks on sign-in; a strict content security policy.
- Uploaded files checked by type and size, stored privately, served only to signed-in members.
- Change history kept per workspace; who confirmed each person’s consent, and when.
6.Subprocessors
The agency allows us to use these subprocessors. We bind each to data protection terms at least as strict as these, and we tell the agency at least 30 days before adding or replacing one; the agency can object, and if we can’t resolve the objection it may end the agreement.
| Who | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, databases, file storage, email delivery, security (rate limits, bot checks), logs | Workspaces, files and the directory in the EU jurisdiction; network worldwide |
| Anthropic, PBC | AI features, only when someone uses one (writing a pitch, reading a CV) | United States, under the EU Standard Contractual Clauses [EU option being arranged] |
| Stripe Payments Europe, Ltd. | Payments, once paid plans start (billing contact only, no candidate data) | EU |
| Google LLC / Microsoft Corporation | Sign-in, only for teams that choose to sign in with Google or Microsoft | Their own regions; they receive the sign-in request, no workspace data |
7.Transfers outside the EU
Data leaves the EU only where the table above says so, and then under the EU Standard Contractual Clauses (or the EU–US Data Privacy Framework where the recipient is certified), with the additional measures they require.
8.Helping the agency
- People’s requests: the app lets the agency find, correct, export and delete a person’s data. Where that isn’t enough, we help on request.
- Breaches: we tell the agency without undue delay, and within 48 hours of becoming aware of a personal data breach affecting its data, with what we know and what we are doing.
- Impact assessments and authorities: we give the information the agency reasonably needs.
- Audits: we provide the information needed to show we meet this agreement, and allow audits by the agency or an auditor it appoints, with reasonable notice and under confidentiality.
9.At the end
When the agency closes its workspace, it can first export its data; on request we provide a full export. We then delete the workspace’s data within 30 days, and from backups when they expire [confirm backup period], unless the law requires us to keep it.