Draft: this document is being reviewed by our lawyers and may change before launch.
Data processing agreement
How we process personal data on behalf of customers. Part of the terms of service.
Last updated 1 November 2026
1. Roles and scope
The Customer is the controller of personal data in the service. Hirestrella is the processor and acts only on the Customer's documented instructions, which are the terms, this agreement and the Customer's use of the product's settings.
2. Details of processing
Subjects: job candidates and the Customer's users. Data: identity and contact details, interview recordings and transcripts, integrity monitoring recordings (camera and shared screen) and events, assessment results, scores, notes, scheduling data and interviewers' calendar free/busy times, photo ID check images (when the Customer enables that stage), optional fairness survey answers. Purpose: providing hiring software. Duration: the term of the agreement plus the deletion period.
3. Our commitments
We will keep personal data confidential; make sure our staff are bound by confidentiality; apply the security measures on our security page; help the Customer respond to data subject requests (the product includes export and erasure tools); and help with impact assessments and regulator enquiries where reasonable.
4. Sub-processors
The Customer authorises the sub-processors listed on our sub-processors page. We will give at least 30 days' notice of a new sub-processor, during which the Customer may object. We impose equivalent data protection obligations on each sub-processor.
5. International transfers
Data is hosted in the region agreed with the Customer. Where a feature requires transfer outside that region, we rely on the safeguards required by the applicable law (for example under Saudi PDPL transfer regulations), and the Customer can switch off features that need it.
6. Personal data breaches
We will tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer data, with the information the Customer needs to meet its own notification duties.
7. Deletion and return
The Customer can export data at any time. When the agreement ends, we delete Customer data within 30 days of the end of the export period, including from backups on their normal cycle, unless the law requires us to keep it.
8. Audits
We will make available the information reasonably needed to show compliance, including answers to security questionnaires. Enterprise customers may agree further audit rights in their order form.