Data Processing Addendum

1. Roles

ProvenRemote is a processor of personal data that candidates and employers provide to the platform. The employer is the controller of data it inputs about its company and its hiring needs. The candidate is the controller of data in their own profile, and ProvenRemote processes that data on the candidate's behalf to provide certification and matching services. Where ProvenRemote determines the purposes and means of processing, it acts as controller for its own account operations, fraud prevention, and legal compliance.

2. Subject matter and duration

The subject matter is the processing of personal data necessary to operate the ProvenRemote platform: candidate certification, AI-assisted scoring, employer shortlisting, audio screening, billing, and customer support. Processing continues for the life of the user's account or an active job post, plus any retention period described in the Privacy Policy, unless a deletion request is received earlier.

3. Purpose of processing

We process personal data only for the purposes of: authenticating users; evaluating and certifying candidates; matching certified candidates to employer roles; enabling employers to send audio screening questions and review answers; processing payments; communicating with users; keeping the platform secure and lawful; and satisfying legal obligations.

4. Categories of personal data

Candidate data: name, email, city, English self-rating, hours available, time-zone availability, internet speed, equipment status, expected salary, written and audio answers, transcripts, AI scores, certification status, and training progress. Employer data: name, email, company name, job post content, screening questions, and billing details. Technical data: IP address, browser type, country detected from IP, and session cookies.

5. Categories of data subjects

Candidates applying to ProvenRemote; certified candidates matched to employer posts; employers and their authorized representatives who post roles or manage shortlists; and visitors to the website.

6. Processor obligations

We will:

• Process personal data only on documented instructions, including these Terms.
• Ensure personnel who access data are subject to confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Not engage subprocessors without notice and, where required, an opportunity to object.
• Assist customers in responding to data subject rights requests.
• Notify customers promptly if we become aware of a personal data breach affecting their data.
• Make available reasonable information about our security practices on request.
• Return or delete personal data when the service ends, except where retention is required by law.

7. Subprocessors

We use service providers for hosting, database, file storage, email delivery, authentication, payment processing, and AI transcription and scoring. The current, versioned list is published on our Subprocessors page, which records every change with a version number and effective date; named provider details are available on request from privacy@provenremote.com. We enter written agreements with subprocessors that require them to process data only for the purposes we specify and to maintain appropriate security measures. We publish a new version of that page at least 30 days before adding or replacing a subprocessor, and active employers may object in writing.

8. Security measures

We apply access control through authenticated accounts and role-based permissions; encrypted data transmission; encrypted storage; regular backups; logging and monitoring; and private storage for audio recordings. Full details are on our Security page.

9. Data subject rights

Candidates and employers may access, correct, or delete their personal data through their account settings or by contacting privacy@provenremote.com. We will respond to requests within 30 days and will assist employers in responding to requests from their own employees or representatives.

10. Return and deletion

At the end of the processing relationship, we will delete or return personal data as requested, except where we are required to retain it for legal, tax, or regulatory purposes. Audio recordings, transcripts, and scores are deleted from active storage when the candidate account is deleted, subject to any legal hold.

11. Changes to this DPA

We may update this DPA to reflect new services, subprocessors, or legal requirements. Material changes will be posted at least 30 days before they take effect, and we will email active employers. Continued use of the Services after the effective date constitutes acceptance.

12. Contact

For questions about this DPA or to request a signed copy, email privacy@provenremote.com.