Data Processing Agreement
Last updated: 23 June 2026
1. Scope
This Data Processing Agreement ("DPA") forms part of the agreement between Vettara Search ("Processor", "Vettara") and the customer ("Controller") for Vettara's AI-assisted executive search services. It applies when Vettara processes Personal Data on behalf of the customer under applicable data protection laws, including GDPR and UK GDPR where applicable.
2. Definitions
"Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Subprocessor", "Personal Data Breach", and "Supervisory Authority" have the meanings given in applicable data protection law. "Customer Data" means Personal Data submitted to, generated in, or processed through the Service on behalf of the customer.
3. Processing Details
| Subject matter | AI-assisted executive search, candidate sourcing, enrichment, scoring, workflow management, exports, and reporting. |
| Duration | The subscription term plus deletion, backup, audit, and legal retention periods. |
| Nature and purpose | Parsing customer briefs, retrieving public or customer-provided professional information, generating search results, maintaining candidate workflow state, and providing support. |
| Personal Data types | Names, work emails where provided or discovered, public profile URLs, job titles, employer names, work history, location signals, professional summaries, notes, scores, user account data, audit logs, and uploaded document content. |
| Data subjects | Customer users, customer contacts, prospective candidates, executives, senior professionals, and individuals included in uploaded customer materials. |
4. Customer Instructions
Vettara will process Customer Data only on documented customer instructions, including the agreement, product configuration, search briefs, user actions, support requests, and lawful written instructions. The customer is responsible for ensuring those instructions are lawful and that it has an appropriate legal basis for the candidate searches, outreach, exports, and downstream hiring workflows it performs.
5. Vettara Obligations
- Process Customer Data only under documented instructions unless law requires otherwise.
- Ensure personnel authorised to process Customer Data are subject to confidentiality duties.
- Implement appropriate technical and organisational security measures.
- Use subprocessors only as described in this DPA and the Subprocessors page.
- Assist with reasonable data subject, security, breach, DPIA, and consultation obligations.
- Delete or return Customer Data at the end of the service, subject to legal and backup retention.
- Make reasonable information available to demonstrate compliance with this DPA.
6. Security Measures
Vettara uses measures described on the Security page, including encryption in transit, access controls, role-based permissions, tenant separation, audit logging, monitoring, secret management, backups, and limited production access. Security measures may evolve provided they do not materially reduce overall protection.
7. Subprocessors
The customer gives general authorisation for Vettara to engage subprocessors listed on the Subprocessors page. Vettara remains responsible for subprocessors' performance of data protection obligations and will require them to protect Customer Data under written terms.
Vettara will provide notice of material new subprocessors where practical. Customers may object on reasonable data protection grounds. If the objection cannot be resolved, either party may terminate the affected service as its sole remedy.
8. International Transfers
Where Customer Data is transferred outside the EEA, UK, or other protected region, Vettara will use appropriate transfer safeguards where required, such as Standard Contractual Clauses, UK transfer addenda, adequacy decisions, or equivalent lawful mechanisms.
9. Personal Data Breach
Vettara will notify the customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data. The notice will include available information reasonably required for the customer to assess notification obligations. Vettara's notification is not an admission of fault or liability.
10. Data Subject Requests
If Vettara receives a data subject request relating to Customer Data, it may direct the requester to the customer unless legally required to respond. Vettara will provide reasonable assistance for customer-handled requests, taking into account the nature of the processing and information available to Vettara.
11. Audits
Vettara will make reasonable compliance information available on request. Any audit must be limited to once per year unless required by a regulator or confirmed breach, conducted on reasonable notice, during business hours, under confidentiality, and without exposing other customers' data or compromising platform security.
12. Return and Deletion
On termination, Vettara will provide a reasonable opportunity to export available Customer Data unless access was suspended for security, legal, or serious misuse reasons. On verified instruction, Vettara will delete or anonymise eligible Customer Data, except for backups that expire through normal rotation, legal holds, audit records, security logs, billing records, or data retained as required by law.
13. Liability
Liability under this DPA is subject to the exclusions and limits in the Terms of Service or applicable order form, unless applicable law prohibits that limitation.
14. Contact
For DPA-related enquiries, contact support@vettarasearch.com.