This DPA forms part of the agreement between the Customer (Controller) and Welle Digital Kft. (Processor) when Customer uses Candalign to process personal data relating to job candidates.
1. Subject matter & duration
Processor will process candidate personal data only to provide integrity screening and related features described in the Terms of Service.
2. Nature & purpose of processing
- Storage and parsing of CVs and interview transcripts
- AI-assisted analysis to generate integrity scores and flags
- Display of results to authorised Customer users
3. Sub-processors
Customer authorises the following sub-processors subject to GDPR Article 28 requirements. We will provide at least 30 days' notice before adding or replacing a sub-processor that processes candidate personal data.
Sub-processor register
| Sub-processor | Purpose | Location | Candidate data |
|---|---|---|---|
| Hetzner Online GmbH | Compute, storage, database | Germany / Finland (EU) | Yes |
| Mistral AI | OCR and AI inference | France (EU) | Yes (ephemeral) |
| Stripe, Inc. | Payment processing and billing | United States (metadata only) | No |
| Resend | Transactional email delivery | United States (user emails only) | No |
| PostHog (EU cloud) | Product analytics (consent-gated) | European Union | No candidate identifiers |
| Sentry (optional) | Frontend error monitoring | United States (if enabled) | Scrubbed; no candidate content |
We will notify Customer at least 30 days before any intended change to sub-processors that process candidate personal data, allowing Customer to object in accordance with the DPA.
4. EU AI Act allocation
Under EU AI Act Article 12, Processor maintains record-keeping infrastructure enabling Deployers to comply with their log retention obligations. Audit metadata is retained for at least six months.
Under Article 26, Deployer (Customer) is responsible for human oversight, candidate notification, monitoring, and retention of logs in their systems. Processor provides audit exports, review attestation features, and platform retention to support these obligations.