This Data Processing Addendum ("DPA") forms part of the Terms of Service between SMNSCU Ltd (trading as Coderbase) ("Provider") and the Customer, into which it is incorporated by reference. It applies on every plan. It governs the Provider's processing of personal data on the Customer's behalf in connection with the Service.
1. Roles
As between the parties, the Customer is the controller of candidate and recruiting personal data submitted to the Service, and the Provider is the processor. The Provider is an independent controller of its own account, billing, and usage data as described in the Privacy Policy.
2. Scope of processing
The Provider processes personal data only to deliver the Service: operating interviews and the collaborative workspace, producing recordings and transcripts where enabled, generating rubrics and reports (including AI-assisted drafting), sending operational communications, and providing support. Categories of data subjects: the Customer's users and its candidates. Categories of data: names, email addresses, interview audio/video and transcripts, candidate code and work product, interviewer notes, and scoring data.
The Provider processes personal data on the Customer's documented instructions, which this DPA and the Customer's configuration of the Service constitute, unless required otherwise by law (in which case the Provider informs the Customer unless legally prohibited).
3. Confidentiality and security
The Provider ensures persons authorized to process the data are bound by confidentiality, and maintains appropriate technical and organizational measures for a service of this nature, including encryption in transit, tenant isolation enforced at the query layer, role-based access control, audit logging of state-changing and PII-reading operations, and EU-located primary infrastructure.
4. Subprocessors
The Customer generally authorizes the following subprocessors, each engaged under terms no less protective than this DPA:
- Hetzner Online GmbH (Germany) – hosting and compute; all primary data storage.
- Cloudflare, Inc. – object storage (recordings, documents), CDN, and DNS.
- Resend, Inc. – transactional email delivery.
- 100ms, Inc. – interview video calls and call recording.
- Mistral AI (France) – AI-assisted rubric and report drafting over interview transcripts. Chosen specifically for EU data residency.
Deliberate routing safeguard: candidate personal data sent to an AI model is routed only to EU-resident Mistral. Non-personal-data AI workloads (for example, benchmarking new interview questions against synthetic profiles) may use other model providers, but candidate data never reaches them.
The Provider will give the Customer notice of any intended addition or replacement of a subprocessor (via the published list at this URL and platform or email notice), giving the Customer the opportunity to object on reasonable data-protection grounds.
5. Data subject rights and assistance
Taking into account the nature of the processing, the Provider assists the Customer with reasonable technical and organizational measures to fulfill data-subject requests (access, rectification, erasure, restriction, portability, objection) and with the Customer's obligations regarding security, breach notification, and data protection impact assessments.
6. Personal data breach
The Provider notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information reasonably required for the Customer to meet its own notification obligations.
7. International transfers
Primary processing and storage occur in the European Union. Where a subprocessor processes personal data outside the UK/EEA, the transfer is protected by an appropriate safeguard (adequacy regulations or standard contractual clauses, with the UK Addendum where applicable).
8. Return and deletion
When the Customer's use of the Service ends, the Provider deletes or returns personal data processed on the Customer's behalf in accordance with the Terms of Service, the Privacy Policy, and any separate written retention commitments, save for copies required to be retained by law.
9. Audits
The Provider makes available information reasonably necessary to demonstrate compliance with this DPA and allows for audits, no more than annually and on reasonable notice, conducted in a manner that does not compromise the security or confidentiality of other customers.
10. Changes
The Provider may update this DPA from time to time; material changes are notified to the Customer. The version in force is the one published at this URL. Questions may be sent to [email protected].