Data Processing Agreement

Evalynq processes personal data on the Customer's behalf for the duration of the Customer's use of the Service, for the purpose of providing the recruitment-assessment functionality the Customer configures — inviting candidates, running timed assessments, optional identity/proctoring verification, scoring, human review, and results reporting. Processing ends when the Customer's account is closed and the corresponding data is deleted in accordance with Section 7 below.

• Data subjects: candidates invited by the Customer, and the Customer's own staff.
• Personal data: name, email, and application reference; a government ID/passport image; assessment answers and uploaded files; CV/résumé content, where the Customer uses screening; webcam snapshots, room-scan images, screen captures, and browser/device event logs, where the Customer enables monitoring and the candidate consents; and staff account and role data.

Evalynq will process personal data only on the Customer's documented instructions — which the Customer gives primarily through its own configuration of the Service (the assessments, monitoring settings, and features it turns on) — unless required to do otherwise by law, in which case we will inform the Customer before processing, unless that law prohibits it.

Evalynq ensures that any person authorized to process personal data (including our own staff) is bound by an obligation of confidentiality, whether contractual or statutory.

• Private object storage (identity documents, proctoring evidence, answer files, question attachments, CV submissions) is never public; access is exclusively through short-lived signed URLs generated on demand for an authorized, authenticated staff member of the Customer, and every access is audit-logged.
• Every Customer's data is isolated from every other Customer's at the database query level, enforced server-side, not only in the interface.
• Passwords are stored as salted hashes, never in plain text. Invitation and password-reset links use single-use, hashed tokens.
• Candidate answers, correct-answer data, authentication tokens, and secrets are never written to application logs.
• Configurable, automatically scheduled retention deletion exists for proctoring evidence, ID documents, candidate answer files, CV submissions, and question attachments.
• A dedicated, audit-logged, fail-closed data-deletion capability exists for a full erasure request, at both the individual-candidate and whole-organization level.

The Customer authorizes Evalynq's general use of the following sub-processors. We will provide reasonable advance notice before adding a new sub-processor that will process the Customer's personal data, giving the Customer an opportunity to object.

• Brevo — outbound transactional email (magic links, invitations, reminders).
• Backblaze B2 — private, S3-compatible object storage for candidate ID documents, proctoring evidence, uploaded answer files, question attachments, and CV submissions.
• Google (Gemini API) — optional, per-Customer AI-assisted grading and CV screening, used only where the Customer has explicitly enabled that feature; not contacted at all otherwise.
• Render — application hosting, primary database, and scheduled job execution.
• Sentry — optional error tracking; request bodies, cookies, authorization headers, and candidate content are never sent to it, by design; unused entirely unless separately configured.

• On the Customer's request, or on termination of the Customer's account, Evalynq will delete the Customer's personal data (including candidate data), except to the extent retention is required by applicable law.
• A Customer can request deletion of a specific candidate's data at any time during the account's life, independent of full account closure.
• Deletion is applied at the storage layer, not only hidden from the interface, and storage objects are removed before the corresponding database records, so a failure leaves data safely retryable rather than silently orphaned.

Where a data subject (e.g. a candidate) submits a rights request directly to Evalynq rather than to the Customer, we will inform the Customer promptly and provide reasonable assistance to help the Customer respond, taking into account the nature of the processing.

Evalynq will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide the information reasonably necessary for the Customer to meet its own notification obligations to a supervisory authority or affected individuals.

On reasonable request, and no more than once per year absent a specific security concern, Evalynq will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to an audit conducted by the Customer or an auditor mandated by the Customer, subject to reasonable confidentiality and scheduling terms.

Where a sub-processor listed in Section 6 processes personal data outside the Customer's or a data subject's jurisdiction, Evalynq will rely on an appropriate transfer mechanism recognized under applicable data protection law (such as Standard Contractual Clauses, where required). Contact support@evalynq.com for the specific mechanism applicable to a given transfer.

This DPA should be read together with our Privacy Policy (our overall data-handling posture), Candidate Privacy Notice and Proctoring Consent Policy (what a candidate is told and consents to), and our Terms of Service (the overall agreement this DPA forms part of). Where this DPA and the Terms conflict on a data-processing matter, this DPA controls.