Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions or the signed agreement (the "Agreement") between HackGeniX Tech Private Limited ("HackGeniX", the Data Processor) and the company that licenses Oximus Pro (the "Company", the Data Fiduciary). It applies whenever HackGeniX processes personal data on the Company's behalf. Terms used here have the meanings given in the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Details of the processing

• Subject matter and purpose — providing Oximus Pro: online assessments, live interviews, interview monitoring, reports and support.
• Duration — the term of the Agreement, plus the deletion period in section 10.
• Data principals — Candidates invited by the Company, the Company's authorised users, and contacts at the Company's Clients.
• Personal data — as listed in section 4 of our Privacy Policy: identity and contact details, identity photographs and documents, webcam and phone-camera pictures, screen pictures around signals, device information, signals and timings, answers, scores, notes and scorecards. No video or audio recordings.
• Processing — collection, storage, organisation, display to authorised users, transmission, generation of signals and reports, backup and deletion.

3. The Company's responsibilities

The Company decides the purposes and means of processing and is responsible for: giving Candidates a lawful notice and obtaining consent or relying on another lawful ground; the lawfulness of its instructions; configuring monitoring, retention and access appropriately; responding to data principals' requests and grievances about Candidate data; and its own disclosures to Clients.

4. HackGeniX's obligations

HackGeniX will:

• process personal data only on the Company's documented instructions — which include the Agreement, this DPA and the Company's configuration of Oximus Pro — unless the law requires otherwise, in which case it will tell the Company first where lawful;
• tell the Company if, in its opinion, an instruction breaches the law;
• ensure that personnel with access are bound by confidentiality and access only what their role needs;
• implement the security measures in section 6;
• not sell personal data, use it for advertising, or use Candidates' answers or images to train AI models;
• assist the Company, taking into account the nature of the processing, in responding to data principals' requests, handling grievances and meeting its obligations on security and breach notification.

5. Sub-processors

The Company authorises HackGeniX to engage sub-processors in these categories: cloud hosting and file storage (India), email delivery, video relay (TURN) servers, code execution, payment processing for billing, and — only where the Company switches on AI-drafted follow-up questions — an AI model provider, which receives job and question text but no Candidate personal data. HackGeniX will impose data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance. A current list is available on request. HackGeniX will give at least fifteen days' notice of a new sub-processor of Candidate data; the Company may object on reasonable data-protection grounds, and if the parties cannot resolve the objection, the Company may terminate the affected service and receive a refund of prepaid fees for it.

6. Security measures

HackGeniX maintains reasonable security safeguards, including: encryption of data in transit; private storage of pictures, shown through short-lived signed links; logical separation of each company's data; role-based access control within each company; access to production limited to authorised HackGeniX personnel; logging of administrative actions; rotation of sign-in tokens; database backups; and processing of eye movement and answer timing on the Candidate's device so that no eye-tracking video or audio is transmitted.

7. Personal data breaches

HackGeniX will notify the Company without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Company personal data, with the information then available about its nature, likely consequences and the measures taken. It will provide updates as more is known and cooperate with the Company's notifications to the Data Protection Board of India and affected data principals. HackGeniX will report cyber incidents to CERT-In as the law requires.

8. Location and transfers

Production data and monitoring captures are stored in India. Personal data may be processed outside India only by sub-processors in the categories above, only to countries not restricted by the Government of India under the DPDP Act, and with appropriate safeguards.

9. Audits

On reasonable written request, no more than once a year and with at least thirty days' notice, HackGeniX will provide information reasonably necessary to demonstrate compliance with this DPA, in the first instance through written answers to a security questionnaire and relevant documentation. Any on-site audit must be at the Company's cost, during working hours, subject to confidentiality, and must not access other customers' data.

10. Return and deletion

During the term the Company can export its data from Oximus Pro. Monitoring captures are deleted automatically at the end of the retention period the Company sets. Within thirty days after the Agreement ends, HackGeniX will delete the Company's personal data, except where the law requires it to be kept, and will confirm deletion on request. Backups are overwritten in the ordinary course within a further sixty days.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement. If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails.

12. Contact

Data protection queries: privacy@oximuspro.com · Grievance Officer: Grievance Officer name, HackGeniX Tech Private Limited, 67/1, Thiyagi Nadesan Street No. 3, Ammapettai, Salem – 636003, Tamil Nadu, India.