MagicInterview
Create account
Legal

Data Processing Addendum

The data processing terms that apply when MagicInterview processes personal data on behalf of a customer, for example an organization that provides it to staff.

Last updated

This Data Processing Addendum ("DPA") applies when Agents AI Ltd. ("MagicInterview") processes personal data on behalf of a customer in providing the MagicInterview service, for example when an organization gives MagicInterview to its staff or members and is responsible for the personal data in their use of it (the "Customer"). It forms part of the Terms of Service.

If you use MagicInterview as an individual, MagicInterview is the controller of your account data, and the Privacy Policy applies, not this DPA.

To have this DPA signed or to get a copy for your records, email support@magicinterview.app.

1. Definitions#

"Data Protection Law" means the laws that apply to the processing of personal data under the agreement, including Regulation (EU) 2016/679 (GDPR) and the UK GDPR where they apply. "Personal Data", "controller", "processor", "processing", "data subject" and "personal data breach" have the meanings those laws give them. "Subprocessor" means a provider that MagicInterview engages to process Personal Data for the Customer.

2. Roles#

For Personal Data the Customer's users put into MagicInterview, the Customer is the controller and MagicInterview is the processor. MagicInterview is the controller of its own account, billing, security and product-analytics data, as described in the Privacy Policy.

3. Processing details#

  • Subject matter and purpose: providing MagicInterview to the Customer's users: storing their projects, conversations and sources, turning speech into text, writing suggested answers, practice and research, and keeping the service secure.
  • Duration: while the Customer's users hold accounts, and until deletion as set out below.
  • Types of Personal Data: account details (name, email), content users add (CVs, notes, files, transcripts, answers), numeric voice profiles where users provide a voice sample, subscription status, and usage and diagnostic data.
  • Categories of data subjects: the Customer's staff or members who use MagicInterview, and people whose words or details appear in their content.
  • Nature of processing: hosting, transmission to Subprocessors, transformation (speech to text, answer generation) and deletion.

4. Instructions#

MagicInterview processes Personal Data only on the Customer's documented instructions, which are the agreement, this DPA and the Customer's use of the service's features, unless the law requires otherwise. MagicInterview will tell the Customer if it believes an instruction infringes Data Protection Law.

5. Confidentiality#

MagicInterview ensures that people authorized to process Personal Data are bound by confidentiality.

6. Security#

MagicInterview implements appropriate technical and organizational measures to protect Personal Data, including those described on the Security page: encryption in transit, hashed passwords, isolated per-account workspaces, rate limiting, server-side secrets, EU hosting, and no storage of conversation audio. These measures may be updated if the level of protection is not reduced.

7. Subprocessors#

The Customer gives general authorization for MagicInterview to use the Subprocessors listed on the Subprocessors page. MagicInterview engages each Subprocessor under its data processing terms or a written agreement, chooses providers whose terms protect the data they receive, and remains responsible for their performance. The Apple App Store and Google Play act under their own terms. MagicInterview will update the list before it adds or replaces a Subprocessor and will notify Customers who have asked to be told. A Customer may object on reasonable data protection grounds within 30 days of notice, and the parties will discuss it in good faith. If the matter cannot be resolved, the Customer may stop using the affected feature or terminate the agreement for the affected service.

8. International transfers#

MagicInterview hosts Customer data in Germany. If it or a Subprocessor transfers Personal Data to a country without an adequacy decision, it will do so under appropriate safeguards, such as the European Commission's standard contractual clauses or the UK addendum, as applicable.

9. Assistance#

Taking into account the nature of processing, MagicInterview will assist the Customer, by appropriate technical and organizational measures, in responding to data subject requests, and with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation. Users can access, correct and delete much of their data in the app. If MagicInterview receives a request directly from a data subject about Customer data, it will refer the person to the Customer where it can identify the Customer.

10. Personal data breaches#

MagicInterview will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will give the information it has to help the Customer meet its obligations, and update it as the investigation progresses.

11. Return and deletion#

On the Customer's written request, or when the agreement ends, MagicInterview will delete the Customer's Personal Data, or give the Customer's users the means to export or delete it themselves, unless the law requires it to keep some data. Deleting an account removes its workspace, files, voice profile, subscription records and diagnostic events.

12. Audits#

MagicInterview will make available the information reasonably necessary to show compliance with this DPA, and will allow and contribute to audits by the Customer or its auditor, on reasonable notice, not more than once a year unless a regulator or a breach requires more, during business hours and under confidentiality, and without disrupting service for other customers.

13. Liability and order of precedence#

Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of Personal Data, this DPA prevails. If it conflicts with standard contractual clauses that apply, the clauses prevail. This DPA is governed by the law that governs the Terms of Service.

14. Contact#

Data protection questions: support@magicinterview.app. Operator details are in the Legal Notice.