Data Processing Agreement (DPA)
Standard Enterprise Addendum · Version 2026.1
1. Scope & Purpose
This Data Processing Agreement ("DPA") governs the processing of personal data by AssessInsights on behalf of the customer ("Data Controller") in connection with 360° talent assessment services under the GDPR and CCPA.
2. Categories of Data & Data Subjects
Data processed under this agreement includes candidate names, work email addresses, job titles, evaluator rating scores, and qualitative diagnostic feedback. Data subjects include employees, managers, peers, and candidate evaluators.
3. Technical & Organizational Measures (TOMs)
AssessInsights maintains strict technical controls including AES-256 data encryption at rest, TLS 1.3 transit encryption, automated vulnerability scanning, and multi-tenant logical isolation.
4. Sub-processors & Cloud Infrastructure
AssessInsights engages trusted third-party sub-processors for cloud hosting (Google Cloud Platform / Firebase) and transactional email dispatch. All sub-processors undergo rigorous third-party security audits and execute binding Standard Contractual Clauses (SCCs).
5. Sub-Processor Change Notifications & Audit Rights
AssessInsights shall provide enterprise Data Controllers with at least thirty (30) days prior notice before onboarding new sub-processors. Data Controllers maintain the right to conduct annual security compliance evaluations and request security documentation related to our SOC 2-aligned architecture via our Security & Compliance Portal.
6. Data Subject Rights & Incident Management
In the event of a verified security incident affecting customer data, AssessInsights will notify affected Data Controllers without undue delay and within seventy-two (72) hours of confirmation. We provide administrative tools to process Data Subject Requests (access, rectification, erasure, data export) directly inside the workspace portal.
7. Data Retention & Post-Termination Purge
Upon contract termination or account closure, AssessInsights provides a thirty (30) day grace period for Data Controllers to export raw evaluation archives and vector reports. Following the grace period, all associated candidate records are permanently purged using secure cryptographic wiping standards.