This Data Processing Addendum (DPA) supplements the Terms of Service when a business customer uses CDL Smart App to process personal information on behalf of that customer. It is intended to describe the parties' privacy and security responsibilities and to support applicable U.S. privacy-law requirements.
Roles
For personal information that a customer uploads, collects, or directs CDL Smart App to process for the customer's recruiting, hiring, staffing, or employment workflows, the customer determines the business purpose and means of that processing. CDL Smart App acts as a service provider or processor to the extent those terms apply under applicable privacy law. CDL Smart App may separately act as a business or controller for account, security, billing, support, fraud-prevention, and service-administration information that it determines how to process for its own legitimate operational purposes.
Customer instructions
CDL Smart App will process customer-controlled personal information only to provide, secure, support, maintain, and improve the contracted service; carry out documented customer instructions; comply with law; or protect the rights, safety, and security of users and the service. A customer may not instruct CDL Smart App to process personal information unlawfully.
Sale, sharing, and targeted advertising
CDL Smart App does not sell customer-controlled applicant information for money and does not use customer-controlled applicant information for cross-context behavioral advertising or targeted advertising. To the extent applicable law treats CDL Smart App as a service provider or processor, CDL Smart App will not retain, use, or disclose customer-controlled personal information outside the business purposes and permitted processing described in the agreement except as allowed by law.
Confidentiality and access
CDL Smart App uses role-based access and technical controls designed to limit personal-information access to people and systems that need it for authorized purposes. Personnel and service providers with access to personal information are expected to protect it and use it only for authorized work.
Security
CDL Smart App maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, or destruction. Safeguards may include authenticated access, row-level database controls, encryption or separate protection for certain sensitive identity fields, server-side secret management, logging, restricted administrative access, incident-response procedures, and access restrictions. No security program can guarantee that every incident will be prevented.
Subprocessors and service providers
CDL Smart App may use third-party service providers for infrastructure, databases, authentication, payment processing, email, text messaging, document processing, security, and AI-assisted features. CDL Smart App remains responsible for selecting and managing providers consistent with its contractual obligations and will require appropriate privacy and security protections where applicable.
Individual rights requests
When CDL Smart App receives a verified privacy request concerning customer-controlled data, it may direct the requester to the applicable customer or assist the customer as reasonably necessary to respond. Customers remain responsible for determining whether a request must be honored and for meeting their own legal response deadlines.
Security incidents
CDL Smart App maintains a written incident-response process designed to identify, contain, investigate, document, remediate, and recover from suspected or confirmed security incidents. Material incident actions and decisions may be recorded in a restricted incident register and administrative audit records.
If CDL Smart App discovers or confirms unauthorized acquisition of, access to, or disclosure of customer-controlled personal information, CDL Smart App will notify affected customers within the time required by applicable law and otherwise without unreasonable delay after obtaining information sufficient to identify the affected customer and reasonably describe the incident. Notice may be delayed where permitted or required by law enforcement or other applicable law.
CDL Smart App will provide information reasonably available to support the customer's investigation and legally required notices, which may include the nature of the incident, known or reasonably believed data categories involved, known scope, mitigation measures, and relevant updates as the investigation develops. Customers remain responsible for notices they are legally required to provide unless the parties agree otherwise or applicable law assigns that obligation differently.
Nothing in this DPA requires CDL Smart App to disclose information that would compromise another customer's security, violate law, waive applicable legal privilege, or materially interfere with an active law-enforcement or forensic investigation.
Deletion and return
Upon termination of a customer account or a valid deletion request, CDL Smart App will delete or de-identify customer-controlled personal information within a reasonable period, subject to backups, security logs, fraud-prevention needs, legal holds, billing records, applicable retention duties, and information independently retained by another authorized organization.
Audits and information
CDL Smart App may provide reasonable information about its privacy and security practices to help a customer assess compliance. Any formal audit, penetration test, or access to confidential security material requires advance written agreement and reasonable safeguards to protect other customers and the service.
Order of precedence
If this DPA conflicts with the Terms of Service on the processing of customer-controlled personal information, this DPA controls for that subject. Other portions of the Terms remain in effect.
Contact
Privacy, security, or data-processing questions may be sent to support@cdlsmartapp.com.