InstaTalent
Join the waitlist

{Legal}

Data Processing Agreement

Last updated October 18, 2026

This is a summary of the Data Processing Agreement (DPA) between InstaTalent and each employer that uses it. It forms part of our Terms and applies automatically. If you need a countersigned copy for your records, request one below.

Request a signed DPA

1. Roles

The employer is the controller of candidate personal data used in its hiring. BrightSpheres LLC ("InstaTalent") is the processor and processes that data only to provide the service. InstaTalent is a separate controller for employer account data, billing, and interviews a candidate has explicitly agreed to share with other employers.

2. Details of the processing

  • Subject matter and purpose: hosting job postings and applications; conducting, recording, transcribing and AI-assessing interviews; producing reports; and messaging, all to support the employer's recruitment
  • Duration: for the term of the employer's account, plus the deletion period below
  • Data subjects: job applicants and candidates invited to interviews; the employer's team members
  • Personal data: identity and contact details, CVs and application answers, interview audio, camera video and screen share, transcripts, AI scores and evidence, notes, stage changes and decisions with reasons, consent records
  • Special categories: not intended. The service is designed not to infer them; any that a candidate volunteers are processed only as part of the transcript

3. InstaTalent's obligations

  • Instructions: process personal data only on the employer's documented instructions (these terms and its use of the product), and tell the employer if an instruction seems to break data protection law
  • Confidentiality: staff with access are bound by confidentiality
  • Security (Art. 32): appropriate technical and organisational measures, including encryption in transit, per-employer access control, time-limited access to recordings, audit logs, automatic recording deletion, backups, and least-privilege access to production systems
  • Sub-processors: the employer gives general authorisation to the sub-processors described on our Sub-processors page (a named list is available on request). We give at least 30 days' notice of new ones; the employer may object on reasonable data protection grounds and, if we cannot resolve it, terminate the affected service. We bind each sub-processor to equivalent obligations and remain responsible for them
  • Data subject requests: forward requests we receive to the employer and help it respond, including access and deletion of interview data
  • Assistance: provide information the employer reasonably needs for its security obligations, data protection impact assessments, prior consultations and AI-related transparency duties
  • Personal data breaches: notify the employer without undue delay, and within 48 hours of becoming aware of a breach affecting its data, with the information it needs to meet its own notification duties
  • Deletion: recordings are deleted after the employer's retention period (180 days by default). When the account ends, we delete or return the employer's personal data within 30 days, and it leaves backups within a further 30 days, unless the law requires us to keep it
  • Audits: make available the information needed to demonstrate compliance and allow reasonable audits, normally by written questionnaire, with on-site audits on reasonable notice
  • No other use: we do not sell the data, use it for advertising, or use it to train AI models

4. International transfers

Where personal data is transferred outside the EU/EEA or UK to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2 controller-to-processor, and Module 3 processor-to-processor for our sub-processors) and the UK Addendum apply, and are incorporated by reference.

5. The employer's obligations

  • Have a lawful basis for the processing and give candidates the notices required where they live
  • Meet any obligations specific to AI in hiring that apply to it, such as notice, consent, audit, human-oversight and record-keeping requirements
  • Keep a human in charge of every hiring decision and not rely solely on AI scores
  • Respond to candidates' requests for a human interview, an accommodation, or deletion
  • Set a recording retention period suitable for its jurisdiction and delete data it no longer needs

6. Liability and precedence

The liability limits in the Terms apply to this DPA. If the DPA and the Terms conflict on data protection, the DPA wins; if the Standard Contractual Clauses conflict with either, the Clauses win.

7. Contact

To request a countersigned DPA or ask about it, email privacy@instatalent.dev.