Data Processing Agreement
Staffholm and Rolefit are brands of Sirin OÜ, a company registered in Estonia (registry code 16315993). Staffholm is the service employers use, and Rolefit is the name candidates see when they apply. Wherever this document says “Staffholm”, “Rolefit”, “we” or “us”, it means Sirin OÜ.
This agreement is part of the Terms of Service. It applies to every account from the moment the account is created, so there is nothing to sign. If your legal team wants a signed copy, write to info@staffholm.com. On anything to do with personal data it takes precedence over the Terms of Service.
1. Roles
You, the customer, are the controller of candidate personal data in your workspace. You decide why it is collected and what happens to the people it describes.
Sirin OÜ is the processor. We process that data only on your documented instructions.
Your instructions are the Terms of Service, this agreement, including the transfers in §6, the configuration you set in the product and anything you tell us in writing. If the law requires us to process data in another way, we tell you first unless that law forbids it. We will tell you if we think an instruction breaches data protection law, and we will not carry it out until the point is resolved.
If you recruit for clients. Where a recruitment agency acts for a client, the client may be the controller and the agency its processor. We are then the agency's sub-processor, these terms apply between us and the agency, and the agency makes sure its client has agreed to that.
For your own users' account data (names, work email addresses, billing, usage) Staffholm is a controller in its own right. That is covered by the privacy policy, not by this agreement.
2. What is processed
| Subject matter | Reading, structuring and scoring job applications |
| Duration | While your account is open, plus the retention periods in Annex 1 |
| Nature and purpose | Extract structured facts from a CV, ask the candidate about gaps, score against your adverts, present a ranked queue and explanations |
| Types of data | CV contents (name, contact details, employment and education history, skills, anything else the candidate chose to include), whether the candidate uploaded it or you forwarded it or added it by hand, answers to our questions, contact details given at submission, an optional covering note, optional attachments, the link or site the application came from, decision and interview records, your notes |
| Categories of data subject | Candidates for your vacancies, and people a CV names, such as referees |
| Special categories | Not intentionally processed. We do not ask for them. A CV may contain them because the candidate chose to include them. See §3 |
3. Special category data
We do not ask for health data, trade union membership, religion, ethnicity, sexual orientation or anything else in Article 9. Our questions are generated from the requirements in your advert.
A candidate may nonetheless put such information in their CV. Where that happens it is incidental and not sought. The model reads the whole CV, and it is instructed to ignore anything that is not in the advert. The candidate notice asks candidates not to include health information.
4. Our obligations
We will:
- process only on your documented instructions
- ensure everyone who processes the data is bound by confidentiality
- apply the measures in Annex 2
- respect the conditions in §5 before engaging any sub-processor
- help you respond to data subject requests, using the tools in the product and our own assistance where the tools are not enough
- help you with Articles 32 to 36 (security, breach notification, impact assessments and prior consultation), taking into account what we know and you do not
- delete or return the data at your choice when processing ends, unless law requires us to keep it
- make available what you need to demonstrate compliance, and allow audits under §7
If you ask us to set up your account, you invite our person into your workspace as a member. They see what that role can see, act only on your instructions and are bound by confidentiality.
Anonymous totals. You instruct us to make anonymous totals from the data we process for you, and we may keep and use them for our own purposes after the data they came from is deleted. Today that is one line per pay answer a candidate chooses to give, namely the month, the kind of job, the advert's pay range and the answer, with no company, candidate, application or exact time. We make them as the data arrives, never re-identify them and never publish a total for fewer than ten answers. Once anonymous they are not personal data and fall outside this agreement.
5. Sub-processors
You give general written authorisation for us to engage sub-processors. The current list, what each does and where it processes, is on the sub-processors page.
Before adding or replacing one we will give you 30 days' notice by email to the account owner. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection you may terminate the affected service and receive a refund of any unused prepaid fees.
Every sub-processor is bound by written terms no less protective than these. We remain fully liable to you for their performance, within the limit in §12.
Services you connect yourself, such as the inbox you forward from or the calendar you link to your interviews, are yours and are not our sub-processors.
6. International transfers
Data is stored in the EU. The CV text and answers are sent to Anthropic in the US to be read, and some other sub-processors are US-headquartered and may process or access data outside the EEA. Where they do, transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. The sub-processors page records which mechanism applies to each.
If you are outside the EEA, the EU Standard Contractual Clauses (processor to controller, Module Four) apply between us for what we send back to you, and are part of this agreement.
7. Audits
You may audit our compliance with this agreement, once in any twelve months, on 30 days' notice, at your cost, without disrupting the service. We will answer a reasonable written security questionnaire instead where that satisfies you, which for most customers it will. A demand from a supervisory authority is not limited by this.
8. Breaches
We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with what we know at the time, and will keep you updated.
Notifying the supervisory authority and the affected people is your obligation as controller. We will give you what you need to do it.
9. Data subject requests
Candidates can exercise their rights without an account. Where a request reaches us rather than you, we will pass it to you promptly and not respond on our own initiative, except to acknowledge it. Where you ask us to act, we will.
Export is in the product. To erase a candidate, write to info@staffholm.com. The application leaves every list at once and is deleted within 30 days, along with its files.
10. Ending
When your account is closed we will delete or return the data, at your choice. Absent instruction within 30 days, we delete, and we confirm it in writing if you ask. Backups age out on their own cycle and are not restored to serve a deleted record. Cancelling a paid plan does not close the account. See §5 of the Terms of Service.
11. Automated decision-making
The service produces a ranking and an explanation. It makes no decision that produces legal or similarly significant effects. A human at your organisation decides.
You must keep it that way. A person has to read the application and be free to disagree with the score. The Court of Justice of the EU has held that a score can itself count as an automated decision when whoever receives it relies on it heavily (C-634/21, SCHUFA). Using the output as an automatic filter would create obligations under GDPR Article 22 and, for hiring, under the EU AI Act, which lists employment as high risk, and those fall on you as controller. See the AI transparency notice.
11a. What you warrant to us
We process candidate data on the strength of these, and they are warranties rather than description.
- You have a lawful basis for every candidate whose data reaches your workspace, and you have given them the information Articles 13 and 14 require. Our candidate privacy notice is written to help you and is not a substitute for you doing it. A candidate whose CV you forward or add by hand has not seen it. Annex 3 gives you a sentence to use.
- Your instructions are lawful, including the requirements you write into an advert and the weights you set.
- You will keep a human deciding, as §11 requires.
- You will not send us special category data you have not told us about, and you will not ask a question designed to elicit it. See §3.
- If your use of the service needs a data protection impact assessment, it is yours to do as controller, and we give you ours to work from.
If somebody brings a claim against us because one of these was not true, you will cover our reasonable costs of defending it, on the terms in §9a of the Terms of Service.
11b. Cost of helping you
The help described in §4, §7 and §9 is included in what you pay. Where a request goes materially beyond that, such as a bespoke audit, an unusual volume of data subject requests or assistance with an impact assessment that amounts to consultancy, we will tell you before we start and agree a reasonable fee. We will never withhold help that the Regulation requires of us, whether or not a fee is agreed.
12. Order of precedence and liability
On personal data, this agreement wins over the Terms of Service. On everything else, the Terms of Service win.
The limitation of liability in §9 of the Terms of Service applies to this agreement and to any claim between us arising out of it, as though set out here in full. This agreement does not create a second, uncapped liability between us. It does not limit what a candidate can claim directly under data protection law. Where this agreement is signed on its own, as a buyer's legal team will sometimes ask, that limitation is incorporated by this sentence and applies just the same.
Annex 1. How long data is kept
| Record | Kept |
|---|---|
| Application started, never submitted | 1 day |
| Application submitted | 240 days from submission |
| Submitted, role then filled | Shortened to 180 days from the fill date |
| Candidate opted in to future roles | 365 days, and the candidate can withdraw at any time |
| Erasure requested | Purged within 30 days |
| Uploaded files | Same clock as their application |
| Sent or cancelled emails in the outbox | 90 days |
| Record of a filled job for your Insights: title, date, and the hired person's rank, score and channel, with no name | While your account is open |
| Inputs and outputs at Anthropic | Deleted within 30 days, longer only if flagged for breaking its usage rules (up to 2 years) or if the law requires it |
These periods run in the code and filling a role can only shorten them. If you need a record for longer, for example for a dispute, export it before the clock runs out. A discrimination claim can in some cases be brought up to a year after the person learned of the harm, so keep what you may need under your own rules.
Annex 2. Security measures
- Data at rest in the EU with Supabase, encrypted by the provider. TLS for everything in transit.
- Each workspace's rows are separated by row-level security in the database.
- Roles limit what each person sees. A hiring manager sees only their own roles' applicants.
- Two-step sign-in is available to every account.
- Uploaded files are never public and are served through short-lived signed links.
- Secrets are held as encrypted secrets at Cloudflare and never in source control.
- Card details never reach us. Stripe handles them on its own pages.
- Deletion runs on a schedule and reaches stored files as well as database rows.
Annex 3. What to tell the people who apply
Use this in your advert, your automatic reply or your own privacy notice. It does not replace your own privacy notice.
In English. We use Staffholm, a tool from Sirin OÜ, to help read applications. An AI model reads your CV and scores it against this advert, and a person at our company makes every decision. You can ask us for a human review. More at https://www.staffholm.com/candidates
In Estonian. Kandideerimisdokumentide lugemisel kasutame Staffholmi, Sirin OÜ tööriista. Tehisintellekti mudel loeb CV läbi ja võrdleb seda selle kuulutuse nõuetega ning iga otsuse teeb meie ettevõttes inimene. Võite paluda inimese ülevaatust. Lisainfo https://www.staffholm.com/et/candidates
Last updated: 1 November 2026