Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement (the "Services Agreement") between the customer identified in that agreement ("Customer") and Lantern AI Inc., a United States company with an address at 2261 Market Street, STE 85453, San Francisco, CA 94114 ("Lantern"). It applies when Lantern processes Personal Data for Customer through Lantern's AI Hiring Manager services.

By entering into a Services Agreement that incorporates this DPA, each party agrees to this DPA on behalf of itself and its applicable affiliates.

1. Definitions

"Applicable Data Protection Law" means privacy and data protection laws applicable to the Processing, including applicable U.S. state comprehensive privacy laws and, where relevant, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

"Controller," "Processor," "Business," "Service Provider," "Contractor," "Consumer," "Personal Data," "Personal Information," "Process," "Sell," and "Share" have the meanings given by Applicable Data Protection Law.

"Customer Personal Data" means Personal Data Lantern Processes on Customer's behalf through the Services. "Subprocessor" means a third party Lantern appoints to Process Customer Personal Data.

2. Roles and instructions

Customer is the Controller or Business for Customer Personal Data. Lantern is the Processor, Service Provider, or Contractor, as applicable. Customer instructs Lantern to Process Customer Personal Data to provide, secure, support, and maintain the Services; carry out the Services Agreement; and comply with documented lawful instructions. Lantern may improve the Services using aggregated or de-identified information as described in Section 9, not identifiable Customer Personal Data.

Each party will comply with its obligations under Applicable Data Protection Law. Customer is responsible for the lawfulness of its instructions, hiring criteria, and disclosures of Customer Personal Data to Lantern.

3. Details of Processing

Subject matter and purpose

Lantern provides an AI Hiring Manager that can help Customer calibrate hiring criteria, identify and engage potential candidates, manage candidate communications, conduct or assist with interviews and assessments, organize hiring evidence, generate job-related summaries and recommendations, and coordinate scheduling.

Duration

Lantern Processes Customer Personal Data for the term of the Services Agreement and any limited period afterward needed for return, deletion, backup cycles, security, dispute resolution, or legal compliance.

Nature of Processing

Collection, recording, organization, structuring, storage, retrieval, consultation, analysis, generation of job-related inferences, transmission, restriction, deletion, and other operations needed to provide the Services.

Data subjects

Candidates, prospective candidates, Customer employees and contractors, recruiters, hiring managers, interviewers, references, and other people whose Personal Data Customer submits to the Services.

Categories of Personal Data

• identifiers and contact information;
• resume, education, employment, skills, qualifications, and professional-profile information;
• job applications, role preferences, communications, scheduling information, and recruiter or interviewer notes;
• written, audio, or video interview and assessment responses, recordings where enabled, transcripts, and feedback;
• job-related summaries, matches, rankings, scores, recommendations, and other inferences;
• account, device, usage, diagnostic, security, and log information; and
• sensitive Personal Data only where Customer has a lawful, necessary, and clearly disclosed basis to Process it.

4. Customer obligations

Customer will:

• give lawful, documented instructions and disclose only Personal Data it has the right to Process;
• provide required privacy, recording, and artificial-intelligence notices and obtain required consent;
• comply with employment, anti-discrimination, accessibility, labor, and automated-employment-decision requirements;
• provide accommodations, alternative processes, and qualified human review where required;
• respond to Data Subject requests and involve Lantern where assistance is needed;
• use appropriate access controls and promptly notify Lantern of suspected misuse; and
• avoid instructing Lantern to infer or use protected characteristics unlawfully.

5. Lantern obligations

Lantern will:

1. Process Customer Personal Data only on Customer's documented instructions, unless law requires otherwise;
2. ensure people authorized to Process Customer Personal Data are bound by confidentiality obligations;
3. maintain the security measures described in Annex A;
4. taking into account the nature of Processing, reasonably assist Customer with Data Subject requests;
5. reasonably assist Customer with security, breach notification, impact assessments, and regulator consultations required by Applicable Data Protection Law;
6. notify Customer if Lantern believes an instruction infringes Applicable Data Protection Law;
7. maintain records and information reasonably necessary to demonstrate compliance with this DPA; and
8. return or delete Customer Personal Data as described in Section 9.

6. CCPA and similar U.S. state terms

Lantern will not:

• Sell or Share Customer Personal Data;
• retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for a commercial purpose other than the business purposes specified in the Services Agreement and this DPA;
• combine Customer Personal Data with Personal Data received from another person or collected from Lantern's own interaction with a Consumer, except as permitted by Applicable Data Protection Law; or
• use Customer Personal Data for cross-context behavioral advertising.

The parties acknowledge that Customer discloses Customer Personal Data to Lantern only for the limited and specified purposes in this DPA. Customer may take reasonable and appropriate steps to help ensure Lantern uses Customer Personal Data consistently with Customer's obligations and may require Lantern to stop and remediate unauthorized use. Lantern will notify Customer if it determines it can no longer meet these obligations.

Website visitor information Lantern collects on its own behalf at lantern.md is not Customer Personal Data and is governed by Lantern's Privacy Policy and Cookie Policy.

7. Subprocessors

Customer grants Lantern general authorization to use Subprocessors. Lantern will:

• impose data protection obligations that are no less protective in material respects than those in this DPA;
• remain responsible for each Subprocessor's performance of those obligations; and
• provide notice of a new Subprocessor through the Lantern Trust Center or another agreed channel.

Customer may object to a new Subprocessor on reasonable data-protection grounds within 15 days after notice. The parties will work in good faith on a commercially reasonable solution. If none is available, Customer may terminate the affected Services without penalty for the unused portion of the applicable subscription term.

Current Subprocessor information is available through the Lantern Trust Center.

8. Security incidents

Lantern will notify Customer without undue delay after confirming a breach of security that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a "Security Incident").

Lantern will provide information reasonably available to help Customer meet its notification obligations, take reasonable steps to contain and remediate the Security Incident, and provide updates as material information becomes available. Notification is not an admission of fault or liability.

Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked scans or failed login attempts, are not Security Incidents under this DPA.

9. Return and deletion

At Customer's written request or after the Services Agreement ends, Lantern will return or delete Customer Personal Data within a commercially reasonable period, unless law requires retention. Deletion from backups will occur through Lantern's normal secure backup lifecycle. Until deletion, this DPA continues to apply.

Lantern may retain aggregated or de-identified information that cannot reasonably be linked to a Data Subject or Customer and will not attempt to re-identify it except to test de-identification controls as permitted by law.

10. Audits

On reasonable request, Lantern will provide information needed to demonstrate compliance with this DPA, which may include current third-party audit reports, certifications, or security documentation available through the Lantern Trust Center.

If that information is insufficient and Applicable Data Protection Law requires additional review, Customer may conduct one audit per year through an independent auditor, subject to reasonable notice, confidentiality, security, and scope restrictions. Customer bears its audit costs unless the audit identifies a material breach by Lantern. Audits must not expose another customer's data or unreasonably disrupt Lantern's operations.

11. Data transfers

Lantern is based in the United States. Customer authorizes Lantern and its Subprocessors to Process Customer Personal Data in the United States and other locations needed to provide the Services.

If Applicable Data Protection Law requires a transfer mechanism for Customer Personal Data from another country, the parties will use the legally required mechanism, such as applicable standard contractual clauses or an approved addendum. The transfer mechanism controls if it conflicts with this DPA.

12. Liability and order of precedence

The liability limits and exclusions in the Services Agreement apply to this DPA. If this DPA conflicts with the Services Agreement on the Processing of Customer Personal Data, this DPA controls. If a legally required transfer mechanism conflicts with this DPA, that transfer mechanism controls for the affected transfer.

13. Changes and termination

This DPA remains in effect while Lantern Processes Customer Personal Data. Lantern may update it where reasonably necessary to reflect changes in law or the Services, provided an update does not materially reduce protection for Customer Personal Data during a current subscription term.

Annex A: Security measures

Lantern maintains a security program designed for the nature of the Services and Customer Personal Data, including:

• access controls based on least privilege and role, with multi-factor authentication for privileged access where appropriate;
• encryption in transit and at rest where appropriate;
• logging, monitoring, vulnerability management, and incident response procedures;
• secure software-development and change-management practices;
• personnel confidentiality and security awareness obligations;
• vendor and Subprocessor risk management;
• business continuity, backup, and recovery controls appropriate to the Services; and
• data retention and secure deletion processes.

Security measures may evolve as technology and risk change, but Lantern will not materially decrease the overall level of protection during a current subscription term.

Annex B: Subprocessors

Lantern's current Subprocessor list, service locations, and supporting trust information are maintained through the Lantern Trust Center. Customer may request a copy by emailing team@lantern.md.

Contact

Lantern AI Inc.
Attn: Privacy and Security
2261 Market Street, STE 85453
San Francisco, CA 94114, United States
team@lantern.md