Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Cherrypicker Terms of Use (“Terms”) between Cherrypicker Inc. (“Cherrypicker,” “we,” “us,” or “our”) and each Customer that uses the Services. It applies automatically when a Customer accepts the Terms. No separate signature is required.

Capitalized terms not defined in this DPA have the meanings given in the Terms.

1. Definitions

“Customer Personal Data” means personal information that Cherrypicker processes on the Customer’s behalf in providing the Services to that Customer. It includes personal information contained in Customer Data or User Content the Customer submits, and screening information (such as responses, transcripts, recordings where enabled, summaries, and scores) generated for the Customer’s roles.

“Independent Data” means professional and business information that Cherrypicker independently obtains, licenses, or collects for its own sourcing and data operations, and information Cherrypicker processes for its own business purposes, such as account, billing, security, and product analytics information. Independent Data is not Customer Personal Data, and Cherrypicker processes it as described in its Privacy Policy.

“Data Protection Laws” means privacy and data protection laws that apply to the processing of Customer Personal Data under this DPA, including the California Consumer Privacy Act, as amended (“CCPA”), and similar U.S. state laws.

“Subprocessor” means a third party Cherrypicker engages to process Customer Personal Data on the Customer’s behalf.

“Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

2. Roles and Scope

For Customer Personal Data, the Customer is the business or controller, and Cherrypicker is the service provider or processor. For Independent Data, Cherrypicker acts as an independent business or controller, and this DPA does not apply.

Cherrypicker processes Customer Personal Data to provide the Services the Customer uses, including candidate sourcing workflows, outreach, introductions, AI-assisted screening, hiring dashboards, support, and security, and for the other business purposes described in the Terms.

For Cherrypicker Labs engagements, this DPA applies to Customer Personal Data processed during the engagement unless the applicable project agreement sets different data protection terms, in which case the project agreement controls for that engagement.

3. Processing Instructions

Cherrypicker will process Customer Personal Data only on the Customer’s documented instructions, unless applicable law requires otherwise. The Terms, this DPA, and the Customer’s configuration and use of the Services are the Customer’s documented instructions.

Cherrypicker will tell the Customer if it believes an instruction violates Data Protection Laws, and may decline to follow that instruction.

4. Service Provider Commitments

With respect to Customer Personal Data, Cherrypicker will not:

• Sell or share it, as those terms are defined under the CCPA and similar laws;
• Retain, use, or disclose it for any purpose other than the business purposes specified in the Terms and this DPA, or as otherwise permitted for service providers under Data Protection Laws;
• Retain, use, or disclose it outside the direct business relationship between Cherrypicker and the Customer;
• Combine it with personal information Cherrypicker receives from or on behalf of others, or collects from its own interactions with individuals, except as necessary to provide the Services to the Customer or as otherwise permitted for service providers under Data Protection Laws;
• Use it for advertising, retargeting, cross-context behavioral advertising, or third-party marketing; or
• Use identifiable Customer Personal Data to train or fine-tune general-purpose artificial intelligence models for unrelated third-party purposes.

Cherrypicker may use Customer Personal Data to maintain, secure, and improve the quality of the Services, and may create aggregated or de-identified information as described in the Terms, provided that it does not use Customer Personal Data to build or modify profiles for another customer. Cherrypicker will not attempt to re-identify de-identified information.

Cherrypicker will comply with its obligations under Data Protection Laws, provide the level of privacy protection those laws require, and notify the Customer if it determines it can no longer meet its obligations under this DPA. The Customer may then take reasonable and appropriate steps to stop and remediate unauthorized processing.

5. Confidentiality and Security

Cherrypicker will ensure that personnel and contractors authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as needed to provide the Services.

Cherrypicker will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of Customer Personal Data, as described in the “Data Security” sections of the Terms and Privacy Policy. Access to screening information is limited to the Customer’s authorized users and to Cherrypicker personnel and Subprocessors who need it to provide the Services.

6. AI-Assisted Screening

Before an AI-assisted screening begins, Cherrypicker will present the candidate with notice that the interview is conducted by artificial intelligence and, where enabled, notice of recording or transcription, and will obtain consent where required by applicable law.

Cherrypicker will keep records of those notices and of the candidate’s acknowledgment or consent, as made available by its screening provider, and will provide them to the Customer on reasonable request for screenings of the Customer’s candidates.

The Customer remains responsible for notices, consents, assessments, and accommodations required of it as the employer, as described in the Terms.

7. Subprocessors

The Customer authorizes Cherrypicker to engage Subprocessors to process Customer Personal Data. Cherrypicker will engage each Subprocessor under a written agreement with data protection obligations no less protective than those in this DPA, to the extent applicable to the services the Subprocessor provides.

Cherrypicker’s current Subprocessors are listed below. Certain specialized providers are identified by function only, to protect the confidentiality of Cherrypicker’s vendor relationships. Cherrypicker will identify those providers to a Customer on request at support@getcherrypicker.com, subject to the confidentiality obligations in the Terms.

Cherrypicker also contacts candidates through third-party platforms such as LinkedIn. Those platforms process information under their own terms and privacy policies and are not Cherrypicker’s Subprocessors.

Cherrypicker will update this list and notify the Customer by email to the account owner at least 15 days before a new or replacement Subprocessor begins processing Customer Personal Data. Where a change is urgently needed for security or continuity of the Services, Cherrypicker will notify the Customer as soon as reasonably practicable.

The Customer may object to a new Subprocessor on reasonable data protection grounds by emailing support@getcherrypicker.com within 15 days of notice. The parties will discuss the concern in good faith. If it cannot be resolved within 30 days, the Customer may stop using the Services or features that depend on that Subprocessor. This is the Customer’s sole remedy for an objection.

Cherrypicker remains responsible for its Subprocessors’ performance of their data protection obligations under this DPA, subject to the limitations of liability in the Terms.

Independent professional data suppliers and enrichment services that Cherrypicker uses for its own sourcing and data operations are classified according to their actual processing activities and are not automatically Subprocessors, as described in the Privacy Policy.

8. Privacy Requests

If Cherrypicker receives a request from an individual to exercise privacy rights concerning Customer Personal Data, Cherrypicker will promptly notify the Customer and will not respond to the request except to direct the individual to the Customer, unless the Customer authorizes a response or applicable law requires otherwise.

Taking into account the nature of the processing, Cherrypicker will provide reasonable assistance to help the Customer respond to those requests, and will keep a record of how each request was received, routed, and resolved.

9. Security Incidents

Cherrypicker will notify the Customer without undue delay after confirming a Security Incident affecting the Customer’s Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories of data affected, and the steps Cherrypicker is taking in response. Cherrypicker will provide updates as more information becomes available and will reasonably cooperate with the Customer’s response.

Notice of a Security Incident is not an acknowledgment of fault or liability.

10. Deletion and Return

After the Customer’s account ends, Cherrypicker will delete or de-identify Customer Personal Data within 90 days of the Customer’s written request. Before deletion, the Customer may export information available for export through the Services.

Cherrypicker may keep Customer Personal Data where retention is required by law, where it is needed to honor opt-out or suppression requests, to establish or defend legal claims, or in backups until they are overwritten in the ordinary course. Any retained data remains subject to this DPA.

11. Compliance Information

Upon reasonable written request, Cherrypicker may provide existing, reasonably available information concerning its Services and applicable safeguards, subject to confidentiality, security, intellectual property, third-party contractual restrictions, and applicable law, as described in the Terms.

Any additional audit, certification, questionnaire, investigation, or custom reporting obligations must be separately agreed in writing, except where required by applicable law.

12. Customer Responsibilities

The Customer is responsible for having a lawful basis to provide Customer Personal Data to Cherrypicker, for providing notices and obtaining consents required of the Customer, and for ensuring that its instructions comply with Data Protection Laws, as described in the Terms.

13. International Data

Cherrypicker processes Customer Personal Data in the United States. The Services are designed for U.S. hiring. If the Customer intends to submit personal data subject to the EU or UK General Data Protection Regulation, the Customer must contact Cherrypicker first so that the parties can agree on appropriate transfer terms.

14. Liability and Order of Precedence

Each party’s liability arising out of or relating to this DPA is subject to the limitations of liability in the Terms.

If this DPA conflicts with the Terms on a matter of data protection, this DPA controls. In all other respects, the Terms control.

15. Changes

Cherrypicker may update this DPA from time to time, and will revise the “Last updated” date above. Updates will not reduce the overall level of protection for Customer Personal Data except where required by law.

16. Contact

Cherrypicker Inc.
2248 Broadway #1443
New York, NY 10024
Email: support@getcherrypicker.com