Data Processing Addendum

This Addendum forms part of the Terms of Service between Ascent and each hiring company that uses it (the “Customer”). It covers the personal information of applicants and of the Customer’s team members that Ascent handles to provide the Service (“Customer Data”).

The Customer decides why applicant information is collected and how hiring decisions are made, and remains accountable for it. Ascent processes Customer Data on the Customer’s behalf, as its service provider under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector. Where Ascent itself decides how information is processed (for example, drafting AI feedback, described on our AI Transparency page), it takes responsibility for that processing as described in our Privacy Policy.

• Uses it only to provide the Service as the Customer directs through its use of Ascent, and never sells it or uses it for advertising.
• Doesn’t use one Customer’s applicants for another Customer’s hiring.
• Limits access to people who need it to run the Service, who are bound to keep it confidential.
• Helps the Customer respond to applicants’ requests to access, correct or delete their information.

Ascent protects Customer Data with safeguards suited to its sensitivity, including encrypted connections, passwords stored only as salted scrypt hashes, sign-in cookies that scripts can’t read, one-time sign-in codes, rate limits on sign-in attempts, and access limited to each Customer’s own team. We review these safeguards as the Service grows.

Ascent uses the providers below to run the Service. Each is bound by contract to protect the information and to use it only to provide its service to us. We’ll update this list before adding or replacing a provider that handles Customer Data.

Customer Data is stored and processed outside Canada, including in the United States, where it may be accessible to courts and authorities under local law. The Customer is responsible for telling applicants this where the law requires it, and for any privacy impact assessment Quebec law requires before its information leaves Quebec; Ascent will provide the information needed for one.

If Ascent becomes aware of a breach of security safeguards involving Customer Data, it will notify the Customer without undue delay, share what it knows, and take reasonable steps to contain it. That lets the Customer meet its own duties to report breaches to the Privacy Commissioner of Canada (or Quebec’s Commission d’accès à l’information) and to notify affected people where there’s a real risk of significant harm.

The Customer can export its data and delete its account at any time from its account settings. When the Customer’s subscription ends, or on request, Ascent deletes Customer Data, except where the law requires it to be kept.

Ascent will make available the information reasonably needed to show it meets this Addendum. Questions go to our Privacy Officer at ascentapplications.assist@gmail.com. If this Addendum and the Terms of Service conflict about Customer Data, this Addendum applies.