Data Processing Addendum
Last updated: June 1, 2026
Roles of the Parties in Data Processing
When Talent Kasi processes candidate personal data on your behalf, you are designated as the Data Controller, and Talent Kasi acts as the Data Processor. These roles are defined in accordance with GDPR Article 4 and equivalent definitions under POPIA.
Scope and Purpose of Processing
We process applicant data, including names, contact details, CVs, screening answers, and communications, exclusively for the purpose of delivering the Talent Kasi Service. We commit to not using customer data for training shared models or for any secondary purposes without your explicit written instruction.
Approved Sub-processors
Our current approved sub-processors include AWS (hosting in Frankfurt and Cape Town), OpenAI (for CV parsing, with an opt-out option available on our Scale plan), Postmark (for transactional email services), and Cloudflare (for CDN and WAF services). The most up-to-date list of sub-processors is published on our /security page, and we will notify you of any changes at least 30 days in advance.
Security Measures Implemented
We maintain robust technical and organizational measures as detailed on our Security page. These measures include AES-256 encryption for data at rest, TLS 1.3 for data in transit, mandatory MFA for all engineering access, quarterly disaster recovery testing, and an active SOC 2 Type II program.
Data Subject Rights Support
Talent Kasi provides self-service tools within the product for data export, correction, and deletion. Should you receive a data subject request that you are unable to fulfill independently, we will provide assistance within 10 working days at no additional charge.
International Data Transfers
For data transfers outside the European Economic Area (EEA) or South Africa, we rely on Standard Contractual Clauses and other equivalent transfer mechanisms. A comprehensive transfer impact assessment is available to our Scale plan customers under a Non-Disclosure Agreement (NDA).
Term and Data Deletion
This Data Processing Addendum remains in effect for the duration that we process personal data on your behalf. Upon termination of our services, we will delete or return all personal data within 90 days, except where retention is required by law.
Execution of the DPA
Customers on our Scale plan can request a countersigned Data Processing Addendum. Please email legal@talentkasi.io with your legal entity name, and we will provide a signed copy within 3 working days.