The DPA you already have

This Data Processing Addendum (“DPA”) forms part of the agreement between Trovakap Private Limited, a company incorporated in India that provides the Itya service (“Trovakap”), and the customer organization that subscribes to it (the “Agreement”). In this DPA, “we” and “us” mean Trovakap acting as the provider of the service. It governs our processing of personal data on the customer’s behalf and applies wherever the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, India’s Digital Personal Data Protection Act 2023, or a comparable law applies to that processing.

• Customer as controller. The customer — the data fiduciary, in the terms of India’s DPDP Act — determines why and how candidate, interviewer and workspace personal data is processed in Itya. The customer decides which roles are opened, which candidates are entered, which interviews are recorded, and what the retention policy is.
• Trovakap as processor. Trovakap Private Limited processes that personal data only to provide, secure and support the service, and only on the customer’s documented instructions.
• Trovakap as controller, separately. For its own account records, billing, service security, abuse prevention and product telemetry about how the service itself is used, Trovakap acts as a controller. That processing is described in the privacy policy, not here.

Where this DPA conflicts with the rest of the Agreement on the processing of personal data, this DPA prevails. Where an executed order form or a negotiated data-protection agreement conflicts with this DPA, that signed document prevails.

This DPA is incorporated into the Agreement automatically. A customer that subscribes to Itya and continues to use the service is bound by it, and Trovakap is bound to the customer, without either party needing to sign anything. Self-serve customers therefore already have a data processing agreement in place.

If your organization needs an executed counterpart — because procurement, a data protection officer, or a supervisory authority requires one — email legal@itya.ai with your legal entity name, registered address, and the signatory’s name and title. We will return a counter-signed copy of this DPA, including the Standard Contractual Clauses, with the annexes populated for your subscription.

We will also complete a reasonable security questionnaire and answer a transfer‑impact‑assessment request during an evaluation. Send those to security@itya.ai.

Subject matter. Provision of the Itya interview-intelligence service: scheduling and hosting interviews, capturing consented interview audio and video, producing transcripts, generating AI-assisted debriefs and scorecards for human review, and managing the resulting hiring records.

Duration. For the term of the Agreement, plus the deletion window described under “Return and deletion” below.

Nature of the processing. Collection, recording, structuring, storage, transcription, automated analysis to produce draft evaluations for human review, retrieval, transmission to systems the customer connects, restriction, erasure and destruction.

Purpose. Solely to provide, secure, monitor, support and improve the service for the customer, and to comply with law. Trovakap does not use customer personal data to train general-purpose AI models, does not sell it, and does not use it for advertising.

Data subjects. Candidates and applicants; interviewers, recruiters, hiring managers and other workspace members; administrative and billing contacts of the customer; and any third party a customer’s users mention inside interview content they submit.

Personal data. The categories below, as the customer chooses to enter or capture them:

• Identity and contact data: name, email address, phone number, profile photo where supplied, job title and employer.
• Application data: resumes and attachments, application answers, stage and status, recruiter notes and internal comments.
• Interview data: scheduled times and attendance, consented audio and video, transcripts, speaker attribution, AI-drafted debriefs and scorecards, and the reviewer edits and decisions recorded against them.
• Account and security data: authentication credentials in hashed form, two-factor enrollment, session and device records, IP address, and audit-log entries.
• Billing data: billing contact, billing address and subscription records.

Special category data. Trovakap is not designed to process special category data under Article 9, criminal‑offense data under Article 10, or children’s data. A customer must not configure the service to collect it. Because interview conversation is free-form, special category data can appear incidentally in a transcript; Trovakap applies the same technical and organizational measures to it and does not process it for any separate purpose.

The commitments Article 28(3) of the GDPR requires of a processor:

• (a) Documented instructions. Trovakap processes personal data only on the customer’s documented instructions, including as to international transfers. The Agreement, this DPA and the customer’s use of the product’s features are the complete documented instructions. If Trovakap is required by law to process beyond them, it will tell the customer first unless that law forbids it. Trovakap will tell the customer if it believes an instruction infringes data protection law.
• (b) Confidentiality. Every Trovakap person with access to customer personal data is bound by a written confidentiality obligation that survives the end of their engagement, and access is granted only where a role requires it.
• (c) Security. Trovakap implements the technical and organizational measures described under “Security measures” below, appropriate to the risk under Article 32.
• (d) Sub-processing. Trovakap engages subprocessors only on the terms in “Subprocessors” below, and imposes on each of them data-protection obligations no less protective than these.
• (e) Data subject rights. Trovakap assists the customer, by appropriate technical and organizational measures and so far as possible, in responding to requests to exercise data subject rights.
• (f) Articles 32–36. Trovakap assists the customer in meeting its own security, breach-notification and data-protection-impact-assessment obligations, taking into account the nature of the processing and the information available to Trovakap.
• (g) Return or deletion. At the end of the Agreement Trovakap returns or deletes customer personal data as set out under “Return and deletion” below.
• (h) Information and audits. Trovakap makes available the information needed to demonstrate compliance with Article 28 and allows for and contributes to audits, as set out under “Audit rights” below.

The customer gives Trovakap a general authorization to engage subprocessors. Today they are:

• Every deployment: Oracle Cloud Infrastructure; Anthropic; OpenAI; Microsoft Azure Communication Services; Amazon Web Services (SES); Stripe.
• Conditional: Slack; Zendesk; Google Workspace; Microsoft 365; Zoom; Amazon Web Services (S3); Deepgram; AssemblyAI; Recall.ai; Greenhouse, Lever, Ashby and Workable.

The subprocessor list gives each one’s purpose, the data it sees, where it processes and the transfer mechanism that covers it, with a dated change log. The list is incorporated into this DPA.

Before a new subprocessor starts processing customer personal data, Trovakap gives at least 30 days’ notice. To receive that notice, email legal@itya.ai asking to be added to the subprocessor notification list. A customer that reasonably objects on data-protection grounds within that notice period may raise the objection with Trovakap; if the parties cannot agree on a resolution, the customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused term.

Trovakap remains fully liable to the customer for the performance of each subprocessor’s obligations. Each subprocessor is engaged under a written contract imposing data-protection obligations no less protective than this DPA.

Calendar and meeting accounts the customer connects itself are not Trovakap’s subprocessors. The customer is already the controller of those accounts and directs the transfer:

• Your own Google Calendar and Google Meet, when a workspace member connects them through OAuth to schedule interviews and create meeting links.
• Your own Microsoft Outlook Calendar and Microsoft Teams, when a workspace member connects them through OAuth to schedule interviews and create meeting links.
• Your own Zoom account, when a workspace member connects it to create meeting links.

Where Trovakap processes personal data that is subject to EU, UK or Swiss data protection law outside the country of origin, the following transfer mechanisms apply and are incorporated into this DPA by reference.

• EU SCCs, Module Two. Module Two (controller to processor) of the clauses in Commission Implementing Decision (EU) 2021/914 applies to transfers of customer personal data from the customer as controller to Trovakap as processor. Clause 7 (docking) applies; clause 9 uses option 2 (general written authorization) with the 30-day notice period above; clause 11 does not use the optional independent-dispute-resolution wording; clause 17 selects Irish law; clause 18(b) selects the courts of Ireland. Annex I is populated by the “Parties, roles”, “Subject matter” and “Categories” sections above; Annex II by “Security measures”; Annex III by the subprocessor table.
• EU SCCs, Module Three. Module Three (processor to subprocessor) applies between Trovakap and each subprocessor listed above that is outside the EEA and not covered by an adequacy decision.
• UK transfers. The UK International Data Transfer Addendum to the EU SCCs (version B1.0, issued under section 119A of the Data Protection Act 2018) applies to transfers subject to UK GDPR, with the EU SCCs above as the approved transfer mechanism it amends. Where the customer prefers the standalone UK IDTA, Trovakap will execute it on request.
• Swiss transfers. For transfers subject to the Swiss FADP, the EU SCCs apply with the Swiss adaptations: the Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR are read as references to the FADP, and the clauses also protect the data of legal entities until the FADP no longer requires it.

Transfer impact assessments. Trovakap has assessed the laws of the destination countries for the transfers above and is not aware of any law or practice that would prevent it from meeting its obligations under the SCCs. Trovakap has not received a government request for customer personal data. Trovakap will notify the customer if it becomes unable to comply, will challenge any request it believes is unlawful, and will disclose only the minimum required. Trovakap will share its transfer impact assessment and its supplementary measures on request to security@itya.ai.

The measures below are the technical and organizational measures Trovakap applies under Article 32 and Annex II of the SCCs. The security page describes them in product terms, and states precisely which data is encrypted at the application layer and which relies on encrypted infrastructure volumes.

• Encryption in transit. TLS 1.2 or above on every external connection, with HSTS on the public origins.
• Encryption at rest. Application-layer AES-256-GCM with versioned keys for the highest-risk secrets — integration OAuth access and refresh tokens, two-factor secrets, webhook signing secrets and stored bot credentials. The database and object storage sit on encrypted block and object volumes provided by the hosting platform, and backups are encrypted before they leave the host.
• Access control. Role-based permissions enforced per request; every tenant query is scoped to one workspace; cross-workspace access is available only to a named system path that is itself audited.
• Authentication. Password hashing with an adaptive work-factor function (bcrypt, cost factor 12), breached-password checks, optional two-factor authentication, session listing and remote sign-out, and short-lived rotating refresh tokens in host-scoped cookies.
• Consent gating. Interview capture will not start without a recorded consent decision from the participants, and the deletion deadline is fixed at consent time so a later policy change cannot extend it.
• Logging and monitoring. An audit log of interview, scorecard, billing, security and administrative actions with actor context; structured application logs; alerting on error rate, queue depth and circuit breakers.
• File safety. Uploaded files are scanned before they are made available, and quarantined on a positive result.
• Resilience. Automated encrypted backups to a separate off-host store, with restore drills.
• Organizational measures. Least-privilege production access, code review, dependency and secret scanning in continuous integration, and a documented vulnerability disclosure policy.

Trovakap does not currently hold a SOC 2 or ISO 27001 certification and makes no such claim.

Trovakap provides self-service tooling that lets a customer answer most requests without contacting us: candidate and workspace data export, candidate erasure, consent records, and an audit trail of what was done and by whom. A candidate can also start a verified request directly through the public data-request flow, which identifies the controlling workspace and routes the request to it.

If a data subject contacts Trovakap directly about data Trovakap processes for a customer, Trovakap will not respond substantively. It will tell the data subject to contact the customer, and notify the customer without undue delay unless the law forbids it.

Where a customer needs more help than the tooling gives, Trovakap will provide reasonable assistance at no additional charge for requests that arise from ordinary use of the service. An erasure accepted by the customer is executed against live systems within 72 hours and works through backups as they roll off.

Trovakap notifies the customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting that customer’s personal data. Notice goes to the workspace owner and to any security contact the customer has given us.

The notice will describe, so far as the information is available at the time:

• the nature of the breach and the categories and approximate number of records;
• the likely consequences;
• the measures taken or proposed to address it and to mitigate its effects; and
• a contact point for further information.

Where the full picture is not available within 72 hours, Trovakap sends what it has and follows up in phases. Trovakap will not delay notice to complete an investigation. Trovakap’s notice is not an admission of fault. The customer, as controller, remains responsible for notifying its supervisory authority and, where required, affected data subjects.

These are the retention periods Trovakap applies by default. A workspace administrator can shorten or lengthen the configurable ones. Where a class has no automatic expiry, that is stated rather than dressed up as a policy.

Until deleted means a record is kept until a candidate or an administrator asks for it to be deleted, or the workspace is closed; nothing expires it automatically.

A legal hold, a live security investigation, or a legal obligation can pause a deletion. If that happens to data the customer asked us to delete, we will say so and say why.

For 30 days after the Agreement ends, the customer can export its data through the product’s export tooling, and can ask Trovakap for an export in a structured, machine-readable format.

After that window, Trovakap deletes customer personal data from live systems. Encrypted backups are retained on their normal cycle — at least 30 days — and the data is destroyed as those backups expire. Until then it remains encrypted and is not restored except to recover the production environment.

Trovakap may retain personal data where the law requires it, and will keep it only for as long as that obligation lasts and only for that purpose. On request, Trovakap will confirm deletion in writing.

Trovakap will make available to the customer the information reasonably necessary to demonstrate compliance with Article 28 and this DPA. In the first instance that means: this DPA, the security page, the subprocessor list, the retention matrix, the disclosure policy, and a completed security questionnaire.

Where that is not sufficient for the customer’s own compliance obligations, or where a supervisory authority requires it, the customer may audit Trovakap’s processing once in any 12‑month period, on 30 days’ written notice, during business hours, under an appropriate confidentiality agreement, and in a way that does not disrupt Trovakap’s operations or the confidentiality of other customers’ data. The customer may use an independent auditor that is not a competitor of Trovakap. Each party bears its own costs, except that the customer reimburses Trovakap’s reasonable costs for an audit beyond the first in any 12‑month period. An additional audit may be carried out at any time following a personal data breach affecting the customer.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where a mandatory provision of data protection law — in particular Article 82 GDPR and clause 12 of the SCCs — provides otherwise. Nothing in this DPA limits a data subject’s rights against either party.

Order of precedence: (1) the Standard Contractual Clauses and any applicable UK or Swiss addendum, (2) an executed order form or negotiated data-protection agreement, (3) this DPA, (4) the terms of service.

Trovakap may update this DPA to reflect a change in law, in the service, or in its subprocessors. A change that materially reduces the protection of customer personal data takes effect only after 30 days’ notice, during which the customer may object as described under “Subprocessors”.

Questions and signature requests: legal@itya.ai. This DPA is published in English; a translation is provided for convenience only and the English version governs.