Data Processing Agreement

Published: 26 October 2026

This template sets out CVViZ’s proposed data-processing terms. It applies to a Customer only when validly incorporated into the parties’ agreement with the applicable processing, retention, security, subprocessor and transfer schedules completed and agreed. Publication does not amend an existing agreement, establish acceptance, or demonstrate that a transfer instrument has been executed. Contact he***@***iz.com to complete the applicable agreement.

Applicable agreements and amendment requirements determine which version governs a customer.

This Data Processing Agreement and its annexes (the DPA) govern processing by CVViZ Softwares Private Limited, at 2nd Floor, Hemera, A1-203, Nyati Elysia, Riverfront Road, Kharadi, Pune (MS) 411014, India (CVViZ, we, us), of personal data on behalf of the customer identified in the applicable service agreement (Customer, you).

The Service Agreement means the applicable CVViZ Terms and Conditions, order or other binding agreement for the Services. The Privacy Policy separately explains our personal-information practices.

This DPA forms part of the Service Agreement when the parties validly incorporate and accept this identified version, including through a legally binding electronic process, an order or amendment expressly incorporating it, or signatures. The acceptance record must identify the parties, authorized representative, date and applicable version. Publication, a general privacy acknowledgement or the presence of a link alone does not establish acceptance. An existing applicable DPA continues until validly amended or replaced; publication of this template does not alter an existing agreement.

For conflicts concerning processing on your behalf, this DPA prevails over the Service Agreement. Applicable Standard Contractual Clauses and mandatory law prevail where their terms require it. Contact our Privacy Team at he***@***iz.com for DPA, privacy, rights and transfer questions. Our Engineering Team handles technical investigation through the same address.

1. Scope and responsibilities

1.1 This DPA applies to personal data that CVViZ processes on the Customer's behalf to provide the agreed recruitment services (Customer Personal Data). Annex I describes the subject matter, duration, purposes, processing activities, data categories and individuals concerned.

1.2 The Customer acts as controller and CVViZ as processor. Where the Customer acts as a processor for another controller, CVViZ acts as its subprocessor; the Customer must have the controller's authority to appoint CVViZ and give the relevant instructions. The Customer must make the underlying controller's relevant instructions available to CVViZ before processing; its additional instructions must not conflict with those instructions. The parties must satisfy the applicable requirements for imposing the same relevant data-protection obligations downstream. Each party retains its own obligations under applicable law. This DPA does not make CVViZ the decision-maker for the Customer's hiring purposes.

1.3 Processing for CVViZ's own account administration, billing, legal compliance or other independently determined purposes is outside this DPA to that extent and is addressed in the Privacy Policy. This distinction does not permit CVViZ to reclassify customer recruitment content for an incompatible purpose.

1.4 The Customer is responsible for its lawful collection and use, required notices and permissions, instructions, recruitment criteria and decisions, and configurations. CVViZ remains responsible for its processor obligations, its personnel and subprocessors. Neither party may use this allocation to avoid duties imposed directly on it.

2. Documented instructions and permitted processing

2.1 CVViZ will process Customer Personal Data only on documented instructions, including the Service Agreement, this DPA, the Customer's use and configuration of agreed features, and authorized written instructions, unless processing is required by law within the exception permitted by the applicable Data Protection Laws. For EU GDPR Article 28 purposes, that exception is limited to Union or Member State law to which CVViZ is subject; the corresponding UK requirement applies where UK law governs. CVViZ will notify the Customer of the legal requirement before processing unless that law prohibits notice on important public-interest grounds. A third-country demand does not itself authorize processing contrary to these requirements; applicable SCC duties concerning local laws, government access and inability to comply remain in force.

2.2 Instructions may cover collection, import, storage, parsing, organization, retrieval, matching, AI-assisted analysis, configured automation, communications, export, correction, restriction, return and deletion for enabled Services. A materially different purpose requires a valid further instruction or agreement and any required legal basis, notices and permissions. Public availability of candidate information does not remove these requirements.

2.3 CVViZ will maintain appropriate records of instructions and promptly inform the Customer if an instruction appears to infringe applicable data-protection law. The parties will resolve that issue before the affected processing continues where necessary to comply with law. A warning to the Customer does not relieve CVViZ of its own legal obligations or authorize unlawful processing.

2.4 AI features may process the Customer's prompts, job descriptions, recruitment records, message content and relevant context through authorized service providers to produce requested outputs. The scope depends on the enabled feature. This DPA does not grant CVViZ or its providers an unrestricted right to reuse Customer Personal Data to train general-purpose models. Any use outside documented instructions requires a separately established lawful arrangement and cannot override the Google-data restrictions below. This clause is not a representation that every provider has zero retention or identical data-use settings.

2.5 Google API information. CVViZ's use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including Limited Use, and applicable Google Workspace API requirements. Google API data must not be sold, used for advertising, or used to develop, improve or train generalized or non-personalized AI or machine-learning models. Transfers and human access are limited to permitted purposes and exceptions, and the required explicit prior consent applies to relevant business transfers. These restrictions apply when a provider processes the information for CVViZ.

3. Personnel and security

3.1 CVViZ will restrict access to authorized personnel who need it for their duties and who are bound by confidentiality obligations or an appropriate statutory duty. CVViZ will maintain access management, training and supervision appropriate to those duties.

3.2 Taking account of the nature, scope, context and purposes of processing, the risks to individuals, the state of the art and implementation costs, CVViZ will implement appropriate technical and organizational measures, including the measures in Annex II. CVViZ will regularly assess their effectiveness and maintain appropriate evidence.

3.3 Measures may evolve without materially reducing the agreed level of protection. A change in wording does not remove a stronger binding security commitment or excuse a control deficiency.

4. Disclosure and individuals' requests

4.1 CVViZ will disclose Customer Personal Data only as authorized by documented instructions, this DPA or applicable law. Where legally permitted, CVViZ will notify the Customer before responding to a binding demand for disclosure, provide reasonable assistance to seek protection and limit disclosure to what is required. Applicable transfer-clause duties concerning review, challenge and documentation also apply.

4.2 CVViZ will assist the Customer, through appropriate technical and organizational measures and taking account of the nature of processing, with requests to exercise applicable privacy rights.

4.3 A request received directly concerning Customer Personal Data will be promptly assessed to identify the relevant Customer and forwarded without undue delay and no later than three business days after it is identified as relating to that Customer. CVViZ may acknowledge receipt and explain the routing. It will not make a substantive response on the Customer's behalf unless authorized or legally required. This does not restrict CVViZ's response concerning processing for which it is independently responsible.

4.4 Requests can be sent to he***@***iz.com. The parties will use proportionate identity checks and avoid collecting unnecessary identification documents. CVViZ will keep an appropriate record of instructions, actions and completion evidence.

5. Assistance and assessments

5.1 Taking account of the nature of processing and information available to CVViZ, CVViZ will assist the Customer with security, breach response, data-protection impact assessments and prior consultation requirements, including GDPR Articles 32–36 where applicable.

5.2 Assistance includes relevant available information about processing, service providers, transfers, security and feature behavior. The parties will cooperate on assessments of recruitment automation and AI where required. This DPA does not certify a Customer's recruitment workflow as lawful or bias-free.

5.3 Reasonable charges for exceptional assistance outside normal service provision must be mutually agreed. Charges or administrative arrangements must not prevent mandatory assistance or urgent compliance. Existing contractual rights to assistance remain protected.

6. Information, audits and inspections

6.1 CVViZ will make available information necessary to demonstrate compliance with its processor obligations and will allow and contribute to audits, including inspections, by the Customer or an authorized auditor.

6.2 Ordinary audits will use reasonable notice, confidentiality safeguards, business hours where practicable and measures protecting other customers' information. Relevant independent reports may help focus an audit but do not eliminate audit rights. Restrictions must not prevent a competent authority's powers, an urgent investigation or an audit required by law or applicable transfer clauses. A proposed auditor's conflict of interest should be resolved through a suitable alternative without defeating the audit right.

6.3 The Customer will pay reasonable audit costs for additional routine audits beyond one in a twelve-month period where permitted by the applicable agreement and law. This does not restrict mandatory or regulatory rights. CVViZ will cooperate with competent authorities and promptly refer relevant requests to the Customer where permitted.

6.4 The Customer may disclose this DPA and relevant compliance information to competent authorities and as otherwise legally required. Appropriate redaction of unrelated commercial information must not obstruct the required assessment.

7. Personal data breaches

7.1 CVViZ will notify the Customer without undue delay, and in no event later than 72 hours after becoming aware, of a personal data breach affecting Customer Personal Data processed by CVViZ or its subprocessors. The outer limit does not permit avoidable delay. CVViZ will not wait for a completed investigation or confirmation of cause before giving an initial notice.

7.2 Notice will include available information about the nature of the breach, affected categories and approximate numbers where known, likely consequences, response measures and a contact point. CVViZ may provide information in phases as it becomes available without undue further delay.

7.3 CVViZ will investigate, take appropriate containment and remediation measures, preserve relevant evidence and reasonably assist the Customer with required notifications and mitigation. Notice is not an admission of liability.

7.4 These duties apply to a breach within CVViZ's processing scope even if a Customer action contributed to it. They do not make CVViZ responsible for investigating an unrelated incident confined to systems it does not process or control. Responsibility for cause is assessed separately from notification and assistance.

8. International transfers

8.1 The parties will identify the relevant processing locations, remote access and onward transfers in Annexes I and III. Core hosting location alone is not a guarantee that every connected service or person processes data in that location.

8.2 CVViZ will make a restricted international transfer only where an applicable lawful mechanism is in place and any required assessment and supplementary measures have been addressed. Where legally available and required, the EU Standard Contractual Clauses apply as specified in Exhibit 1. UK restricted transfers require the applicable UK instrument; a reference to the ICO alone does not establish it. Swiss transfers require the relevant adaptations where applicable.

8.3 Applicable transfer clauses prevail over conflicting commercial terms. The parties will provide required cooperation and information, assess changes affecting safeguards, and suspend or end affected transfers where the governing instrument or law requires it. A fallback clause does not establish that a transfer assessment or provider agreement has been completed.

9. Subprocessors

9.1 Subject to the completed agreed list in Annex III, the Customer gives general written authorization for CVViZ to appoint subprocessors for the specified processing. Optional services apply only where enabled and authorized. Independent services contracted directly by the Customer must be distinguished from subprocessors acting for CVViZ.

9.2 CVViZ will give the Customer written notice of a proposed addition or replacement at least fifteen days before the new subprocessor begins the affected processing, with information sufficient to assess it and exercise the right to object. A longer binding notice period remains applicable. Posting a revised list alone does not replace required direct notice.

9.3 If the Customer objects, CVViZ will not appoint or replace the subprocessor for that processing, or will work with the Customer on an appropriate alternative. If no appropriate alternative is available, the Customer may suspend or terminate the affected Services, without prejudice to fees already incurred or other applicable rights. This does not narrow an existing right to suspend or terminate the Services more broadly or add a new termination penalty.

9.4 CVViZ will impose written data-protection obligations providing the protection required by applicable law and this DPA, including required transfer safeguards. CVViZ remains responsible for its subprocessors' performance. Copies or relevant information will be provided as required, with permitted redactions. Applicable SCC third-party beneficiary and onward-transfer duties remain in force.

10. Duration and termination

10.1 This DPA takes effect through the valid incorporation and acceptance described above and continues while CVViZ or its subprocessors process Customer Personal Data, including any required return, deletion or restricted retention after service termination. Signature is one permitted method, not the only method where legally binding electronic acceptance is available.

10.2 The Customer retains its right to terminate this DPA and the Service Agreement for cause at any time, on reasonable notice or without notice, at the Customer's choice. Mandatory suspension and termination rights under transfer clauses remain unaffected.

10.3 The parties will agree amendments required for legal compliance without an additional amendment charge. If they cannot agree, either may terminate on ninety days' written notice under the existing contractual provision. This notice period does not delay an immediate action required by law or transfer clauses.

11. Return, retention and deletion

11.1 The Customer may export or request the return of all Customer Personal Data during the service term and retains the applicable fourteen-day post-termination export-request window. Existing export rights covering other Customer Data are also preserved. A timely return request must be addressed before relevant data is irreversibly deleted, subject to an overriding legal requirement. A shorter binding erasure obligation or a valid instruction must also be respected.

11.2 At the end of processing services, CVViZ will, at the Customer's choice, return or delete Customer Personal Data and delete existing copies, unless storage is legally required within the exception permitted by applicable Data Protection Laws. For EU GDPR Article 28 purposes, that exception is Union or Member State law; the corresponding UK requirement applies where UK law governs. Where local law prohibits return or deletion of data transferred under SCCs, the applicable SCC provisions govern continued protection, restricted processing and the response to that prohibition. The completed retention schedule must specify applicable operational periods and the scope of permitted restricted retention. It must not extend an earlier binding deadline. For transfers governed by SCCs, the return, deletion and certification requirements in those clauses prevail.

11.3 The scope includes relevant active records, duplicate and linked copies, uploaded files and versions, sourcing records, AI-derived records, saved communications and drafts, subprocessors and backups. Disconnecting a mailbox, hiding a record or closing a request does not by itself establish complete erasure.

11.4 Where backup data cannot be selectively removed immediately, it must remain protected and unavailable for ordinary use, expire under the applicable documented schedule and remain subject to binding deletion deadlines. If a backup is restored, outstanding deletion instructions must be reapplied. CVViZ will explain applicable periods and any lawful exceptions and provide appropriate completion evidence, including certification where required.

11.5 Data retained because law requires it must be limited to that requirement, protected, restricted from unrelated processing and deleted when retention is no longer required. CVViZ's separate retention of its own necessary billing or legal records does not authorize indefinite retention of customer recruitment datasets. Preserving a purchased-credit entitlement does not require preserving unnecessary candidate or mailbox content.

11.6 Earlier contractual retention, return and deletion commitments continue until validly changed and must be interpreted consistently with mandatory law and transfer clauses. Publication of this template does not extend an earlier binding retention period or retroactively authorize longer retention. Data may not be recoverable after lawful deletion.

Customer-specific retention record. Before relying on this template for the relevant processing, the parties must agree a record identifying each relevant data category, its retention period or meaningful criteria, the triggering event, the latest permitted deletion point, any legally required exception and the method for confirming return, deletion or restriction. It must cover recruitment records and files, sourcing and AI outputs, communications, signing records, logs, backups and provider-held copies. Earlier binding deadlines remain applicable.

12. Contract administration

12.1 The DPA's precedence is limited to the processing it governs. Liability provisions in the applicable Service Agreement apply to the extent permitted by law and without restricting rights or responsibilities that applicable transfer clauses require to prevail.

12.2 Required notices may be sent electronically to the Customer's authorized contact in its agreement or account record, and to CVViZ at he***@***iz.com. The parties must keep their contact details current. CVViZ will give active customers the required DPA amendment notice by email or in-app notification, subject to the applicable agreement's delivery and acceptance requirements.

12.3 Amendments require a valid written agreement, which may include a legally binding electronic agreement. Existing signed-amendment requirements remain effective until validly changed. A website update alone does not amend an existing customer's DPA or transfer instrument. Any required version, party and acceptance evidence must be retained.

12.4 Invalidity of one provision does not invalidate the remainder where lawful. No provision excludes a party's non-excludable duties or an individual's enforceable rights. No remuneration is due for DPA obligations except as expressly permitted by this DPA or another applicable agreement.

12.5 A stronger existing confidentiality, security, return, deletion, audit or legacy commitment is not removed merely by publishing this revised template. Any proposed prospective change must be identified and validly agreed through the applicable process.

13. Definitions and applicable laws

Data Protection Laws means the privacy and data-protection laws applicable to the relevant party and processing, including the EU GDPR, UK data-protection law, Swiss law, applicable Indian law and applicable US state laws where their respective scope and commencement requirements are met. A customer's location outside the EU does not by itself make the California Consumer Privacy Act apply.

Controller, processor, personal data, processing, data subject and personal data breach have the meanings given by the applicable Data Protection Laws. A subprocessor processes Customer Personal Data for CVViZ in performing the Services. Services means the features supplied under the applicable Service Agreement. SCCs means the relevant unmodified standard contractual clauses lawfully incorporated through Exhibit 1.

Annex I — Parties and processing details

A. Parties

Customer / data exporter: the legal entity identified in the accepted Service Agreement and acceptance record; its address and authorized contact are those recorded for that agreement. Role: controller, or processor acting for an identified controller where applicable. Activities: use of the agreed recruitment Services. Acceptance date and representative: recorded in the legally binding acceptance or execution record.

CVViZ / data importer: CVViZ Softwares Private Limited, 2nd Floor, Hemera, A1-203, Nyati Elysia, Riverfront Road, Kharadi, Pune (MS) 411014, India. Contact: Privacy Team, he***@***iz.com. Role: processor, or subprocessor as applicable. Activities: provision of agreed recruitment Services. Acceptance/execution evidence: the record through which this DPA is validly incorporated by the parties. An affiliate does not become a party merely because it uses the service; any required accession must be completed.

B. Description

Sensitive and younger-candidate information. Recruitment submissions can contain sensitive information or information about younger applicants. The Customer must establish lawful processing and any required conditions, notices, consent and safeguards before submission; it must not include unnecessary sensitive information. CVViZ will apply purpose limitation, access restrictions, confidentiality and applicable deletion/transfer safeguards. Additional agreed measures must be recorded where the nature of the data requires them. This clause does not assert that every candidate is an adult or that sensitive information never enters a résumé.

Retention criteria. Subject to earlier binding deadlines and valid deletion instructions, the agreed schedule must limit active recruitment records and files to the instructed service duration, followed only by the restricted return and deletion stages required under section 11; communications and derived records to the enabled purpose for which they are needed; technical logs to a documented, limited security or diagnostic purpose; and protected backup copies to a fixed documented expiry. Signing records and legally required records must have a specified purpose and applicable period. These criteria guide the customer-specific schedule required by section 11; they do not establish an already verified deletion schedule or authorize indefinite retention.

C. Competent supervisory authority

For EU SCCs, the authority is determined under SCC Clause 13 by the Customer's establishment, representative or relevant data-subject location, as applicable. For a UK Addendum, the ICO has the role specified by that instrument. Swiss adaptations apply where relevant. The applicable customer record must identify the competent authority selected under these rules; a generic location formula does not complete this field.

Annex II — Contractual security requirements

These are contractual requirements for processing under an accepted DPA. Before acceptance, the parties must identify the measures actually implemented for the relevant Services and record the applicable control descriptions in the agreed security schedule, including relevant assistance measures. A statement of an obligation does not itself constitute an audit opinion or certification. Existing stronger commitments remain effective.

CVViZ will maintain:

1. Governance and people: a documented security program with accountable ownership, confidentiality obligations, access authorization and recorded privacy/security training before relevant access and at least annually thereafter. An overview is available on request under section 6.
2. Identity and separation: individual staff access, least privilege, access reviews and timely removal; authentication and protected credential handling; logical customer separation and separation of production from development/test processing. Privileged access and relevant security events must be logged and reviewed appropriately.
3. Encryption and network safeguards: industry-standard encryption over public networks; encryption for backup/archive media and any necessary portable-device copies; appropriate encryption and access restrictions for stored Customer Personal Data; network restrictions and protection against malicious access. Access to Customer systems must follow its authorization and agreed connection procedures.
4. Lifecycle and resilience: controlled changes, vulnerability management, protected backups, recovery procedures and testing, incident response, and documented return/deletion instructions covering linked stores and subprocessors. A deletion record must distinguish a soft-delete marker from completed erasure.
5. Physical infrastructure: appropriate access, environmental and availability protections for facilities used to process data. Where a cloud provider operates the facilities, CVViZ must obtain and evaluate relevant assurance for that provider's responsibility and manage its own configuration and access. This does not claim that CVViZ itself operates the provider's buildings or equipment.
6. Independent testing: independent penetration and vulnerability testing at least annually covering the relevant service systems; tracking and remediation of findings, appropriate revalidation and results made available under section 6. Existing specific testing commitments remain applicable.
7. Audit assurance: the scope, reporting period, boundaries, exclusions and current evidence for any agreed audit assurance will be identified in the security schedule. Any annual SSAE 18 or equivalent audit obligation in an existing DPA remains applicable for its agreed scope. This template does not assert certification or comprehensive audit coverage.
8. Breach and rights support: notification and assistance under sections 4–7, with the breach clock starting at awareness. Information may be phased; neither a completed investigation nor customer fault postpones required notification.
9. Provider and AI controls: authorized providers and instructions, appropriate access and disclosure controls, verification of relevant processing settings, and the Google restrictions in section 2.5. No zero-retention, universal no-training or all-EU processing assurance is implied.

Detailed control descriptions and evidence may be shared under appropriate confidentiality safeguards. Existing stronger obligations remain governed by section 12.5.

Annex III — Agreed subprocessor schedule

Before this template is relied on for the relevant processing, the parties must complete and agree a dated subprocessor schedule. For each subprocessor, the schedule must identify:

• Legal name and address or contact details.
• Purpose, processing activities, applicable Services and data categories.
• Storage, processing and remote-access countries.
• Duration, return and deletion arrangements.
• Applicable data-protection agreement and international-transfer safeguards.
• Appointment and required change-notice details.

The agreed schedule forms part of the accepted DPA. It must distinguish subprocessors acting for CVViZ from independent data sources or services contracted directly by the Customer. Listing a brand in the informational overview below does not authorize its appointment, complete this schedule or replace the notice and objection requirements in section 9. CVViZ must provide the required details and obtain the applicable authorization before the relevant processing begins.

Exhibit 1 — Transfer clauses and elections

The applicable transfer package must identify the transfer paths, parties, role/module and completed annexes. The official mandatory clauses remain unmodified. Publication of this template does not establish that a transfer instrument has been accepted or that the required transfer assessment has been completed.

Official source documents: EU Standard Contractual Clauses under Decision 2021/914 and UK Addendum, version B1.0. The exact applicable text, selections and completed schedules must be retained with the accepted agreement.

EU transfers. Where required and legally available for the transfer, the parties incorporate the applicable clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, without altering their mandatory text. Module Two applies to a Customer controller transferring to CVViZ as processor; Module Three applies to a Customer processor transferring to CVViZ as subprocessor for an authorized controller. The applicable module and transfer must be recorded, rather than treating all modules as interchangeable.

The selections for both Module Two and Module Three are: Clause 7 docking applies through its prescribed accession process; Clause 9(a), Option 2, uses general written authorization with at least fifteen days' advance notice; the optional independent dispute-resolution language in Clause 11 is not selected; Clause 17, Option 1, selects the law of Germany; and Clause 18 selects the courts of Germany, specifically Berlin, without restricting a data subject's right under Clause 18(c) to bring proceedings in the courts of their habitual-residence Member State. These law and court elections preserve the current DPA's elections and also work for Module Three; selecting Option 1 does not require the exporter to be established in Germany. The completed customer-specific Annexes I–III must identify the parties, processing, implemented security measures and agreed subprocessors and must be included in the accepted transfer package. The public template and provider overview do not complete these fields. The official clauses must be available with the exact accepted version, and override conflicting terms.

If the 2021/914 clauses are unavailable for a particular transfer or do not provide the required protection, the parties must establish the appropriate lawful safeguard before that transfer; naming these clauses alone is insufficient. Required transfer assessments and supplementary measures remain separate obligations.

UK transfers. Where required, the parties will incorporate the applicable approved UK Addendum to the EU SCCs, retaining its mandatory Part 2 clauses. Part 1 must contain the parties, date and contact details in Table 1; the identified EU SCC version, module and elections in Table 2; and completed appendix information in Table 3. Table 4 must record the permitted selection of parties entitled to end the Addendum when the approved form changes. The currently approved form/version and selected entries must be fixed with the agreement before use; a generic reference to the ICO is not a completed Addendum. The UK Addendum's required adaptations govern over inconsistent EU-law and court selections for UK restricted transfers.

Swiss transfers. Where required, document the recognized SCC adaptations for Swiss law, supervisory authority, jurisdiction and third-party rights without reducing EU rights where EU law also applies. The completed Swiss schedule must identify whether Swiss law alone or both Swiss and EU law govern the transfer, the FDPIC's role, relevant FADP/GDPR references, the selected contractual law and courts, and preservation of applicable rights of individuals habitually resident in Switzerland. Complete these entries using the FDPIC's official guidance and the actual transfer context; the reference alone does not complete the adaptations.

Service-provider overview — not the agreed subprocessor schedule

Provider use depends on the enabled Services. This overview identifies service families; it does not authorize an unlisted subprocessor, complete a customer-specific schedule or replace required change notice. The agreed schedule identifies the actual legal entities, processing countries and applicable safeguards.

Other feature-specific AI, sourcing or integration providers must be identified and classified in the applicable agreed schedule before processing Customer Personal Data on CVViZ’s behalf. A public information source or a customer-controlled integration is not automatically a CVViZ subprocessor. Retiring or replacing a provider does not remove obligations concerning any retained historical data.

For the applicable DPA and schedules, contact the Privacy Team at he***@***iz.com.