Personal Information Processing Addendum

The Client Organization determines the purposes for which Candidates’ personal information is collected and used. It is the enterprise collecting that information within the meaning of the Act and remains accountable to the persons concerned.

Sam7 acts exclusively on the Client Organization’s behalf and on its documented instructions, as a service provider, for the sole purposes of hosting, processing, securing, and making the Service available.

Categories of persons — candidates, authorized users of the Client Organization.

Categories of information — identity and contact details, resume content, background and skills, recruiting notes, application status, AI-assisted analysis results.

Operations — collection through public posting pages, hosting, structuring, assisted analysis, making available, export, deletion.

Duration — the term of the contract, plus the return and purge periods provided for in the Terms.

Process the information only on the Client Organization’s instructions and for the agreed purposes · retain, use, or communicate the information for no other purpose, in particular commercial purposes or model training · ensure confidentiality through written undertakings from authorized personnel · implement the security measures described in the Privacy Policy · assist the Client Organization in handling requests from persons concerned and in its obligations in the event of an incident · delete or return the information at the end of the contract.

We use the categories of providers listed in the Privacy Policy. Each is bound by obligations at least equivalent to those in this addendum.

Any change of provider category likely to affect the protection of the information is notified to the Client Organization at least thirty (30) days in advance, with the ability to object and, failing a solution, to terminate the relevant portion of the contract at no cost.

We carry out a privacy impact assessment before any communication outside Québec, in accordance with section 17 of the Act, and proceed only if protection remains adequate. The findings of that assessment are available to the Client Organization on reasoned request, so that it can meet its own obligations.

We notify the Client Organization without undue delay and no later than seventy-two (72) hours after becoming aware of an incident affecting its information, providing the elements needed to assess the risk and to make its own notifications.

We assist it in assessing the risk of serious injury, maintaining its register and, where applicable, notifying the Commission d’accès à l’information and the persons concerned.

On reasonable written request and at most once per twelve (12) month period — except in the event of an incident or a requirement from an authority — we provide the Client Organization with documentation demonstrating compliance with this addendum: description of security measures, summary of relevant assessments, responses to a due-diligence questionnaire.

At the end of the contract, the Client Organization has the retrieval periods provided for in the Terms of Use. Upon their expiry, the information is deleted from our production systems, then purged from backups on a cycle not exceeding thirty-five (35) days, unless a legal retention obligation applies.