Heroify Data Processing Agreement (DPA)

Effective from 9 October 2026 (for Clients who created an Account earlier: from 24 October 2026).

How this DPA works

The DPA forms an integral part of the Platform Terms and Conditions. It is accepted together with the Terms and Conditions when the Account is created, and its acceptance is a condition of using the Platform; the version of the DPA in force on the day the Account is created applies, subject to later amendments introduced in accordance with Section 13. The DPA forms an integral part of the agreement between Heroify and the Client.

Heroify offers an individually negotiated DPA to Subscription Clients on the terms set out in the Pricing and Billing Rules (contact: gdpr@heroify.co). Individual provisions agreed in writing take precedence over this DPA and are not subject to amendment in accordance with Section 13.

This Data Processing Agreement (hereinafter: the DPA) is concluded between the Client using the Heroify platform (hereinafter: the Controller) and Heroify sp. z o.o. with its registered office in Warsaw, ul. Padewska 23/7, 00-777 Warsaw, Poland, KRS 0000903229, NIP 5213930518, REGON 389112980, share capital 35,500.00 PLN (hereinafter: the Processor or Heroify), and governs the processing of personal data of Candidates/Participants to the extent that Heroify processes such data on behalf of the Controller in accordance with Article 28 GDPR.

1. Definitions

Controller: the Client using the Platform who determines the purposes and means of processing the data of Candidates/Participants in its recruitment or employee assessment processes, including processes conducted on behalf of its own clients.
Processor / Heroify: Heroify sp. z o.o., which processes the data of Candidates/Participants on behalf of and in accordance with the documented instructions of the Controller.
Candidate/Participant: an adult natural person whose data are processed through the Platform: a candidate in a recruitment process or an employee undergoing assessment.
Personal data: information relating to Candidates/Participants processed by Heroify on behalf of the Controller, as specified in Annex 1.
Platform: the Heroify web application available at www.heroify.co.
Sub-processor: a third party to which Heroify entrusts the processing of personal data for the purpose of providing services to the Controller, as specified in the List of Sub-processors.
List of Sub-processors: the list constituting Annex 2, made available to the Controller on request (gdpr@heroify.co) and sent with every change in accordance with Section 5, which states the name, purpose, scope of data, processing location and transfer basis of each Sub-processor.
AI System: the elements of the Platform that use artificial intelligence, including language models, described in the AI Transparency Note (summary information: https://heroify.co/ai; the full version is made available to the Controller on request: contact@heroify.co).
Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data (Article 4(12) GDPR).
GDPR: Regulation (EU) 2016/679. AI Act: Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.

2. Subject matter and scope of the entrustment

2.1 The Controller entrusts Heroify with the processing of the data of Candidates/Participants to the extent necessary to provide the Platform services: creating and conducting Assessments, collecting responses, calculating and presenting results, generating reports and summaries using the AI System, communicating with Candidates/Participants, and exporting data to and integrating with systems designated by the Controller.

2.2 A detailed description of the subject matter, nature, purpose and duration of the processing, the categories of data subjects and the categories of data is set out in Annex 1.

2.3 Heroify processes data only on documented instructions from the Controller. The following in particular are deemed to be instructions: the configuration of the Account and Assessments, making an Assessment available to Candidates/Participants, invoking Platform functions (including generating an AI summary, export and integrations) and other actions taken by the Controller or its Users through the Platform. Standard operation of the Platform in accordance with the Terms and Conditions and this DPA carries out the Controller's instruction. Heroify is responsible for the security of the Platform and its default settings (Article 32 GDPR) and for processing within the limits of this DPA; the Controller is responsible for the lawfulness of the purposes and legal bases of processing.

2.4 If Heroify is required to process data under Union or Member State law, it shall inform the Controller of that requirement before processing, unless that law prohibits such information.

2.5 Heroify performs certain Platform functionalities as an independent controller: verification of the contact channel of Candidates/Participants (one-time e-mail/SMS codes) and integrity mechanisms, the candidate profile, the building of statistical norms, psychometric quality analyses of the tools and the improvement of integrity mechanisms, carried out on pseudonymized or aggregated data. The scope, legal bases and periods of this processing are described in the Privacy Policy for Candidates/Participants (https://heroify.co/privacy-policy-candidates) and in Annex 1, Part B. This processing does not go beyond the purposes stated there.

2.6 The Controller configures the method of verifying the contact channel of Candidates/Participants (e-mail code, SMS code or both). With SMS verification, the telephone number of the Candidate/Participant is processed on behalf of the Controller as contact data visible to its Users (Annex 1A) and, in parallel, by Heroify as a controller for the purposes of the verification itself (Annex 1B).

2.7 Making a feedback report available to the Candidate/Participant (general information on the level of results, without detailed numerical scores, notes or statuses) after completion of the Assessment is a permanent function of the Platform. By accepting the DPA, the Controller instructs Heroify to perform this activity on its behalf. Heroify also makes a copy of the feedback report available to the Candidate/Participant in an individual candidate profile, which Heroify manages as an independent controller under the Privacy Policy for Candidates/Participants. The profile contains only feedback reports intended for the Candidate/Participant; it does not contain the Controller's notes, statuses or evaluations, it is not accessible to other Heroify clients or to the Controller, and it is closed at the request of the Candidate/Participant or at the latest after 12 months of inactivity (closure ends the processing for the purposes of the profile and does not cover data processed on behalf of the Controller).

2.8 The Controller may export results and share them with its clients or other recipients, and transfer them to its own systems (ATS). This is processing carried out by the Controller on its own responsibility and does not constitute a breach of the DPA. The providers of systems designated by the Controller are not Sub-processors of Heroify.

2.9 If the Controller acts as a processor on behalf of its own client, Heroify acts as a further processor (sub-processor), and the Controller represents that it holds its client's authorization for further entrustment and that it will ensure that the information required by Article 28 GDPR is provided to that client.

2.10 The Controller acknowledges and does not object that Heroify, as an independent controller, uses Candidates'/Participants' test scores, answers to closed questions, response times and browser window events (without name, surname, e-mail or phone number, with the metadata: test, language, job level, quarter) to build statistical norms (percentiles), conduct psychometric quality analyses of the tools and improve integrity mechanisms, in the manner, on the basis and for the period described in Annex 1, Part B and the Privacy Policy for Candidates/Participants. Published norms contain aggregated data only, with no identifiers or links to the Candidate/Participant, Assessment or Controller. The legal basis for this processing towards Candidates/Participants is Heroify's legitimate interest, not the Controller's consent; a Candidate/Participant may object directly to Heroify.

3. Obligations of Heroify as Processor

Heroify undertakes to:

process data only in accordance with the documented instructions of the Controller and for the purposes set out in Annex 1, unless the processing is required by Union or Member State law;
ensure that persons authorized to process the data have committed themselves to confidentiality and have received data protection training;
implement and maintain security measures in accordance with Article 32 GDPR, as described in Section 4;
comply with the conditions for engaging Sub-processors set out in Section 5;
assist the Controller, taking into account the nature of the processing, in responding to requests from data subjects (Chapter III GDPR), in accordance with Section 10;
assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to Heroify;
make available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allow for audits in accordance with Section 7;
immediately inform the Controller if, in Heroify's opinion, an instruction infringes the GDPR or other data protection provisions;
upon completion of the provision of services, delete or return the data in accordance with Section 9.

4. Technical and organizational security measures

4.1 Heroify has implemented and maintains technical and organizational measures appropriate to the risk, including at least: application and database infrastructure in data centers located in the European Union (processing by Sub-processors is specified in the List); encryption of data in transit and at rest; role-based access control and logical separation of the data of individual Controllers; verification of the contact channel of Candidates/Participants with a one-time code and protection against automated traffic; pseudonymization of data transmitted to the language model provider and exclusion of their use for model training; backups with a defined retention period; logging of access to data; personnel access limited to what is necessary, based on authorizations and confidentiality undertakings; incident management procedures.

4.2 Heroify may update the security measures, provided that this does not lower the overall level of protection. At the Controller's request, Heroify makes available a current description of the measures.

5. Sub-processors

5.1 The Controller grants Heroify a general authorization to engage the Sub-processors specified in the List of Sub-processors. Heroify engages only Sub-processors that provide sufficient guarantees to implement the measures under Article 32 GDPR and imposes on them, by way of a contract, data protection obligations at least equivalent to the obligations under this DPA. For each Sub-processor, the List states the name, purpose, scope of data, processing location and transfer basis.

5.2 Heroify notifies the Controller of any intended addition or replacement of a Sub-processor processing the data of Candidates/Participants by e-mail to the address associated with the Account at least 14 days before the change, stating the purpose, scope of data, location and transfer basis. Where replacing a Sub-processor is necessary for security reasons or to maintain continuity of service (in particular a failure, a security breach or discontinuation of services by the existing Sub-processor), Heroify may make the replacement without the 14-day notice, informing the Controller without undue delay and no later than 5 business days after the replacement; the objection period under clause 5.3 then runs from that notification.

5.3 Within 14 days of the notification, the Controller may raise a reasoned objection based on specific, documented grounds relating to data protection.

5.4 Heroify responds to an objection meeting the conditions of clause 5.3 within 14 days of receipt and, where possible, proposes a solution, for example the Controller refraining from using a feature triggered on a User's request (such as the AI summary) or Heroify disabling such a feature for the Controller. If the Parties do not agree on a solution within 30 days of the objection, the Controller may terminate the agreement with 30 days' notice, with the right to export data under Section 9. An objection not meeting the conditions of clause 5.3 (in particular one not based on data protection grounds) does not suspend the change and does not entitle the Controller to terminate on that basis; Heroify explains a rejected objection to the Controller by e-mail.

5.5 Heroify remains fully liable to the Controller for the performance of the Sub-processors' obligations.

5.6 To generate summaries of results, Heroify uses the language model provider specified in the List, transmitting only pseudonymized data within the scope described in the List (without identification data and without the content of the Candidate's/Participant's responses). Heroify contractually ensures that these data are not used to train the provider's models. The Controller is responsible for not entering personal data of third parties into the job description.

6. Personal data breaches

6.1 Heroify notifies the Controller of a Personal data breach concerning data processed on its behalf without undue delay after becoming aware of it, where feasible no later than within 72 hours. The absence of complete information does not delay the initial notification.

6.2 The notification contains at least: a description of the nature of the breach, the categories and approximate number of data subjects and records, the contact details of the person providing information, the likely consequences, and the remedial measures taken or proposed. Information not available at the time of the initial notification is provided by Heroify in phases, without undue delay.

6.3 Heroify supports the Controller in complying with the obligations under Articles 33 and 34 GDPR by providing the information it holds about the breach.

6.4 The notification is sent to the e-mail address designated by the Controller for data protection matters (notified to gdpr@heroify.co or in the Account settings, if the Platform allows this) and, in its absence, to the address of the Account administrator. The Controller is responsible for keeping these details up to date.

6.5 Heroify documents breaches in accordance with Article 33(5) GDPR.

7. Audits and inspections

7.1 Heroify makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, including this DPA, the List of Sub-processors and a description of the security measures.

7.2 Compliance is verified in the first instance in documentary form: on the Controller's written request, Heroify provides within 30 days the information and documents referred to in clause 7.1 and answers the Controller's questions concerning the processing of its data. If the documentary procedure does not allow compliance with Article 28 GDPR to be demonstrated, the Controller may, no more than once per calendar year, conduct an audit or inspection itself or through an authorized external auditor bound by confidentiality, after agreeing the scope and date with at least 30 days' notice, at its own cost (including the cost of Heroify staff involvement at rates agreed before the audit), in a manner that does not disrupt Heroify's normal operations or the rights of other clients; the audit does not include access to other clients' data. The frequency limit and the 30-day notice do not apply to an audit required by a supervisory authority or to an audit following a Personal data breach concerning the Controller's data.

7.3 The Parties may agree that the audit will be replaced by making available current reports from independent security tests or certificates, if Heroify holds them.

8. Transfers of data outside the EEA

8.1 The main infrastructure of the Platform (application and databases) is located on servers in the European Union. Processing by Sub-processors, including outside the EEA, takes place within the scope and on the bases specified in the List of Sub-processors.

8.2 If a Sub-processor processes data outside the EEA, Heroify bases the transfer on a European Commission adequacy decision (Article 45 GDPR, including the EU-US Data Privacy Framework for certified Sub-processors from the USA) or on Standard Contractual Clauses approved by the Commission (Article 46 GDPR) together with a transfer impact assessment. Heroify makes copies of the safeguards applied available to the Controller on request. The transfer basis for each Sub-processor is specified in the List.

8.3 Heroify does not transfer data to third countries without the safeguards referred to in clause 8.2.

8.4 If the Controller is established outside the EEA, the processing takes place on servers in the EU, and making the data available to the Controller constitutes a transfer to a third country. If the country in which the Controller is established is not covered by a European Commission adequacy decision (in the case of the USA: if the Controller does not hold an active certification under the EU-US Data Privacy Framework), upon acceptance of the DPA the Parties conclude the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914, Module Four (processor to controller), which constitute Annex 3 to this DPA, with Heroify as the data exporter and the Controller as the data importer; Annex 1, Part A constitutes Annex I to the clauses, and Section 4 constitutes Annex II. If the Controller instructs the transfer of data to an ATS system located outside the EEA, the Parties determine, before the integration is launched, the role of the recipient (the Controller's processor or a separate controller) and the appropriate transfer basis; Heroify does not launch the integration until the basis has been determined.

9. Duration of processing, deletion and return of data

9.1 During the term of the agreement, Heroify retains Assessment data (responses, results, reports, AI summaries, notes and statuses) until they are deleted by the Controller or until the agreement ends. Heroify may delete the data of an Assessment that expired more than 24 months earlier, after giving the Controller 30 days' notice by e-mail and enabling export. The Controller may at any time instruct the deletion of the data of an individual Candidate/Participant or of an entire Assessment by writing to gdpr@heroify.co; Heroify carries out such an instruction without undue delay, so that the Controller can meet the time limits arising from the GDPR. Self-service deletion and archiving functions are available to the extent provided on the Platform; archiving, where available, does not extend the retention period.

9.2 The end of the agreement means the closure of the Account by the Controller, termination of the service agreement (by notice or otherwise), or the closure of the Account by Heroify after 24 months of inactivity in accordance with the Terms and Conditions (§ 4.12), announced twice by e-mail. The expiry of an Assessment, the depletion of the unit balance or the end of a Subscription does not end the agreement. After the end of the agreement, Heroify retains the data for 30 days (export window). In the case of a change of provider (§ 4.14 of the Terms and Conditions), the export window lasts at least 30 days from the end of the agreed transition period, regardless of the earlier expiry of the agreement; if the migration has not been completed within the transition period, Heroify does not delete the data until the Controller decides on an extension or on ending the arrangement in accordance with § 4.14 of the Terms and Conditions. During the export window, Heroify enables export at the Controller's request submitted within that period, in CSV or another commonly used machine-readable format.

9.3 Within 90 days after the end of the export window, Heroify deletes the data processed on behalf of the Controller and its copies, including backups, with the exception of data whose retention is required by law and data covered by a specific dispute, complaint or authority proceeding concerning those data, on the Controller's instruction or to the extent that Heroify has its own legal obligation to retain them (until the matter is concluded). Heroify does not restore previously deleted data from backups for production use. The Controller may instruct the deletion of data before the end of the export window; in that case Heroify deletes them immediately and the export window expires.

9.4 Deletion of Assessment data does not cover the data under Annex 1, Part B, item 3, which Heroify retains for the period stated there, without the Assessment or Controller identifier. After that period, Heroify retains anonymized data only: aggregated cohort statistics (count, score distribution for a given test, language, job level and quarter) and statistics at the level of test items and their interrelations, with no individual record and no possibility of reconstruction. Data of persons whose objection has been upheld is not included in this dataset or in the aggregates. Percentile norms for a test are made available only once the comparison population is large enough that an individual score cannot be inferred from a percentile; Heroify decides on releasing norms for a test together with a psychometrician.

9.5 The deletion of a Candidate's/Participant's data on the Controller's instruction covers the data processed on behalf of the Controller. The copy of feedback reports in the candidate profile and the data referred to in Annex 1, Part B are subject to the rules of the Privacy Policy for Candidates/Participants and are deleted at the request of the Candidate/Participant addressed to Heroify or after the periods stated there have elapsed.

9.6 At the Controller's request, Heroify confirms that the deletion has been carried out.

10. Exercise of data subject rights

10.1 The Controller is responsible for enabling Candidates/Participants to exercise their rights under the GDPR with respect to data processed on its behalf.

10.2 Where Heroify receives a request directly from a Candidate/Participant concerning data processed on behalf of the Controller, it forwards the request to the Controller without undue delay and informs the data subject accordingly; it does not respond on behalf of the Controller without the Controller's authorization.

10.3 Heroify provides the Controller with technical assistance in the exercise of rights, in particular by: exporting a Candidate's/Participant's data, deleting the data of an individual Candidate/Participant on instruction (Section 9.1), providing insight into the factors taken into account in the result (for the purpose of explaining the role of the AI System), and making the feedback report available to the Candidate/Participant.

10.4 Requests concerning data for which Heroify is an independent controller are handled by Heroify itself, and Heroify informs the Controller of this if the request also concerns the Controller's process.

11. Cooperation under the AI Act

11.1 Heroify is the provider and the Controller is the deployer of the AI System within the meaning of the AI Act. The rules for using the AI System, its limitations and the obligations of the deployer are described in the AI Transparency Note, made available to the Controller on request (contact@heroify.co); § 6 of the Terms and Conditions sets out the Controller's obligations in this regard.

11.2 With respect to data protection, Heroify: does not use the data of Candidates/Participants to train models; informs the Controller of material changes to the AI System affecting the processing of data; at the Controller's request, provides a description of the factors taken into account in the result, needed to give the Candidate/Participant an explanation of the role of the AI System in the decision.

11.3 The Controller does not configure its own systems (including ATS) so that they automatically reject Candidates/Participants on the basis of a score, ranking or trust indicator without human review.

12. Liability

12.1 Each Party is liable to data subjects for damage caused by processing that infringes the GDPR to the extent that it is responsible for such damage (Article 82 GDPR). The provisions of this Section govern only the settlement between the Parties and do not limit the rights of data subjects or the powers of the supervisory authority.

12.2 Heroify is exempt from liability towards the Controller if it is not at fault for the damage or acted in accordance with the Controller's instructions (in particular where the damage results from a configuration made by the Controller, content entered by its Users or the manner in which the results were used), subject to any liability that cannot be excluded under mandatory provisions of law. This exemption does not cover Heroify's responsibility for the security of the Platform and its default settings (Article 32 GDPR) or for processing outside the limits of this DPA.

12.3 Heroify's total liability towards the Controller under this DPA, except for damage caused intentionally and liability arising from processing by Heroify outside the scope of or contrary to the Controller's instructions, is limited to the total fees paid by the Controller in the 12 months preceding the event giving rise to the damage. The Parties may agree a different limit in the Service Agreement.

13. Amendments to the DPA

13.1 Heroify may amend the DPA for important reasons: changes in legal provisions or in the guidelines of supervisory authorities; changes to the List of Sub-processors (in accordance with Section 5); changes to Platform functions affecting the processing of data; and also to the extent that the amendment does not lower the level of data protection or the rights of the Controller.

13.2 Heroify notifies the Controller of each amendment by e-mail at least 14 days before it takes effect, stating the scope of the changes.

13.3 Continued use of the Platform after the change enters into force constitutes acceptance. A Controller who does not accept the change may terminate the agreement before it enters into force, with the right to export data under Section 9. A subsequent purchase by the Controller is governed by the DPA version applicable to its Account under this Section; the purchase itself does not replace the notification and objection procedure and does not override an individually negotiated DPA.

13.4 Provisions individually agreed in writing are not subject to amendment in accordance with this Section.

14. Cooperation with the supervisory authority

14.1 In the event of a complaint or proceedings of a supervisory authority concerning the data of Candidates/Participants, the Parties inform each other and cooperate in order to clarify the matter.

15. Final provisions

15.1 The DPA is governed by Polish law and is interpreted in accordance with the GDPR. In the event of a discrepancy with the English version, the Polish version prevails.

15.2 In matters not regulated herein, the Platform Terms and Conditions (https://heroify.co/terms) and the Service Agreement, if concluded, apply.

15.3 In the event of a conflict between the DPA and the Terms and Conditions, the DPA takes precedence in data protection matters. The provisions of the Service Agreement or of an individually agreed DPA take precedence over this DPA.

15.4 The DPA remains in force for the term of the service agreement and, with respect to Section 9, until the data have been deleted or returned.

15.5 The Parties will endeavor to resolve disputes amicably; failing agreement, the court having jurisdiction over Heroify's registered office is competent.

15.6 The invalidity of one provision does not affect the validity of the remaining provisions.

15.7 Contact for DPA matters: gdpr@heroify.co.

ANNEX 1: Description of the processing

Subject matter: provision of the Platform services: creating and conducting Assessments that evaluate the competencies, abilities, fit and attitude of Candidates/Participants.

Nature of the processing: collection, recording, organization, storage, calculation of results, automated analysis of results using a language model in order to generate a summary supporting the User, presentation, disclosure within the Platform and on the Controller's instruction (export, ATS), restriction, deletion. Exclusively by electronic means, through the Platform.

Purpose: conducting the Assessments commissioned by the Controller, presenting the results to the Controller and its Users, making the results available to Candidates/Participants on the Controller's instruction, and enabling the exercise of data subject rights.

Duration: for the term of the agreement, until the data are deleted by the Controller; the export window and the deletion deadline after the end of the agreement, as well as Heroify's right to delete the data of Assessments that expired more than 24 months earlier, are set out in Section 9.

Categories of data subjects: candidates taking part in recruitment processes conducted by the Controller, including on behalf of the Controller's clients; employees and contractors of the Controller undergoing assessments. Adults only.

Categories of data:

Identification and contact data: first name, surname, e-mail address, telephone number (with SMS verification); the candidate's identifier in the Controller's ATS system, if integrated.
Responses: responses to closed questions (tests), responses to open questions, attachments.
Results: test and scale scores, overall score, percentiles, competency reports, the summary generated by the AI System, statuses and notes assigned by the Controller's Users, the trust indicator label (high/medium/low) together with a general explanation of what it is based on, made available to Users in the report and stored like the report.
Communication data: the content and delivery status of e-mail messages sent to Candidates/Participants on behalf of the Controller.

Special categories of data (Articles 9 and 10 GDPR): the Controller does not instruct Heroify to intentionally collect special categories of data or data relating to criminal convictions and offences, and does not formulate open questions aimed at obtaining them. If a Candidate/Participant discloses such data on their own initiative in an open response or attachment, Heroify stores them solely as part of the response on behalf of the Controller, does not use them to calculate results, does not transmit them to the language model provider (the content of responses is not transmitted) and does not allow searching by them. Once such a disclosure has been identified (by a User of the Controller or by Heroify), Heroify, on the Controller's instruction, restricts access to the response or attachment concerned to the persons who need it, and if Heroify identifies the disclosure itself, it informs the Controller and asks for instructions. The Controller is responsible for assessing the basis for further processing and may instruct the deletion or redaction of the indicated fragment, file or entire response; Heroify carries out the instruction without undue delay. Heroify does not perform automated detection of such content. Data relating to criminal convictions and offences (Article 10 GDPR) are treated under the same rules, separately from data under Article 9.

Part B. Data processed by Heroify as an independent controller (for information)

Beyond the entrustment, Heroify processes as an independent controller, on the basis of Article 6(1)(f) GDPR and after carrying out a balancing test: (1) contact channel verification data (use of the telephone number to send the code with SMS verification, records of codes sent) and technical session data used to calculate the trust indicator (IP address, device and browser type), for 6 months from the end of the session; the indicator itself, together with its general explanation, once calculated becomes part of the report processed on behalf of the Controller (Part A); (2) the candidate profile (identification data, login data, copy of feedback reports), until the profile is closed or for 12 months from the last login (from creation, if the candidate has never logged in); (3) test and scale scores, answers to closed questions, response times and browser window events, without identifying data and without the Assessment or Controller identifier, with the metadata test, language, job level and quarter, for the purposes of statistical norms, psychometric quality analyses of the tools and improvement of integrity mechanisms (including with the analytics tool provider specified in the List), for 36 months from the end of the test session, regardless of earlier deletion of Assessment data by the Controller; after that period, anonymized data only as referred to in clause 9.4. An objection by a Candidate/Participant accepted by Heroify excludes their data from the norms and analyses. Details: the Privacy Policy for Candidates/Participants. Heroify does not use these data for any other purposes, in particular not to evaluate Candidates/Participants on behalf of other clients or for marketing purposes.

ANNEX 2: List of Sub-processors

The List of Sub-processors in the version of 9 October 2026 constitutes Annex 2 to this version of the DPA. Heroify makes it available to the Controller on request (gdpr@heroify.co), sends it with every change and notifies changes in accordance with Section 5.

ANNEX 3: Standard Contractual Clauses, Module Four

The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Four (transfer from processor to controller), as published in the Official Journal of the EU, are incorporated into the DPA by reference and apply in the cases specified in clause 8.4. Optional choices: Clause 7 (docking clause) applies; Clause 11(a): the option of an independent dispute resolution body does not apply; Clause 17: Polish law; Clause 18: Polish courts. Annex I.A (parties): Heroify sp. z o.o. as data exporter, the Controller as data importer, with the details from the Account. Annex I.B (description of the transfer): Annex 1, Part A. Annex II (technical and organizational measures): Section 4 of the DPA. Full text of the clauses: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.