ECRU
RECRU

Data Processing Agreement (DPA)

Last updated: 16 April 2026

1. Parties

This Data Processing Agreement (hereinafter, the "DPA") is entered into between COSMIC TOMORROW (trading as RECRU), Tax ID 519123069, with address at R. Alfredo Allen n.º 455-461, 4200-135 Porto, Portugal (hereinafter, the "Processor"), and the client contracting the services of the RECRU platform (hereinafter, the "Controller").

2. Subject matter

This DPA governs the processing of personal data that the Processor carries out on behalf of the Controller in the context of providing the recruiting automation service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

3. Nature and purpose of the processing

The Processor will process the data solely to provide the contracted services: storage, organisation and automation of recruitment processes managed by the Controller.

4. Type of personal data

Candidate data entered by the Controller: first name, last name, email address, phone number, CV, assessment notes and any other data the Controller chooses to include in the platform.

5. Categories of data subjects

Candidates for job positions managed by the Controller.

6. Processor obligations

The Processor undertakes to:

  • Process the data solely on documented instructions from the Controller.
  • Ensure that persons authorised to process the data have committed to confidentiality.
  • Apply appropriate technical and organisational security measures in accordance with Article 32 of the GDPR (TLS encryption in transit, encryption at rest, per-tenant access control, audit logs).
  • Assist the Controller in complying with obligations relating to data subject rights (access, erasure, portability, restriction).
  • Delete or return all personal data to the Controller once the services have ended, within a maximum of 30 days.
  • Make available to the Controller all information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR.

7. Sub-processors

The Processor may subcontract the following services, which act as sub-processors:

  • Supabase Inc. — Database infrastructure, authentication and file storage (servers in the EEA)
  • Twilio Inc. (SendGrid) — Sending transactional email communications (USA, under Standard Contractual Clauses)
  • Resend Inc. — Sending screening emails (USA, under Standard Contractual Clauses)
  • Deepgram Inc. — Real-time voice transcription during interviews (USA, under Standard Contractual Clauses)
  • Google LLC (Gemini) — Artificial intelligence features: document generation, CV analysis, automated reports (USA, under Standard Contractual Clauses)

The Processor will notify the Controller at least 30 days in advance of any change of sub-processors, giving the Controller the opportunity to object.

8. International transfers

Data transfers to sub-processors located outside the EEA (specifically SendGrid/Twilio in the USA) are carried out under the Standard Contractual Clauses approved by the European Commission through Implementing Decision (EU) 2021/914.

9. Term

This DPA remains in force for the duration of the services agreement between the parties. Its termination entails the data deletion obligation described in section 6.

10. Contact

For any matter relating to this DPA: privacy@recru-app.com