Effective date: 11 October 2026
Sree Priya, trading as Tike AI Ventures, Bengaluru, India. Contact: trust@tikeai.ventures
This Data Processing Addendum ("DPA") forms part of the Propel Resume Screener Terms and Conditions (the "Terms") between Sree Priya, a sole proprietor trading as Tike AI Ventures in India ("we", "us", the "Processor"), and the customer that uses Propel Resume Screener ("you", the "Customer"). It applies automatically whenever we process Customer Personal Data on your behalf, without needing a signature. If you need a countersigned copy, email us.
Data Protection Law means every law that applies to the processing of Customer Personal Data, including where applicable the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), India's Digital Personal Data Protection Act, 2023 and its rules ("DPDP Act"), the California Consumer Privacy Act ("CCPA") and the Australian Privacy Act 1988.
Customer Personal Data means personal data in the job descriptions, resumes and other content you upload to Propel Resume Screener, and in the criteria, scores, rankings and downloads produced from them, that we process on your behalf. It does not include your account, sign-in, purchase or support data, which we control as described in our Privacy Policy.
Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR. Under the DPDP Act, "controller" means Data Fiduciary, "processor" means Data Processor and "data subject" means Data Principal.
Subprocessor means a third party we engage to process Customer Personal Data.
SCCs means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).
You are the controller (Data Fiduciary) of Customer Personal Data, and we are your processor (Data Processor).
If you are a recruitment agency acting for a client employer, you may be a processor for that client. In that case we are your subprocessor, and you confirm that your instructions to us are authorised by your client.
Annex I describes the processing: its subject matter, nature, purpose and duration, and the types of personal data and data subjects.
Each party will comply with Data Protection Law. You are responsible for the lawfulness of the data and of your instructions, including having a legal basis, giving candidates the required notices (including about AI-assisted screening), carrying out any data protection impact assessment you need, and the accuracy of the data you upload.
We process Customer Personal Data only on your documented instructions. Your complete instructions are the Terms, this DPA, and your use of the app's features, such as uploading, scoring, downloading and deleting. Further instructions need our written agreement.
If a law requires us to process Customer Personal Data in another way, we will tell you before we do, unless that law forbids it.
We will tell you if, in our opinion, an instruction infringes Data Protection Law.
We do not use Customer Personal Data to train AI models, and our subprocessors are bound not to either.
Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality and has access only to the extent needed to run the service.
We implement and maintain the technical and organisational measures in Annex II. We may update them, provided the overall level of protection is not reduced.
You give general authorisation for us to use the subprocessors listed in Annex III.
Before we add or replace a subprocessor, we will update Annex III and email the address on your account at least 15 days before the new subprocessor processes any Customer Personal Data.
You may object on reasonable data protection grounds by emailing us within those 15 days. We will work with you in good faith to address the objection. If we cannot, you may stop using the affected feature or close your account.
We impose data protection obligations on each subprocessor by written contract that are no less protective than those in this DPA, and we remain responsible to you for their performance.
If we receive a request from a data subject about Customer Personal Data, we will pass it to you without undue delay and tell the requester to contact you. We will not respond to it ourselves unless you instruct us to.
The app lets you view, download and delete resumes and job profiles yourself. Where that is not enough, we will give you reasonable help to respond to requests.
We will give you the information about Propel Resume Screener that you reasonably need for a data protection impact assessment or a consultation with a supervisory authority, including this DPA, Annex II and our Privacy Policy.
We will notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting Customer Personal Data. We will send the notice to the email address on your account.
The notice will include, as far as we know it at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. We will add information as it becomes available.
We will investigate the breach, take reasonable steps to contain it and reduce its effects, and help you meet your own notification duties.
Notifying you of a breach is not an admission of fault.
You can download your results and delete resumes, job profiles or your whole account in the app at any time. That is how you obtain a copy of, and end processing of, Customer Personal Data.
When you delete them, we delete the Customer Personal Data from our live systems straight away. Copies in database backups and in recoverable file storage are deleted within 7 days, and server logs within 30 days. If a file cannot be removed at the time, for example during a storage outage, it is removed when the job profile or account is deleted, and in any case within 365 days of upload.
Usage records of past scoring runs are kept for billing and service records. The candidate's name and contact lines are erased when the resume or job profile is deleted.
When your account ends, we delete all Customer Personal Data in the same way, unless a law requires us to keep it.
On request, we will give you the information reasonably needed to show that we comply with this DPA: this DPA and Annex II, written answers to a reasonable security questionnaire (once every 12 months), and the certifications and audit reports of our subprocessors, such as Google Cloud's ISO 27001 certificate and SOC reports and TypeSafe's SOC 2 Type II report, subject to their confidentiality terms.
If that information is not enough to meet a specific requirement of Data Protection Law, or a supervisory authority requires it, you may audit our compliance with this DPA. Audits are at your cost, at most once every 12 months, with at least 30 days' notice, during business hours, remotely where possible, and carried out by you or an independent auditor bound by confidentiality. Audits are limited to the processing of Customer Personal Data and do not include access to other customers' data.
The parties agree that audits under clause 8.9 of the SCCs are carried out in accordance with this section.
We are based in India. We and our subprocessors process Customer Personal Data in India and in the United States, as described in Annex III.
For transfers of Customer Personal Data to us that are subject to the GDPR, the parties enter into Module 2 (controller to processor) of the SCCs. Where you are a processor for your client, they also enter into Module 3 (processor to processor). The SCCs are incorporated into this DPA by reference and completed as follows:
you are the data exporter and we are the data importer;
the optional docking clause in clause 7 applies;
under clause 9(a), option 2 (general written authorisation) applies, with the notice period set out in section 6 of this DPA;
the optional wording in clause 11(a) does not apply;
the competent supervisory authority is determined in accordance with clause 13;
under clause 17, option 1 applies and the SCCs are governed by the law of Ireland;
under clause 18(b), disputes are resolved by the courts of Ireland;
Annexes I, II and III of the SCCs are Annexes I, II and III of this DPA.
For transfers subject to the UK GDPR, the parties enter into the UK Addendum, which is incorporated by reference and completed as follows. In Table 1, the parties are as set out in Annex I. In Table 2, the Addendum EU SCCs are the SCCs as completed above. In Table 3, the Appendix Information is in Annexes I, II and III. In Table 4, both the importer and the exporter may end the UK Addendum as described in its section 19.
For transfers subject to the FADP, the SCCs apply as completed above, with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and data subjects habitually resident in Switzerland may bring claims before the courts of Switzerland.
Our subprocessors receive Customer Personal Data under the SCCs or another transfer mechanism recognised by Data Protection Law. If there is a conflict between the SCCs and this DPA or the Terms, the SCCs prevail.
We process Customer Personal Data as your Data Processor under this contract, as section 8(2) of the DPDP Act requires, and only for the purposes you specify through your use of the app.
We maintain reasonable security safeguards (Annex II) to prevent personal data breaches.
We erase Customer Personal Data when you instruct us to, as described in section 10.
We will tell you about any personal data breach as described in section 9, so you can inform the Data Protection Board of India and the affected Data Principals.
We will help you respond to Data Principals' requests to access, correct, complete, update or erase their data, and to their grievances.
For Customer Personal Data that is subject to the CCPA or a similar US state law, we act as your service provider or processor. We will not:
sell or share it, as those terms are defined in the CCPA;
keep, use or disclose it for any purpose other than providing Propel Resume Screener to you, or outside our direct business relationship with you;
combine it with personal data we receive from anyone else, except as the CCPA allows.
We will tell you if we can no longer meet these obligations. You may take reasonable steps to stop and remedy any unauthorised use of the data.
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited.
If there is a conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms.
This DPA applies for as long as we process Customer Personal Data. Apart from the SCCs, it is governed by the same law as the Terms.
We may update this DPA to reflect changes in Data Protection Law or in our services, as described in the Terms. Updates will not reduce the protection given to Customer Personal Data.
Data exporter: the Customer, with the name, company and contact email in its Propel Resume Screener account. Role: controller, or processor for its client employer. Activities: using Propel Resume Screener to screen candidates for jobs. The data exporter accepts this DPA and the SCCs by accepting the Terms.
Data importer: Sree Priya, sole proprietor trading as Tike AI Ventures, 3rd Floor Plot No. 7F, Raj Pinnacle, 6th Cross Phase 1, Doddanekundi Industrial Area, Bengaluru, Karnataka 560048, India. Contact: Sree Priya, trust@tikeai.ventures. Role: processor. Activities: providing Propel Resume Screener to the Customer. The data importer accepts this DPA and the SCCs by publishing it and providing the service.
Categories of data subjects: job candidates and applicants whose resumes the Customer uploads, and people named in job descriptions, such as hiring managers or contacts.
Categories of personal data: identity and contact details in resumes (such as name, email address, phone number, address and profile links); employment history, education, qualifications, skills, certifications, languages and anything else the resume contains; the content of job descriptions; file names; and data derived from these: criteria ratings, total scores, rankings and whether the resume meets the must-have criteria.
Sensitive data: not requested or used as criteria by design. Resumes may nevertheless contain special categories of data (for example health, religion, ethnic origin or sexual orientation) or data about criminal convictions, if candidates chose to include them. Safeguards: access is limited to the Customer's account and our authorised personnel; data is encrypted in transit and at rest; it is never used to train AI models; it is deleted on the Customer's instruction; the scoring instructions ask the AI to assess only the Customer's criteria; and the Terms forbid criteria based on protected characteristics.
Frequency of the transfer: continuous, for as long as the Customer uses Propel Resume Screener.
Nature of the processing: storing uploaded files; extracting their text; detecting duplicates; sending job descriptions to an AI model to suggest criteria; sending job descriptions, resume text and criteria to an AI model for scoring; calculating scores and rankings; generating downloads; and deleting data.
Purpose: to provide Propel Resume Screener to the Customer, which helps the Customer screen and rank job candidates against the criteria for a job.
Retention: until the Customer deletes the resume, job profile or account. The exception is the original uploaded files, which are also deleted automatically 365 days after upload; the extracted text, criteria, scores and rankings are not affected. Deleted files can be recovered by our administrators for up to 7 days, database backups are kept for up to 7 days, and server logs for up to 30 days. Usage records of scoring runs are kept with the candidate's name and contact lines erased.
Transfers to subprocessors: as described in Annex III, for the same subject matter and nature as above, and for as long as needed to provide the service.
Determined in accordance with clause 13 of the SCCs.
Encryption in transit: all traffic between the app and our servers, and between our servers and our subprocessors, uses HTTPS (TLS).
Encryption at rest: the database, uploaded files and backups are stored on Google Cloud, which encrypts stored data by default.
Customer access control: users sign in with Google or Apple through Firebase Authentication. Every request to our servers must carry a valid, verified sign-in token, and each Customer can access only the data in its own account.
Operator access control: access to production systems is limited to our authorised personnel, using individual accounts protected by multi-factor authentication, with only the permissions they need.
Credentials: we do not store user passwords. Service credentials and API keys are kept in server configuration, not in source code.
Data minimisation: only the text of uploaded files is extracted and used. Images in files are ignored. Resumes are sent only to the AI models that score them: TypeSafe's and, where we use it to score resumes, Anthropic's. Only job descriptions are sent to suggest criteria.
Deletion: data is deleted from live systems as soon as the Customer deletes it in the app. The candidate's name and contact lines are erased in usage records. Backups and recoverable file copies expire after 7 days and server logs after 30 days.
Availability and recovery: the managed database on Google Cloud takes automated backups, kept for 7 days.
Logging and monitoring: server logs record requests and errors and are kept for 30 days. Crash reports from the app help us find and fix faults.
Subprocessor management: we use providers that hold recognised security certifications (Google Cloud: ISO 27001 and SOC 2; TypeSafe: SOC 2 Type II). Each is bound by data protection terms, and none trains AI models on the data.
Incident response: we assess, contain and investigate suspected breaches, and notify Customers within 72 hours of becoming aware of one that affects their data.
Personnel: everyone with access to Customer Personal Data is bound by confidentiality.
Google LLC (Google Cloud Platform). Hosting, database, file storage and logs. Processes all Customer Personal Data. Location: United States (Iowa).
TypeSafe AI, Inc. Scoring resumes against the criteria with its Jev AI model. Processes job description text, resume text (including candidates' contact details) and criteria. Location: United States. TypeSafe's own subprocessors are listed at trust.typesafe.ai/subprocessors.
Anthropic, PBC. Suggesting criteria from a job description with its Claude AI model, and, where we use it for scoring, scoring resumes. Processes job description text and, for scoring, resume text (including candidates' contact details) and criteria. Location: United States.
Our other providers, Firebase Authentication, Crashlytics and Analytics (Google) and RevenueCat, process only account, sign-in, crash, usage analytics and purchase data that we control, not Customer Personal Data. They are described in our Privacy Policy.
Related: Terms and Conditions ยท Privacy Policy