This Data Processing Addendum (“DPA”) is part of the Jo Master Services Agreement (“MSA”) between JCH Communications Inc. (“Jo”) and the Customer. Jo is a brand of JCH Communications Inc. It applies to personal information handled in connection with employer, hiring manager and Candidate recruitment workflows. Capitalised terms not defined here have the meaning given in the MSA.
| Data | What it is | Jo’s role | Customer’s role |
|---|---|---|---|
| Referral Data | Name, contact details and any other information Customer gives Jo about an individual it refers | Service provider (processor) for Customer, to invite the individual to Jo and administer the Referral and Exclusivity Period | Controller (business) |
| Customer Content and user data | Job descriptions (including pay ranges, location and work arrangements), company culture information, hiring managers’ voice conversations with Jo’s AI agents and their transcripts, and Authorized Users’ and hiring managers’ names, work emails and roles | Service provider (processor) for Customer, to provide the Service. Jo is separately responsible for its own account, security and billing records | Controller (business) |
| Candidate Profile Data | Information Candidates give Jo, and the profiles Jo builds | Independent controller: Jo has the relationship with the Candidate and obtains the Candidate’s consent | None, except for Candidate Information after Unlock |
| Candidate Information after Unlock | The copy of a Candidate’s briefing that Customer receives | Independent controller of the original | Independent controller of its copy |
When an individual referred by Customer creates a Jo account, Jo holds that individual’s information as controller. Jo may keep a record of the Referral, its date and the Referring Customer to administer the Exclusivity Period. Jo will delete Referral Data about individuals who do not join Jo within 90 days.
For Customer Personal Information, Jo will:
This section applies to Customer Personal Information that is subject to the CCPA or another US state privacy law. Customer discloses it to Jo only for the limited and specified business purposes in section 3. Jo:
Jo certifies that it understands and will comply with these restrictions.
Jo. Jo is an independent controller of Candidate Profile Data. Jo is responsible for giving Candidates notice and obtaining their consent for voice recording, for availability to employers and for automated screening, and for handling Candidates’ requests made to Jo, as set out in Jo’s Privacy Policy and Terms.
Customer. Customer is an independent controller of the Candidate Information it receives on Unlock. Customer is responsible for its own notices to Candidates, its lawful use of the information under section 4 of the MSA, its retention and security of its copy, and its responses to Candidates’ requests about its copy. On first contact, Customer will tell the Candidate who it is, why it is contacting them, and that it received their information through Jo.
No processing for each other. The parties do not intend to act as joint controllers or as each other’s processors for this information, and each will comply with the Privacy Laws that apply to it.
Requests. Jo handles requests made to it about Candidate Profile Data and Customer Personal Information. If Customer receives a request about information Jo holds, it will pass it to Jo within five business days and will respond itself to requests about its own copy of Candidate Information.
Notices. Jo may tell a Customer that has Unlocked a Candidate when the Candidate has asked for erasure or for no further contact. Customer will act on the notice as section 4 of the MSA requires.
Blocking. At a Candidate’s request (configured in the Service under Settings → Blocked Employers & Domains or requested at [email protected]), Jo may withhold the Candidate’s profile from the Candidate’s current employer, specified email domains, or another named employer, without telling that employer. Customer acknowledges this.
Jo maintains administrative, technical and physical safeguards appropriate to the sensitivity of the Personal Information it handles. These include logical tenant isolation across Customers and Licensed Partner Client Sub-tenants, session and CSRF security controls, limiting access to authorised personnel, and restricting Candidate Personal Information to authorised, Unlocked contexts.
Customer authorises Jo to use the following subprocessors for Customer Personal Information.
| Category | Provider | Purpose |
|---|---|---|
| Hosting | Railway | Application hosting |
| Database, authentication and storage | Supabase | Storing and securing platform data |
| Voice infrastructure and transcription | Vapi | Browser-based voice sessions, phone sessions, and speech transcription |
| AI model inference | OpenAI and Anthropic | Analysing conversations and matching |
| Transactional email | Resend | Account and notification emails |
| Payment processing | Stripe | Customer payments for Credits |
Jo will give Customer at least 30 days’ notice of a new or replacement subprocessor, by email or in the Service. Customer may object on reasonable data-protection grounds within that period, and the parties will discuss it in good faith. If they cannot resolve it, Customer may stop using the affected part of the Service. Jo requires each subprocessor to protect Personal Information on terms no less protective than this DPA and remains responsible for it.
Jo will tell Customer without undue delay, and within 72 hours, after it becomes aware of a Security Incident that affects Customer Personal Information. Jo will give Customer the information it reasonably has, take reasonable steps to contain and fix the incident, and cooperate with Customer’s notices to regulators and individuals. Jo keeps records of Security Incidents as Privacy Laws require.
Each party is responsible for notifying regulators and individuals about incidents affecting Personal Information it controls. Where an incident affects Candidate Information that a Customer has Unlocked, Jo will tell that Customer where it is reasonably necessary for Customer to meet its own obligations.
When the MSA ends, or when Customer asks, Jo will delete or return Customer Personal Information within 90 days, unless the law requires Jo to keep it. Jo may keep the minimum Referral record needed to administer the Exclusivity Period and to show compliance. This section does not apply to Candidate Profile Data, which belongs to Jo’s relationship with the Candidate, or to the Candidate Information Customer already holds, which section 4 of the MSA governs.
Jo will give Customer the information reasonably needed to show that Jo meets this DPA. Customer may audit Jo’s compliance once a year, or after a Security Incident, on reasonable notice, during business hours, at Customer’s cost, and subject to confidentiality. The audit may be carried out by Customer or by an independent auditor it appoints. Jo may meet an audit request in whole or part by giving relevant third-party reports, where it has them.
Customer authorises Jo and its subprocessors to process Personal Information in Canada and the United States. Jo does not offer the Service to customers established in the EEA, UK or Switzerland as of the date of this DPA. If Jo later offers the Service in those regions, the parties will execute appropriate transfer mechanisms before Personal Information from those regions is processed.
Jo’s liability under this DPA is subject to section 14 of the MSA. If this DPA conflicts with the MSA on data protection, this DPA prevails. Jo may update this DPA as section 17 of the MSA allows.
Privacy contact: Privacy Officer, JCH Communications Inc. (“Jo”), 26 Sidney Street, Toronto, ON | Email: [email protected]