Data Processing Agreement

Last updated: May 2026 · DPA v1

Summary

LEFTFIELD SOLUTIONS FZE, registered in UAE, operating Top5, will sign a Data Processing Agreement (DPA) with any customer that needs one. The DPA covers GDPR Article 28, UAE PDPL, and equivalent processor obligations, and is annexed with the European Commission's Standard Contractual Clauses (SCCs) for cross-border data transfers.

To request: email legal@top5cv.com with your company legal name, governing-law preference (if any), and the signatory's name and email. We aim to return a signed DPA within five business days.

1. Roles

  • Controller: you, the customer.
  • Processor: LEFTFIELD SOLUTIONS FZE, registered in UAE, operating Top5.
  • EU AI Act split: in parallel, you are the Article 26 deployer and we are the provider of the Top5 high-risk AI system.

Who is responsible for what, beyond data protection

Top5 is a decision-support tool. The same split applies on every page here, in the data processing agreement and in the Customer AI Use Guide.

You, the customer, own:
lawful hiring use · candidate notices · human review before any decision that affects a candidate, including rejecting or setting one aside · EU AI Act deployer duties · NYC Local Law 144 duties, including the bias audit, the candidate notice and the alternative process · FCRA and local employment-law duties · and every final decision.
Top5 owns:
the platform · the truth of what we do with your data and candidates' data · our sub-processors and where they run · AI transparency, including what the system does and where it can be wrong · logging and audit records · and the provider-side evidence a regulator may ask us for.

Top5 is not a background-check service and not a consumer-reporting agency. How Top5 uses AI

2. Subject matter and duration

The processing covered by the DPA is whatever Top5 carries out on your behalf for as long as your Top5 subscription is active, plus the retention window described in our Privacy Policy §5.

3. Nature and purpose of processing

CV ingestion, text extraction, vector embedding, AI-assisted assessment, shortlist generation, and account/billing management — as described in our AI Disclosure.

For deployer-side guidance on using Top5 responsibly under the EU AI Act, UK and UAE data-protection law, US fair-hiring law, and NYC LL 144, request our Customer AI-Use Guide from legal@top5cv.com.

4. Sub-processors

The current list is published at /legal/sub-processors. We give 30 days' notice before adding a sub-processor that has access to customer or candidate data.

5. International transfers

For transfers to sub-processors outside the EU/EEA, the DPA annex incorporates the European Commission's Standard Contractual Clauses (Commission Decision 2021/914), with the supplementary technical and contractual measures appropriate for the relevant transfer destination post-Schrems II.

6. Security measures

  • TLS in transit, encryption at rest via Supabase Storage
  • Row-level security on every tenant table plus server-side user_id filtering (defence in depth)
  • Scoped service-role keys; no customer access to other customers' data possible by construction
  • Sentry PII scrubbing on stack traces; PostHog cookieless analytics
  • Vendor security per /legal/sub-processors

7. Data subject rights

We assist you in fulfilling data subject requests via the in-product /api/data-requests endpoint and the Settings > Privacy panel. The endpoint returns a structured JSON bundle covering account, roles, candidates, summaries, interviews, and notes — suitable for GDPR Article 15 access and Article 20 portability requests, and the equivalent UAE PDPL rights.

8. Breach notification

We will notify you without undue delay (and in any event within 72 hours of confirmation) on becoming aware of a personal data breach affecting customer or candidate data, with the information you need to fulfil your own GDPR Article 33 notification obligation. The DPA sets out the exact notification fields and channels.

9. Audit rights

We make available the information necessary to demonstrate compliance with this DPA, including third-party audit reports of our sub-processors where available. Customer-led on-site audits are available on reasonable notice for enterprise customers — see legal@top5cv.com.

10. Return or deletion of data

On termination of the subscription, customer data is retained for the period in our Privacy Policy §5 then deleted. You may request earlier deletion via /api/data-requests at any time.

11. How to sign

Email legal@top5cv.com with your company legal name and signatory details. We will return the DPA prefilled for counter-signature. Enterprise customers requiring redlines on the standard text are welcome — we treat reasonable redline cycles as part of the procurement process.