1. Parties and roles
This addendum forms part of the agreement between the customer organisation ("Controller") and CanadaBridge AI ("Processor") where the Processor processes personal data on the Controller's behalf.
For candidate accounts created directly by individuals, CanadaBridge AI acts as controller and the Privacy Policy governs.
2. Subject matter and duration
Processing lasts for the term of the agreement plus any legally required retention period. The subject matter is the provision of recruitment, applicant-tracking and AI-assistance services.
3. Nature, purpose and data
Categories of data subjects: candidates, recruiters and administrative users.
- Identity and contact data — name, email, phone, language.
- Professional data — experience, education, certifications, skills, languages, salary expectations.
- Work-authorisation data — visa status, Express Entry interest, last four digits of a passport number where provided.
- Recruitment records — applications, pipeline stages, interview schedules, notes, messages.
- Technical data — hashed IP addresses, event and audit logs.
4. Processor obligations
- Process personal data only on the Controller's documented instructions, including for international transfers.
- Ensure personnel with access are bound by confidentiality.
- Implement the technical and organisational measures in section 5.
- Assist the Controller with data-subject requests, impact assessments and regulator consultations.
- Notify the Controller without undue delay, and in any case within 72 hours of becoming aware, of a personal-data breach.
- Delete or return personal data at the end of the agreement, except where retention is legally required.
- Make available the information needed to demonstrate compliance and allow audits, subject to reasonable notice and confidentiality.
5. Technical and organisational measures
- Row-level security on every table, enforced by the database rather than the application layer.
- Role-based access control with roles held in a dedicated table and evaluated by security-definer functions.
- Private-only file storage with short-lived signed URLs; no public object URLs.
- Encryption in transit (TLS) and at rest at the storage layer.
- Server-side validation of all inputs and CSRF protection on state-changing calls.
- Append-only audit, security and domain-event logs with SHA-256 hashed IP addresses.
- Soft delete plus a document registry supporting erasure and export requests.
6. Sub-processors
The Controller authorises the use of infrastructure sub-processors for hosting, database, storage, email delivery and AI inference. We maintain a current list and give notice before adding or replacing a sub-processor, allowing the Controller to object on reasonable data-protection grounds.
7. International transfers
Where personal data is transferred outside the EEA, the UK or Canada, the transfer is covered by Standard Contractual Clauses or another valid transfer mechanism with each sub-processor.
8. Liability
Each party's liability under this addendum is subject to the limitations in the Terms of Service. This addendum prevails over the Terms of Service in the event of a conflict about processing.
9. Execution
Organisations requiring a countersigned copy should contact legal@canadabridge.ai with their legal entity name and address.