TalentFora Data Processing Addendum

1. Introduction

1.1 Purpose of This Addendum

This Data Processing Addendum ("Addendum") applies where TalentFora, provided by FORASOFTWARE AUSTRALIA PTY LTD (ACN: 685 226 706 / ABN: 25 685 226 706) ("TalentFora"), processes personal information (referred to herein as "personal data") on behalf of a customer in connection with the TalentFora Platform.

This Addendum forms part of, and should be read together with, the TalentFora Terms & Conditions, Privacy Policy, Sub-Processor / Data Transfer Summary, and any applicable order form, agreement, or online subscription terms.

1.2 Scope

This Addendum applies to personal data processed by TalentFora on behalf of employers, recruiters, organisations, or other customers using the Platform, including candidate data, resumes, CVs, recruitment materials, and related Platform outputs.

Where there is a conflict between this Addendum and the Terms & Conditions regarding the processing of personal data on behalf of a customer, this Addendum will apply to the extent of that conflict, unless otherwise required by applicable law, including the Privacy Act 1988 (Cth).

2. Roles of the Parties

2.1 Customer as Primary APP Entity

The customer is the primary APP Entity (and data controller) responsible for determining the purposes and means of processing candidate data and other personal data uploaded to or processed through the Platform.

The customer is responsible for ensuring that it has an appropriate legal basis, lawful authority, and has provided all necessary collection notices to collect, upload, use, process, retain, transfer, and otherwise manage such personal data in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2.2 TalentFora as Contracted Service Provider

Where TalentFora processes personal data on behalf of the customer, TalentFora acts as a contracted service provider and data processor.

TalentFora processes such personal data only to provide, secure, support, maintain, and improve the Platform, and in accordance with this Addendum, the Terms & Conditions, the Privacy Policy, customer instructions, and applicable Australian law.

2.3 Independent Processing

TalentFora may act as an independent APP Entity in relation to certain business, account, billing, support, security, analytics, legal, and operational data, as further described in the Privacy Policy.

3. Customer Instructions

3.1 Processing Instructions

The customer instructs TalentFora to process personal data as reasonably necessary to provide the Platform and related services, including:

• hosting, storing, and processing uploaded data;
• analysing resumes, CVs, job descriptions, and candidate information;
• generating rankings, scores, summaries, insights, matches, or other Platform outputs;
• supporting account administration and customer support;
• securing, monitoring, maintaining, and improving the Platform;
• enabling downloads, exports, and customer access to data;
• complying with applicable legal or regulatory obligations.

3.2 Additional Instructions

The customer may provide additional lawful instructions where supported by the Platform and agreed by TalentFora. TalentFora is not required to follow instructions that it reasonably believes are unlawful, technically unsupported, commercially unreasonable, or inconsistent with the Terms & Conditions or applicable law.

4. Customer Responsibilities

The customer is strictly responsible for:

• ensuring it has a lawful basis for processing candidate data and other personal data under the Privacy Act 1988 (Cth) and the APPs;
• providing required privacy notices, collection statements, disclosures, or consents where applicable;
• ensuring uploaded data is lawful, accurate, relevant, and appropriate;
• complying with all applicable employment, equality, anti-discrimination, AI-related, privacy, and data protection laws;
• reviewing all AI-generated outputs before using them in any recruitment or employment decisions;
• managing user access, permissions, and account security;
• ensuring lawful retention, deletion, transfer, and use of data downloaded or exported from the Platform.

5. TalentFora Processing Obligations

TalentFora will:

• process personal data in accordance with this Addendum and applicable Australian law;
• implement reasonable technical and organisational measures designed to protect personal data from misuse, interference, loss, and from unauthorised access, modification, or disclosure;
• ensure that personnel authorised to process personal data are subject to appropriate confidentiality obligations;
• take reasonable steps to assist customers with data protection obligations where required by applicable law and reasonably possible;
• notify the customer without undue delay if TalentFora becomes aware of an eligible data breach (as defined under the Notifiable Data Breaches scheme of the Privacy Act 1988 (Cth)) affecting customer personal data, to enable the customer to meet its reporting obligations to the Office of the Australian Information Commissioner (OAIC) and affected individuals;
• process personal data only for the purposes of providing, securing, supporting, maintaining, or improving the Platform, or as otherwise permitted by this Addendum, the Terms & Conditions, Privacy Policy, or applicable law.

6. Subprocessors

6.1 Use of Subprocessors

The customer authorises TalentFora to use group entities, service providers, contractors, infrastructure providers, and other subprocessors to provide, support, secure, maintain, and improve the Platform.

Subprocessors may include providers for:

• cloud hosting and infrastructure, including Microsoft Azure;
• engineering, development, maintenance, and technical support;
• payment processing and billing, including Stripe (for customers outside India) and Razorpay (for customers in India);
• analytics and monitoring;
• customer support and communications;
• authentication, security, and fraud prevention;
• operational and administrative support.

6.2 Group Entities

TalentFora may use Forasoftware group entities, including Softfoora Services Pvt. Ltd., to operate, support, develop, maintain, troubleshoot, or improve the Platform.

6.3 Subprocessor Safeguards

TalentFora will take reasonable steps to ensure that subprocessors processing personal data on TalentFora's behalf are subject to appropriate contractual, technical, and organisational safeguards in accordance with the APPs.

7. International Transfers

7.1 Cross-Border Processing and APP 8

The customer acknowledges that personal data may be processed, stored, accessed, transferred, or supported in multiple jurisdictions to facilitate the delivery of the Platform.

To comply with APP 8 (Cross-border disclosure of personal information), TalentFora advises, and the customer acknowledges, that data may be accessed by our overseas development center (Softfoora Services Pvt. Ltd. in India) and global cloud infrastructure providers (including Microsoft Azure locations globally). India-based support or engineering personnel may access customer personal data, including candidate resumes/CVs, where necessary for support, debugging, maintenance, security, reliability, or service improvement purposes.

7.2 Transfer Safeguards

In accordance with APP 8.1, TalentFora takes reasonable steps to ensure that overseas recipients do not breach the Australian Privacy Principles in relation to the personal data. Such safeguards include:

• stringent data processing agreements and data processing agreements where applicable;
• strict role-based access controls and managed user groups;
• internal access restrictions, comprehensive logging, and monitoring;
• tenant configuration and segregation;
• encryption or pseudonymisation where appropriate.

7.3 Customer Transfers

Where the customer downloads, exports, transfers, or otherwise accesses personal data outside the Platform, the customer remains wholly responsible for ensuring that any subsequent cross-border transfer, use, security, retention, storage, sharing, deletion, and processing complies with APP 8 and all other applicable laws.

8. Security Measures

TalentFora will implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, misuse, interference, loss, alteration, or destruction.

Such measures may include:

• access controls and authentication measures;
• role-based access restrictions;
• encryption and secure transmission methods where appropriate;
• infrastructure and hosting safeguards;
• monitoring, logging, and security review processes;
• backup and recovery systems;
• fraud prevention and misuse detection;
• internal policies, confidentiality obligations, and operational safeguards.

The customer acknowledges that no system, platform, or method of electronic transmission or storage is completely secure.

9. Data Subject Requests

Where TalentFora receives a request from an individual relating to their rights of access, correction, or complaints under the Australian Privacy Principles regarding personal data processed on behalf of a customer, TalentFora will generally direct that individual to the relevant customer.

To the extent required by applicable law and reasonably possible, TalentFora may assist the customer in responding to valid data subject requests relating to personal data processed through the Platform.

The customer remains fully responsible for responding to requests and managing complaints where it acts as the primary APP Entity or decision-maker in relation to the relevant personal data, including managing any required interactions with the Office of the Australian Information Commissioner (OAIC).

10. Return, Deletion, and Retention

Upon termination, cancellation, account closure, expiry of retention periods, or valid deletion request, TalentFora may delete, anonymise, restrict, archive, return, or otherwise manage personal data in accordance with the Terms & Conditions, Privacy Policy, Sub-Processor / Data Transfer Summary, customer settings, this Addendum, and applicable law.

Deletion may not occur immediately, and certain data may continue to exist securely in backups, logs, archives, security systems, or retained operational records for a reasonable period where permitted or required by applicable law.

The customer remains responsible for exporting any permitted data it requires before access ends. Where data has been downloaded or exported from the Platform, the customer remains responsible for its subsequent retention, deletion, storage, transfer, sharing, security, and legal compliance.

11. Audit and Information Rights

TalentFora will make available reasonable information necessary to demonstrate compliance with this Addendum where required by applicable law.

Any audit or information request must be reasonable, proportionate, limited to relevant processing activities, and subject to strict confidentiality, security, and operational requirements. TalentFora may satisfy audit or information requests by providing written responses, security summaries, subprocessor summaries, policies, or other appropriate documentation.

12. Liability, Consumer Law, and Governing Law

12.1 Relationship With Other Terms

This Addendum does not limit or expand the liability provisions set out in the TalentFora Terms & Conditions unless expressly required by applicable law.

12.2 Australian Consumer Law (ACL) Carve-out

The customer remains fully responsible for claims, losses, or liabilities arising from:

• unlawful collection, upload, or use of personal data;
• failure to provide required notices or obtain required consents;
• recruitment or employment decisions;
• misuse of AI-generated outputs;
• unlawful retention, transfer, sharing, deletion, or processing of exported data;
• breach of applicable employment, equality, anti-discrimination, AI, privacy, or data protection laws.

12.3 Governing Law and Jurisdiction

This Addendum and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the laws of New South Wales and the federal laws of Australia. The parties irrevocably agree that any legal action or proceedings arising out of or in connection with this Addendum shall be subject to the exclusive jurisdiction of the courts of New South Wales, Australia.

13. Contact

Questions regarding this Addendum or TalentFora's processing of customer personal data may be directed to our Privacy Officer at:

FORASOFTWARE AUSTRALIA PTY LTD
ACN: 685 226 706
ABN: 25 685 226 706
Principal Place of Business: U 1 29 HELEN ST. NEWTOWN QLD 4350
Email: privacy@talentfora.com