Data Processing Agreement (Lantern AI)

Subject Matter:

Lantern AI provides a voice-based AI interview recruiting service. Under this DPA, Lantern AI processes personal data solely to provide AI analysis of candidate interviews and to automate first‑round screening on behalf of the Customer.

Duration:

Lantern AI will process personal data for the term of the Services Agreement and retain it only as necessary for service provision, or as otherwise required by law.

Nature of Processing:

Collection of interview data from candidates; storage of audio/video recordings and transcripts; automated analysis of responses; and delivery of insights to the Customer.

Purpose of Processing:

• Provide AI analysis of candidate interviews;
• Automate initial screening and provide evaluation results;
• Improve Lantern AI's algorithms using anonymized/aggregated data (see Section 4.9).

Categories of Data Subjects:

Job applicants/candidates and, where applicable, Customer users (e.g., recruiters).

Types of Personal Data:

• Contact Information: name, email address, phone number, and similar contact details;
• Professional Background: resume/CV information, employment history, education, skills;
• Interview Data: audio/video recordings, interview transcripts, responses to questions, derived evaluations or notes;
• Usage Data: IP address, browser type and version, pages visited, timestamps, and duration of visits.

Special Categories:

Lantern AI does not intentionally collect special categories of personal data. If such data may be incidentally disclosed by candidates, the Customer confirms it has a lawful basis and provides any required notices/consents.

4.1 Processing on Documented Instructions:

Lantern AI will process personal data only on documented instructions from the Customer and for the purposes authorized by this DPA, unless required by law.

4.2 Confidentiality:

Lantern AI ensures all personnel and sub‑contractors with access to personal data are bound by confidentiality obligations and trained on privacy and security.

4.3 Security Measures:

Lantern AI maintains appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. See Annex A for details.

4.4 Sub‑Processors:

Customer provides general authorization for Lantern AI to engage sub‑processors listed in Annex B. Lantern AI will notify Customer of changes, flow down equivalent obligations, and remain liable for sub‑processor performance.

4.5 Assistance with Data Subject Rights:

Taking into account the nature of processing, Lantern AI will assist the Customer in responding to data subject requests, and will not respond directly to data subjects without the Customer's instruction unless legally required.

4.6 Breach Notification:

Lantern AI will notify the Customer without undue delay upon becoming aware of a personal data breach affecting Customer data and will provide information and assistance reasonably required for Customer's compliance obligations.

4.7 DPIA & Cooperation:

Lantern AI will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities related to the Services.

4.8 International Data Transfers:

Lantern AI will implement appropriate cross‑border transfer mechanisms (e.g., SCCs for GDPR; CAC Standard Contract/certification/security assessment and separate consent under PIPL as applicable). For Hong Kong data, Lantern AI will apply PCPD‑recommended transfer safeguards on a best‑practice basis.

4.9 Anonymization & Service Improvement:

With Customer permission, Lantern AI may anonymize or aggregate data so it can no longer identify an individual and use such de‑identified data to improve services. Anonymized data may be retained post‑termination. Lantern AI will not use personal data for model training in a way that identifies individuals or exceeds Customer's instructions.

4.10 Records & Audit:

Lantern AI maintains records of processing and will make available information to demonstrate compliance. Customer may audit annually (or as required by law or following a material breach). Audits may rely on third‑party certifications or, if needed, on‑site inspections under confidentiality, with reasonable notice.

4.11 Compliance and Accountability:

Lantern AI will promptly inform the Customer if an instruction infringes applicable law or if Lantern AI can no longer meet its obligations under this DPA.