Data processing agreement

01

Definitions and scope

“Entrusted personal information” means personal information about natural persons, such as candidates, people of interest, client contacts, paper authors, patent inventors and email correspondents, that you upload, enter or import into your HunterBuddy workspace, or instruct HunterBuddy to look up, generate and save.

Your own account information is outside this agreement and is handled under the Privacy policy.

This agreement is made under Article 21 of the Personal Information Protection Law, Article 12 of the Regulations on Network Data Security Management and other provisions. Anything it does not cover is governed by the Terms of service.

02

Roles

• You decide the purpose and method of processing, for example which role to search for, what material to upload, whom to keep and whether to make contact. With respect to the entrusted personal information, you are the personal information handler.
• Boseek processes it on your behalf, as this agreement and your instructions provide, and never beyond the agreed purpose, method and scope.
• For the search sources and methods we choose, the refusal list and our security measures, we bear a personal information handler’s responsibility as the law requires.
• Your instructions are the actions and settings you make through the service, such as starting tasks, confirming what is saved, setting recurring plans and authorization modes, and anything both sides agree in writing.
• If we believe an instruction breaks the law, we will tell you and may pause carrying it out.

03

Purpose

We process entrusted personal information only to provide HunterBuddy to you, including to:

• Find people in your material and in public information for your tasks.
• Bring records of the same person from different sources together, including matching aliases, nicknames, English names and online IDs to real names, check for and merge duplicates, and complete records.
• Match candidates to roles, score the match and explain why.
• Map org charts, relationships between people and introduction paths.
• Draft summaries, reports, interview materials and emails, and translate.
• Check, on the recurring plans you set, for changes in the public information of people you follow, and raise alerts for you to confirm.
• Send emails after you confirm each one, and receive the replies.
• Store, export and delete records.

We never process this information for our own purposes: not for marketing, not for profiling of our own, not for model training and not in other users’ tasks. To keep the service running securely and count usage, we process only de-identified run information that contains no business content.

04

Duration

From when you start using HunterBuddy until this agreement ends, plus the deletion period in section 11.

What you delete goes to the recycle bin and is permanently deleted after 30 days, together with its files. At that point, that individual’s personal information is also cleared or anonymized in record versions, task conversations and run records, leaving only a note that the record was deleted. Copies in backups are cleared on the backup cycle within 30 days.

05

Methods

Processing consists of collecting, storing, parsing (resumes, files, images and audio), analyzing and comparing (bringing identities together and resolving them, checking duplicates, matching, mapping relationships), generating, sending emails once you confirm them, exporting and deleting.

When looking up public information, we access only public web pages, papers, patents and open-source projects that can be read without signing in, limit how often we access them, do not get around access restrictions and do not disrupt websites. We never sign in to or operate recruiting or social platforms that require a login.

Automated processing such as identity judgments and matching follows the authorization mode you choose, keeps its evidence and can be undone.

06

Types of personal information

HunterBuddy is not designed to process sensitive personal information. It does not extract ID numbers, health, religious beliefs, biometric data, financial accounts, location tracks and the like into structured data, and it runs no face or voiceprint recognition. Resumes and other files may contain such information. You should avoid uploading it, and where processing it is truly necessary, you must first obtain the person’s separate consent. You must not upload personal information about children under 14.

07

Your obligations

You undertake the following obligations:

• Make sure processing has a lawful basis, such as the person’s consent or processing public information within a reasonable scope, and inform the person as the law requires.
• Make sure the material you provide was obtained lawfully, for example by following a platform’s rules and the scope of the person’s authorization when you download a resume from it.
• Stop processing information a person has made public when they expressly refuse it, and delete it from HunterBuddy.
• Answer people’s requests to access, correct or delete their information. We will help you.
• Have a person review AI results, and do not make decisions that significantly affect someone’s rights on automated results alone.
• Carry out any personal information protection impact assessment the law requires, for example for entrusted processing or automated decision-making. We will provide the information you need.

08

Boseek’s obligations

Boseek undertakes the following obligations:

• Process as this agreement and your instructions provide, and never beyond the agreed purpose, method and scope.
• Never use it to train or fine-tune any model.
• Store and process it in mainland China (excluding Hong Kong, Macao and Taiwan), and never provide it outside China.
• Never provide it to other users or third parties, and never sell it, unless laws or administrative regulations require otherwise.
• Keep workspaces isolated. Operations staff cannot see your business content. Only when handling a complaint, a report or unlawful content as the law requires, with a manager’s approval and an audit record, may they view the content directly related to that matter.
• Protect the information with encryption, access control, auditing and other technical and organizational measures. Everyone with access is bound by confidentiality.
• Help you meet your personal information protection obligations, including answering individuals’ requests, carrying out impact assessments and handling security incidents.
• When an individual makes a request to us directly, the system checks across workspaces automatically, and we pass the request on to you and help you handle it, without any staff member looking at workspace content. Where a person expressly refuses processing of information they have made public, we put them on the refusal list and from then on stop automatically collecting or completing their information from public sources for any user.
• Accept your supervision. You can ask us to explain our processing, and we will provide the compliance information you need.
• Where the authorities lawfully require access to the data, notify you first where the law allows.

09

Sub-processing

You agree that we may engage the following types of service providers to process entrusted personal information. All of them are in mainland China. Our agreements require them to protect it at least as strictly as this agreement does, and we supervise them.

We will publish any new or changed type of provider on this page and tell you 15 days before it takes effect. If you do not agree, you can stop using the service, export your data and close your account before then.

Once you connect a sending mailbox, emails are sent and received through the mailbox provider you chose. That is not sub-processing by us. If the mailbox provider or a recipient is outside China, the emails travel abroad accordingly, at your own discretion and responsibility.

10

Security incidents

If entrusted personal information is, or may be, leaked, altered or lost, we will act immediately to contain it and notify you within 24 hours of confirming it, stating the types of information involved, the cause and possible harm, what we have done, what individuals can do to reduce the harm, and our contact person. We will help you notify the people concerned and report to the authorities as the law requires.

11

Deletion when the agreement ends

This agreement ends when the Terms of service end, when you close your account or when you delete your workspace. Before then you can export your data. If we decide to stop providing the service, we will announce it and notify you 30 days in advance.

When the agreement ends, we delete the entrusted personal information and keep none of it. For a deleted workspace, deletion follows the 30-day recovery period. For a closed account, deletion happens within 15 working days of verifying your identity. Copies in backups are cleared on the backup cycle within 30 days. If a retention period set by law or administrative regulation has not ended, or deletion is technically difficult, we only store and protect the information and do not otherwise process it.

12

Liability

Each side is liable for losses caused by its own breach of this agreement or the law. Losses caused by your unlawful instructions or material are your responsibility. Other questions of liability are governed by the Terms of service.

13

Other terms

• Where this agreement and the Terms of service differ on personal information protection, this agreement prevails.
• Changes to this agreement follow the section on changes in the Terms of service. Changes to the types of service providers are notified 15 days in advance under section 9 of this agreement.
• Organizations that need a separately signed written data processing agreement can contact us.
• This agreement exists in Chinese and English. If they differ, the Chinese version prevails.
• Contact us: privacy@boseekai.com.