Last updated · October 2026
This Data Processing Addendum ("DPA") forms part of the Vort Terms of Use and applies whenever Vort processes personal data contained in Customer Data on Customer's behalf. Capitalised terms not defined here have the meaning given in the Terms.
Customer Data. For personal data that Customer provides to the Services (briefs, ATS records, notes, shortlists Customer builds, user accounts), Customer is the controller and Vort is the processor. Vort processes that data only on Customer's documented instructions, which are these Terms, the DPA, the Order Form and Customer's use of the product features.
Service Data. For the candidate database and enrichment data that Vort compiles from publicly available sources and third-party providers, Vort is an independent controller and processes it as described in the Privacy Policy. This DPA does not cover Service Data, except that Vort will relay to Customer any data-subject request that affects data Customer has exported.
Where Customer is itself a processor for its own clients (for example a recruiting agency), Vort acts as sub-processor and Customer warrants that its clients' instructions are consistent with this DPA.
| Subject matter | Provision of the Vort sourcing service under the Terms |
|---|---|
| Duration | The subscription term plus the export and deletion periods in section 09 |
| Nature and purpose | Hosting, storing, matching, enriching, displaying, exporting and syncing to Customer's ATS; support; security; improvement in aggregated form |
| Data subjects | Customer's users; candidates Customer records, shortlists or imports |
| Categories of data | Name, work contact details, role, employer, professional history and public profile data; account and usage data of Customer's users; notes Customer writes |
| Sensitive data | Not intended. Customer will not submit special-category or sensitive data as defined by applicable law |
Customer is responsible for the lawfulness of the Customer Data it provides and of its instructions, including having a lawful basis, giving candidates any notices required by law, and honouring their rights. Customer will not instruct Vort to process data in a way that would breach applicable law.
If Vort receives a request from a data subject relating to Customer Data, Vort will forward it to Customer without undue delay and will not respond on Customer's behalf except to confirm that the request has been forwarded. Where the same individual also appears in Service Data, Vort will handle the Service Data part of the request itself, as described in the Privacy Policy, and will notify Customer so that Customer can act on its own copies.
Customer authorises Vort to engage the sub-processors on its current list, which Vort will provide on request by email to hey@vort-sourcing.com. Vort will give at least 14 days' notice by email before adding or replacing a sub-processor. If Customer reasonably objects on data-protection grounds and the parties cannot resolve the objection, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the remaining term. Vort will impose on each sub-processor data-protection obligations no less protective than those in this DPA and remains responsible for their performance.
Vort is established in Israel, which holds an adequacy decision from the European Commission. Where Customer Data is transferred to a sub-processor outside Israel, the EEA or the UK, Vort will ensure an appropriate safeguard applies, such as an adequacy decision or the EU Standard Contractual Clauses (and the UK Addendum where relevant).
On written request not more than once a year, Vort will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of any third-party audit reports it holds. Where that information is not sufficient, Customer may conduct, or have an independent auditor bound by confidentiality conduct, an audit on at least 30 days' notice, during business hours, without unreasonable disruption, and at Customer's cost.
On termination of the Services, Vort will make Customer Data available for export for 30 days and then delete it within a further 30 days, except for copies in routine backups (deleted in the ordinary backup cycle), aggregated or de-identified data, and data Vort is required by law to retain. On request, Vort will confirm deletion in writing.
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms. If this DPA conflicts with the Terms on a matter of data protection, this DPA prevails. This DPA is governed by the same law and courts as the Terms.
Data-protection questions and requests: hey@vort-sourcing.com.