What the DPA covers
Our standard Data Processing Agreement is a legally binding addendum to the Chesky Master Subscription Agreement. It satisfies the written contract requirement under GDPR Article 28 and the equivalent obligations under Brazil's LGPD and US state privacy laws. The DPA covers:
Roles as controller and processor
The DPA clearly defines Chesky as a data processor acting on instructions from the enterprise customer (controller). Where Chesky processes platform-level data independently, the agreement documents controller responsibilities accordingly.
Technical and organizational security measures
The DPA annexes document the specific security measures Chesky applies: TLS 1.3 in transit, AES-256 at rest, role-based access control, annual penetration testing, and incident response procedures.
Sub-processor list and change notification
The DPA names all approved sub-processors and the categories of data each may access. Enterprise customers receive 30 days advance notice before any new sub-processor is added.
Data subject rights
The DPA outlines Chesky's obligations to assist controllers in responding to data subject requests under GDPR Article 28, LGPD Article 37, and applicable state privacy laws.
International transfer mechanisms
For transfers from the EEA, UK, or Switzerland to the US, the DPA incorporates the EU Standard Contractual Clauses (Module 2: controller-to-processor). For transfers from Brazil, equivalent contractual safeguards under LGPD Chapter V apply.
Breach notification
Chesky commits to notifying the enterprise customer within 72 hours of becoming aware of a confirmed personal data breach, with sufficient detail to meet GDPR Article 33 and LGPD Article 48 obligations.
How to get it
We do not publish a generic downloadable DPA because each agreement is executed as a countersigned addendum specific to your organization. There are two ways to request it.
Option 1. Email our privacy team
Send your request to privacy@chesky.ai with your organization name and the name of your Chesky account contact. We will send you a pre-signed DPA within two business days.
Option 2. Book a compliance call
If your security or legal team has questions before signing, book a 30-minute call with our compliance team. We will walk through the DPA and address any vendor questionnaire items at the same time.
Book a compliance callScope and applicability
The DPA applies to all personal data processed by Chesky on behalf of enterprise customers, including candidate evaluation data, ATS integration data, and any data shared via API or file upload.
The DPA does not apply to data that Chesky processes as a controller in its own right, such as account and billing information. That processing is governed by our Privacy Policy.
Enterprise customers may also review our Subprocessors page for the current list of third parties that may process data under this agreement.