Processor terms.

This Data Processing Agreement (“DPA”) forms part of your agreement with Conformant when you use the service as a business customer and we process personal data on your behalf in the workspace.

You (the recruitment or staffing agency) are the data controller for personal data you or your users enter in the workspace. Conformant is the data processor, except for account, billing, and marketing data where Conformant is controller as described in the Privacy Policy.

Processing covers EU AI Act compliance workflows — inventories, classifications, obligations, evidence, documents, deadlines, audit logs, and Advisor messages — for the term of your subscription or trial and as needed to delete data afterward.

This DPA applies while we provide the service and until workspace data is deleted or returned per your instructions.

Storage, organization, retrieval, export, and limited AI-assisted guidance over compliance metadata you submit, solely to provide the Conformant platform.

You will have a lawful basis for personal data you upload (including evidence files). You will not upload unnecessary candidate personal data. You will instruct us only through your use of the product and documented support requests.

We implement appropriate technical and organizational measures including EU hosting for primary workspace data, encryption in transit, role-based access, org-scoped database policies, private storage buckets, and audit logging. See our Security page for more detail.

You authorize our use of sub-processors listed on the Sub-processors page. Their processing is covered by their standard vendor terms; we remain responsible for their performance under this DPA.

Where sub-processors process data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

We will assist you with reasonable data subject requests and security inquiries related to workspace processing, subject to your ability to export data from Settings and contact us at hello@conformant.eu.

We will notify you without undue delay after becoming aware of a personal data breach affecting workspace data we process on your behalf, and provide information reasonably required for your regulatory obligations.

On workspace deletion or contract end, we will delete or return workspace personal data within a reasonable period, except where retention is required by law. Admins can export JSON from Settings before deletion.

Data protection enquiries: hello@conformant.eu

This page is our standard DPA for review. Agencies that need a countersigned copy can request one through our contact form — we will follow up by email. Request a signed DPA. Sub-processors.

Last updated: July 2026