This Data Processing Addendum (DPA) governs Office Hasegawa’s processing, on a customer’s instructions, of applicant, staff, and other personal data the customer enters into TrialOps. It forms part of the TrialOps Terms.
1. Parties and roles
The customer determines the purposes, content, and sharing scope for personal data about applicants, staff, and other people entered into TrialOps and acts as controller. Office Hasegawa acts as processor to the extent needed to provide TrialOps and follow the customer’s documented instructions. Office Hasegawa or a payment provider may act as an independent controller for account, contract, billing, security, or legal-compliance information.
2. Processing details
- Purpose and duration
- Provide store and staff management, applicant and recruiting workflows, trial shifts, onboarding, support, security, and termination processing during the subscription.
- People
- Customer store staff, applicants, applicant contacts, and people involved in recruiting operations.
- Data
- Names, contact details, dates of birth, application sources, work history and preferences, interview and trial-shift information, compensation offers, store notes, onboarding information, account and access details, notification email recipients and content and delivery status, and access and audit records. Applicants can submit PDF, JPEG, PNG, or HEIC document files up to 10 MB. File contents are stored in private R2 storage but are not automatically scanned for malware. File names, formats, sizes, and submission, access, and review history are also processed.
- Instructions
- Customer settings and actions in the service, support requests, and the instructions in the Terms and this DPA. If an instruction violates applicable law, Office Hasegawa will suspend the relevant processing and notify the customer.
3. Office Hasegawa obligations
- Process personal data in accordance with documented instructions and applicable law.
- Require confidentiality from authorized personnel and limit access to what their work requires.
- Use safeguards appropriate to the service, including store-level access controls, authentication and permissions, encrypted connections, private storage, and operation records.
- Notify the customer without undue delay after becoming aware of a personal-data breach and reasonably assist with investigation, impact assessment, and legally required steps.
- Reasonably assist with individual requests, impact assessments, and regulatory consultations, taking the nature of processing into account.
- Provide information reasonably needed to demonstrate compliance and cooperate with audits in a way that protects service security and other customers’ information.
4. Subprocessors and international processing
Office Hasegawa uses Cloudflare as a subprocessor for the Workers application and API, the D1 database, R2 document storage, and Email Service for authentication, invitation, and notification email. Email Service processes recipients, subject and message content, and sending and delivery information. Email retention is governed by Cloudflare service settings and terms; this DPA does not warrant an unverified retention period. Stripe processes store subscription and payment information but is not used as a subprocessor for customer applicant business data.
The deployment configuration does not specify a D1 region. Cloudflare does not guarantee processing or storage exclusively in a particular country or region; information may be processed outside Japan through its global network. Office Hasegawa will notify customers of material subprocessor changes through the service or a registered contact method. Where required by law, the parties will identify an appropriate basis and safeguards for international transfers.
5. Individual requests and incidents
When the customer receives an individual access, correction, or deletion request as controller, Office Hasegawa will provide reasonable assistance. If Office Hasegawa receives such a request, it will contact the customer or handle it as required by applicable law. Incident notice and assistance are governed by Section 3.
6. Data at termination and retention
Access, export, and deletion after termination are governed by the TrialOps Terms and Privacy Policy. The customer should retrieve needed data in advance using available export features. The Privacy Policy describes retention and deletion schedules for applicant information, document originals, and audit logs. We may retain information to the extent needed for legal obligations, claims and disputes, or security. D1 recovery history may retain deleted information for up to 30 days.
7. Customer responsibilities and contact
The customer is responsible for the legal basis for collecting and entering personal data, notices to individuals, data accuracy, access authority, and lawful instructions to Office Hasegawa. Contact about this DPA: [email protected].