JAN (Job Applicant Navigator) — Lopatka Consulting Services LLC
Last Updated: August 17, 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service (the "Agreement") between Lopatka Consulting Services LLC ("JAN," "we," "us," or "our") and the customer using the JAN service (the "Customer," "you," or "your"). It applies whenever you use the Service to process the personal data of job candidates ("Candidate Data").
For the purposes of Applicable Privacy Laws: you are the controller (or "business") of Candidate Data — you decide which candidates to screen and against what criteria — and JAN is your processor (or "service provider"), performing the screening on your instructions. In the event of a conflict between this DPA and the Agreement with respect to the processing of Candidate Data, this DPA controls.
| Item | Description |
|---|---|
| Subject matter and purpose | Screening candidate resumes against the criteria you define; generating scores, tiers, evidence, and interview questions; extracting a candidate email address, where present in a resume, solely for matching a screened candidate to your applicant tracking system; and, where you enable it, making your screening results available to a software agent you authorize under Section 5A of the Terms of Service. |
| Categories of data subjects | Job candidates whose resumes you submit. |
| Categories of personal data | Identity and contact data (name, email address, phone number, mailing address), professional history, education, skills, qualifications, and any other information the candidate included in their resume. |
| Duration of processing | Standard screening data is retained for 24 hours from completion of screening; Enterprise screening data is retained for 14 days from submission; each is then automatically and permanently deleted, as described in the Privacy Policy (Section 4). |
Before AI-powered evaluation, candidate personally identifiable information is removed from the resume text (blind screening); candidate identity is reattached only after scoring is complete.
JAN will process Candidate Data only on your documented instructions. Your documented instructions consist of the Agreement, this DPA, the documented functionality of the Service, and the configuration choices you make within it (including your screening criteria and, where applicable, the agents you authorize). JAN will not:
JAN will inform you if, in its reasonable opinion, an instruction from you violates Applicable Privacy Laws, though JAN is not obligated to monitor your compliance.
JAN certifies that it understands the restrictions in this Section and will comply with them.
JAN will ensure that any person it authorizes to process Candidate Data is subject to an appropriate obligation of confidentiality.
JAN implements reasonable technical and organizational measures designed to protect Candidate Data, as described in Section 6 of the Privacy Policy, including: removal of personally identifiable information from resume text before AI evaluation (blind screening); encryption of data in transit; authenticated, account-scoped access controls; time-limited tokenized links for shared Enterprise results; input sanitization and prompt-injection stripping; and automatic deletion of Candidate Data on the schedules in Section 3 above.
You provide general authorization for JAN to engage Subprocessors to provide the Service. The Subprocessors currently engaged, and the data each handles, are listed in Section 7 of the Privacy Policy. JAN will impose on each Subprocessor data protection obligations that are no less protective than those in this DPA, and JAN remains responsible for its Subprocessors' performance.
JAN will update the Privacy Policy Section 7 table before adding or replacing a Subprocessor that processes Candidate Data and will notify registered users of material changes. If you reasonably object to a new Subprocessor on data protection grounds, your remedy is to stop submitting Candidate Data and to terminate the affected subscription in accordance with the Agreement.
Candidate Data is deleted automatically on the retention schedules in Section 3 — deletion is the default behavior of the Service and does not require a request. During the applicable retention window, you may export screening results through the Service's report functions. Upon termination of the Agreement, any remaining Candidate Data is deleted no later than the expiry of its applicable retention window; JAN does not retain Candidate Data beyond those schedules. Audit logs described in the Privacy Policy (Section 4.4) are retained for security, accountability, and compliance purposes and contain no Candidate Data.
Taking into account the nature of the processing, JAN will provide reasonable assistance to you in:
You are responsible for the lawfulness of the Candidate Data you submit. You represent that you have a lawful basis and, where required, the necessary consent to process the resumes you upload, and that your instructions to JAN comply with Applicable Privacy Laws.
You will provide candidates with all notices required by Applicable Privacy Laws, including, where required: notice that an automated tool is used in screening (see the AEDT provisions of the Terms of Service and Privacy Policy), and notice that a candidate email address appearing in a resume may be extracted and retained for the purpose of matching the candidate to a record in your applicant tracking system, as described in Section 2.2 of the Privacy Policy. JAN has no direct relationship with candidates and cannot provide these notices on your behalf.
Where you authorize a third-party software agent to access your account under Section 5A of the Terms of Service, that agent acts on your behalf and on your instructions — it is your agent, not JAN's Subprocessor. This DPA governs JAN's processing of Candidate Data; it does not govern, and JAN is not responsible for, the storage, transmission, use, or disclosure of Candidate Data by an agent or its provider after the agent retrieves that data from your account. You are responsible for ensuring that your authorization and use of any agent complies with Applicable Privacy Laws and with your obligations to candidates, and the responsibilities allocated to you in Section 5A of the Terms of Service apply equally under this DPA.
Upon your written request, no more than once per twelve-month period, JAN will make available information reasonably necessary to demonstrate compliance with this DPA, which may include this DPA, the Privacy Policy, and written responses to a reasonable security questionnaire. Any further audit rights required by Applicable Privacy Laws will be exercised in a manner that is reasonable in scope, does not disclose other customers' data, and is at your expense. Nothing in this Section limits any audit right expressly mandated by Applicable Privacy Laws.
This DPA is effective for as long as JAN processes Candidate Data on your behalf under the Agreement. It controls over the Agreement with respect to the processing of Candidate Data. We may update this DPA where required to reflect changes in Applicable Privacy Laws or in the Service's processing, and will notify registered users of material changes as described in the Privacy Policy.
Lopatka Consulting Services LLC
Email: support@lopatkacs.com
Location: New York, NY