Data Processing Addendum

This Data Processing Addendum ("DPA") describes how Wackywow.com LLC ("Processor," "we") processes personal data on behalf of customers who use Resume.win in a business capacity (for example, career coaches and organizations) ("Controller" or "Customer").

For individual consumer accounts, our Privacy Policy describes our role as controller. Enterprise customers may request a signed DPA by contacting support.

Customer is the controller of Client Data it uploads or directs us to process. We process that data only to provide the Service, on documented instructions from Customer (including configuration of the product), and as required by law.

We implement appropriate technical and organizational measures, including encryption in transit (TLS), hashed credential storage, private object storage for file binaries with ownership checks, access controls, least-privilege admin access, rate limiting on sensitive APIs, and vendor due diligence for subprocessors. We do not currently claim SOC 2 or ISO 27001 certification; when completed, evidence will be published in the Trust Center.

We treat Client Data (including resumes and career materials) as confidential. We do not sell Client Data. Optional Resume↔Recruit bridge features, if used by end users, are opt-in and do not authorize bulk transfer of resume content without the data subject's consent controls described in the Privacy Policy.

Customer authorizes us to use the subprocessors listed on this page to support the Service. We will post material changes to the subprocessor list and aim to provide notice for material additions where contractually required.

We will reasonably assist Customer with data subject requests (access, deletion, export) related to Client Data processed in the Service. End users of consumer accounts may also use self-service export and deletion in Settings, or contact [email protected].

Upon termination of the Service, Customer may export available data. We will delete or anonymize Customer personal data from active systems within a commercially reasonable period, subject to legal retention requirements and residual backup copies for a limited time.

Privacy and DPA requests: [email protected].