Talent Fabric Ltd., trading as GoPerfect
Version 2026-10-19, effective 19 October 2026
This Data Processing Addendum (“DPA”) is incorporated by reference into the Platform Subscription Terms available at www.goperfect.com/subscription-terms, the applicable Order Form, or other agreement governing the use of GoPerfect’s services (“Agreement”) entered into by and between you, the Customer (as defined in the Agreement) (collectively, “you”, “your”, “Customer”), and Talent Fabric Ltd. (“GoPerfect”, “us”, “we”, “our”) to reflect the Parties’ agreement with regard to the Processing of Personal Data in connection with the Services, both where GoPerfect Processes Personal Data on behalf of Customer and where GoPerfect Processes Personal Data as an independent Controller. Both parties shall be referred to as the “Parties” and each, a “Party”.
Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
By using the Services, Customer accepts this DPA and you represent and warrant that you have full authority to bind the Customer to this DPA. If you cannot, or do not agree to, comply with and be bound by this DPA, or do not have authority to bind the Customer or any other entity, please do not provide Personal Data to us.
In the event of any conflict between certain provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement, solely with respect to the Processing of Personal Data.
1.1 “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
1.2 “Authorized Affiliate” means any of Customer’s Affiliate(s) explicitly permitted to use the Services pursuant to the Agreement between Customer and GoPerfect but who has not signed its own agreement with GoPerfect.
1.3 “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et seq., and its implementing regulations, as may be amended.
1.4 “Candidate Database” means the database of professional profiles of individuals, together with any contact details relating to those individuals, that GoPerfect compiles from licensed data providers and makes available to its customers through the Services (referred to in the Platform Subscription Terms as Sourced Candidate Data). The Candidate Database does not include Customer Data.
1.5 The terms “Controller”, “Member State”, “Processor”, “Processing” and “Supervisory Authority” shall have the meanings given to them in the GDPR. “Business”, “Business Purpose”, “Consumer” and “Service Provider” have the meanings given in the CCPA.
1.6 “Customer Data” means Personal Data that Customer or its users submit to the Services (including data synchronised from Customer’s applicant tracking system, uploaded applications and notes), together with Match Outputs, campaigns, messages and other outputs generated within Customer’s account, LinkedIn session credentials that Customer’s users supply or that the Connection Sync extension provides, and any profile from the Candidate Database that Customer saves, exports or acts upon within its account.
1.7 “Data Protection Laws” means all applicable and binding privacy and data protection laws and regulations including the GDPR, UK GDPR, CCPA, the Israeli Protection of Privacy Law, 5741-1981, and others applicable in the EEA, UK, US, Canada, Switzerland, and Israel.
1.8 “Data Subject” means the identified or identifiable person to whom the Personal Data relates.
1.9 “GDPR” means the General Data Protection Regulation (EU) 2016/679.
1.10 “Match Outputs” means the match score, written explanation and openness estimate generated by the Services for a candidate in relation to a specific vacancy of Customer.
1.11 “Personal Data” or “Personal Information” means any information relating to an identified or identifiable natural person Processed in connection with the Services.
1.12 “Services” means GoPerfect’s cloud-based recruiting platform and related APIs, tools, integrations, mobile and web applications provided under the Agreement.
1.13 “Security Documentation” means GoPerfect’s technical and organizational security measures documentation, available at www.goperfect.com/security or otherwise provided to Customer.
1.14 “Sensitive Data” means any Personal Data subject to special protections under applicable Data Protection Laws, including financial data, health data, racial or ethnic data, or child data.
1.15 “Standard Contractual Clauses” means the clauses adopted under Commission Implementing Decision (EU) 2021/914, including relevant UK and Swiss addenda.
1.16 “Sub-processor” means any third party appointed by GoPerfect to process Personal Data on its behalf, including licensed data providers that process Personal Data on GoPerfect’s instructions.
1.17 “UK GDPR” means the retained EU law version of the GDPR applicable in the United Kingdom.
2.1 Roles of the Parties. The Parties acknowledge that: (a) with respect to Customer Data, Customer is the Controller and GoPerfect is the Processor, and Sections 2.2 to 2.6, 3, 4, 5, 6, 7, 8 and 9 apply to that Processing; (b) with respect to the Candidate Database, GoPerfect is an independent Controller. GoPerfect is responsible for its own lawful basis, transparency and Data Subject rights handling for the Candidate Database, as described in its privacy policy at www.goperfect.com/privacy. When Customer saves, exports or acts upon a profile or contact details from the Candidate Database, that copy becomes Customer Data and Customer is the Controller of it; and (c) neither Party is a joint Controller with the other.
2.2 Customer’s Obligations. Customer shall comply with all Data Protection Laws applicable to it in its use of the Services and its instructions to GoPerfect. Customer shall ensure that it has the right to provide and authorize the Processing of Customer Data by GoPerfect under the Agreement and this DPA. Customer is responsible for its own compliance, including any notice to Data Subjects, in respect of any contact it makes with individuals identified through the Candidate Database.
2.3 Processor’s Obligations. GoPerfect shall process Customer Data: (a) in accordance with Customer’s documented instructions; (b) as necessary to provide the Services; (c) as required by law; and (d) as otherwise set forth in this DPA. GoPerfect shall notify Customer if it believes any instruction violates applicable law.
2.4 Details of Processing. The subject matter, nature, and purpose of Processing, as well as the types of Personal Data and categories of Data Subjects involved, are described in Schedule 1.
2.5 Sensitive Data. The Services are not intended to process Sensitive Data. Any processing of such data requires GoPerfect’s prior written consent and may require supplemental terms. GoPerfect does not hold Sensitive Data as a field in the Candidate Database and does not use age, sex or any special category of data as an input to Match Outputs.
2.6 Use restrictions and CCPA. GoPerfect certifies that it will not sell or share Customer Data as defined in the CCPA and will comply with its obligations as a Service Provider in respect of Customer Data. GoPerfect shall not combine Customer Data with other data, including the Candidate Database, unless permitted under CCPA or instructed by Customer. GoPerfect shall not use Customer Data to train general-purpose or shared artificial intelligence models; learning derived from Customer’s use of the Services remains within Customer’s account. For clarity, contact details that GoPerfect obtains from its data providers at Customer’s request form part of the Candidate Database, may be retained by GoPerfect in that database and made available to other customers (contact details from the Candidate Database are disclosed to a customer only for candidates a user of that customer has selected for a specific position, by saving the candidate or adding them to outreach), and are Processed by GoPerfect as independent Controller under Section 2.1(b) and subject to the safeguards in its privacy policy.
If GoPerfect receives a request from a Data Subject to exercise rights under applicable laws in respect of Customer Data, GoPerfect shall, where appropriate, direct the Data Subject to the Customer. To the extent Customer does not have the ability to address a Data Subject request, GoPerfect shall provide reasonable assistance, taking into account the nature of the Processing and the information available to GoPerfect. Requests relating to the Candidate Database are handled by GoPerfect as Controller; where a Data Subject asks GoPerfect to remove their profile, GoPerfect will also suppress the individual from future outreach through the Services by all customers and, where the individual is present in Customer’s account, will reasonably assist Customer in honouring the request.
GoPerfect shall ensure that its personnel and contractors authorized to process Personal Data are subject to confidentiality obligations.
5.1 Appointment. Customer authorizes GoPerfect to engage Sub-processors to process Customer Data. GoPerfect shall maintain a list of Sub-processors (see Appendix 1), together with a register of the licensed data providers on which the Candidate Database relies, which GoPerfect makes available to Customer under confidentiality obligations on request.
5.2 Notification. GoPerfect shall provide notice of new Sub-processors and allow Customer to object on reasonable grounds within fourteen (14) days of notice.
5.3 Objections. If Customer reasonably objects to a new Sub-processor, GoPerfect shall make efforts to provide an alternative. If no resolution is possible, Customer may terminate the affected Services.
5.4 Agreements. GoPerfect shall enter into data protection agreements with all Sub-processors containing obligations no less protective than this DPA. GoPerfect remains liable for Sub-processors’ performance. GoPerfect’s agreements with providers of large language models prohibit the use of Personal Data to train those providers’ models.
5.5 AI Providers. GoPerfect may use AI providers, including Google (Gemini) and Anthropic (Claude), as Sub-processors, provided that they process only the types of information specified in the Sub-processor List referred to in Appendix 1, do not use the information to train models, and retain it for no more than thirty (30) days.
6.1 Security Measures. GoPerfect shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage, in accordance with its Security Documentation.
6.2 Audits. Upon written request no more than once annually, and subject to confidentiality obligations, GoPerfect shall provide audit reports or facilitate Customer’s audit by providing relevant documentation, or allowing access to facilities, systems, and personnel, as reasonably required. Customer may also request an audit following a Data Incident affecting Customer Data.
6.3 Restrictions. Customer shall avoid or minimize disruption to GoPerfect’s operations when conducting any audit. GoPerfect may satisfy audit requests by providing third-party attestation reports (e.g., SOC 2 Type II), penetration test summaries and its legitimate interests assessment for the Candidate Database.
6.4 SCC Alignment. Nothing in this section shall reduce any audit rights granted under Standard Contractual Clauses or other applicable data transfer mechanisms.
GoPerfect shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after confirming a Data Incident involving Personal Data Processed on behalf of Customer, and shall inform Customer of a suspected Data Incident where it has reasonable grounds to believe that Customer Data is affected. The notification shall describe, to the extent known, the nature of the Data Incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed, and shall be updated as further information becomes available. GoPerfect shall investigate, mitigate, and take necessary steps to remediate the incident, and shall cooperate with Customer’s reasonable requests for information.
Upon termination or expiry of the Agreement, GoPerfect shall (a) make Customer Data available for export for the period stated in the Agreement or, if none is stated, thirty (30) days; (b) delete Customer Data from its production systems within thirty (30) days after the end of that export period; and (c) confirm deletion in writing on Customer’s request. Customer Data held in backups is deleted in accordance with GoPerfect’s backup rotation, under which daily backups are retained for fourteen (14) days, weekly backups for one (1) month and monthly backups for twelve (12) months, and is not restored to production except to recover from an incident. GoPerfect may retain Customer Data to the extent required by law, and will retain hashed identifiers on its suppression list so that individuals who have opted out are not contacted again. Deletion of Customer Data does not affect the Candidate Database, which GoPerfect Processes as independent Controller.
9.1 Adequate Jurisdictions. Personal Data may be transferred to countries recognized as providing an adequate level of protection, including under the EU-US Data Privacy Framework. Israel, where GoPerfect is established, is recognised as adequate by the European Commission and the United Kingdom.
9.2 Standard Contractual Clauses. For other transfers, the Standard Contractual Clauses (SCCs), UK Addendum, or Swiss Addendum shall apply as appropriate.
9.3 Onward Transfers. GoPerfect shall ensure its Sub-processors receiving Personal Data also comply with applicable safeguards, including SCCs if outside of approved jurisdictions.
9.4 Other Regions. For transfers from any other jurisdiction with data export requirements, Parties shall cooperate in adopting required safeguards. Transfers from Israel are made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
10.1 Applicability. Customer may extend this DPA to its Authorized Affiliates, provided that Customer remains responsible for compliance.
10.2 Communication. Customer shall manage all communications with GoPerfect regarding this DPA on behalf of its Authorized Affiliates.
11.1 Impact Assessments. GoPerfect shall assist Customer with data protection impact assessments and consultations with authorities, where required and reasonable.
11.2 Updates and modifications. GoPerfect may update this DPA on reasonable notice to reflect changes in Data Protection Laws or in the Services, provided that an update does not materially reduce the protection given to Customer Data. Each version is identified by its version date and remains available at www.goperfect.com/dpa-[version date]. Any other modification to this DPA comes into effect only when set out in writing and signed by both Parties, or set out as an Agreed Change in an Order Form.
11.3 Candidate Database records. On request and subject to confidentiality obligations, GoPerfect will provide Customer with its legitimate interests assessment for the Candidate Database and a description of the sources and safeguards applying to it, to support Customer’s own impact assessments.
11.4 Group. Where the Agreement is entered into by Talent Fabric Inc., a Delaware corporation and subsidiary of Talent Fabric Ltd., Talent Fabric Inc. contracts and invoices on behalf of the group, and Talent Fabric Ltd. is the entity that Processes Personal Data under the Agreement, as Processor of Customer Data and as independent Controller of the Candidate Database. This DPA binds Talent Fabric Ltd. directly, and Talent Fabric Inc. procures its performance.
11.5 Signed copy. This DPA applies without signature when incorporated through the Agreement. A countersigned copy is available on request at legal@goperfect.com.
Part A: Customer Data (Customer as Controller, GoPerfect as Processor)
Nature and Purpose of Processing: Providing the Services to Customer; performing the Agreement and DPA; acting on Customer instructions; enabling integrations (including synchronisation of candidates with Customer’s applicant tracking system on a user’s instruction, and sending and receiving outreach messages from Customer’s connected email and LinkedIn accounts); generating Match Outputs for Customer’s vacancies; producing aggregated statistics that do not identify any individual; complying with legal obligations.
Duration of Processing: For the duration of the Agreement and the export and deletion periods in Section 8, unless otherwise required by applicable law.
Type of Personal Data: Customer-defined inputs, including identifiers, professional background, contact details, and related metadata; users’ LinkedIn session credentials where the LinkedIn integration is used; Match Outputs; outreach messages and replies; and, where Customer uses automated voice calling in the United States or Canada, call recordings and transcripts.
Categories of Data Subjects: Candidates; Customer employees, contractors, agents; business partners and vendors; other individuals whose data is submitted by Customer.
Part B: Candidate Database (GoPerfect as independent Controller)
Nature and Purpose: Compilation and monthly refresh of professional profiles from licensed data providers; acquisition of contact details on a customer’s request; matching against customers’ vacancies; disclosure to the customer that ran the search.
Type of Personal Data: Name and public profile identifier; work history; education, skills and languages; city or region; public profile content; work email address and, in some cases, personal email address or mobile number. No home address, date of birth or special category data is held.
Categories of Data Subjects: Working professionals worldwide whose profiles appear in licensed datasets.
Lawful basis and rights: Legitimate interests (Article 6(1)(f) GDPR and UK GDPR), as documented in GoPerfect’s legitimate interests assessment. Individuals may object, and request access, rectification or erasure, at privacy@goperfect.com.
The current list of Sub-processors, including the service each provides, the data it receives, its hosting region, and the licensed data providers on which the Candidate Database relies, is published at www.goperfect.com/sub-processors. GoPerfect gives notice of changes to that list under Section 5.2.