Data Processing Agreement (DPA)
Effective Date: August 9, 2026
1. Purpose
This Data Processing Agreement ("DPA") governs the processing of personal information by GATHWAY on behalf of customers who use our Services.
This DPA forms part of the agreement between GATHWAY and the applicable customer and should be read together with the:
2. Definitions
For the purposes of this DPA:
Customer
The organization or individual using GATHWAY.
Personal Information
Information relating to an identified or identifiable individual, as defined by applicable privacy laws.
Processing
Any operation performed on personal information, including collection, storage, organization, use, disclosure, deletion, or destruction.
Subprocessor
A third party engaged by GATHWAY to process personal information on our behalf.
3. Scope
This DPA applies whenever GATHWAY processes personal information on behalf of customers while providing the Services.
Examples include:
User accounts
Professional profiles
Uploaded documents
AI interactions
Analytics
Customer support
Authentication
Subscription management
4. Roles of the Parties
Depending on the circumstances:
The customer may act as the data controller (or equivalent under applicable law).
GATHWAY acts as the data processor (or equivalent) when processing personal information on behalf of the customer.
Where GATHWAY determines the purposes and means of processing for its own operations, it may act as a controller for that processing.
5. Processing Instructions
GATHWAY will process personal information:
Only for the purpose of providing the Services.
In accordance with the customer's documented instructions.
As required by applicable law.
As described in the Terms of Service and Privacy Policy.
If GATHWAY is legally required to process information in a manner inconsistent with customer instructions, we will comply with applicable law and, where permitted, notify the customer.
6. Categories of Personal Information
Depending on the Services used, processing may include:
Contact information
Account information
Professional profiles
Employment history
Education records
Uploaded documents
AI prompts and responses
Usage information
Device information
Billing information
Customer support communications
7. Categories of Individuals
Processing may relate to:
Individual users
Students
Graduates
Job seekers
Employees
Contractors
Recruiters
Administrators
Organization representatives
8. Security Measures
GATHWAY maintains appropriate technical and organizational safeguards designed to protect personal information, including measures such as:
Encryption in transit.
Access controls.
Secure authentication.
Security monitoring.
Audit logging.
Regular software updates.
Backup and recovery procedures.
Security measures are reviewed and improved over time based on risk.
9. Confidentiality
GATHWAY ensures that personnel with access to personal information:
Are bound by confidentiality obligations.
Receive appropriate training.
Access personal information only where necessary to perform their responsibilities.
10. Subprocessors
GATHWAY may engage trusted subprocessors to support the Services, including providers for:
Cloud hosting
Authentication
Payment processing
AI services
Email delivery
Customer support
Analytics
We seek providers with appropriate privacy and security practices and remain responsible for their performance to the extent required by applicable agreements and law.
11. International Data Transfers
Where personal information is transferred across borders, GATHWAY will implement appropriate safeguards where required by applicable law.
These safeguards may include contractual commitments or other legally recognized transfer mechanisms.
12. Assistance
Where appropriate and taking into account the nature of the processing, GATHWAY will provide reasonable assistance to customers in responding to:
Requests from individuals exercising privacy rights.
Security incidents.
Regulatory inquiries.
Compliance obligations.
13. Data Retention and Deletion
Personal information will be retained only as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and protect security.
Upon termination of the Services, personal information will be deleted or returned where appropriate, subject to applicable law and operational backup processes.
14. Security Incidents
If GATHWAY becomes aware of a confirmed security incident affecting customer personal information, we will:
Investigate the incident.
Take reasonable steps to contain and remediate it.
Notify affected customers where required by law or contract.
Cooperate in responding to the incident.
15. Audits
Enterprise customers may request reasonable information regarding GATHWAY's privacy and security practices, subject to confidentiality, security, and operational considerations.
Where appropriate, GATHWAY may provide summaries, certifications, or other evidence instead of direct system access.
16. Changes
This DPA may be updated to reflect:
New Services.
Changes in applicable law.
Security improvements.
Operational changes.
Material changes will be communicated in accordance with our agreements and applicable law.
17. Contact Information
Questions regarding this DPA may be directed to:
GATHWAY Privacy Team
Website:
Privacy:
Legal:
General:
Our Commitment
GATHWAY is committed to processing personal information responsibly, securely, and transparently.
We work to support our customers' privacy obligations while maintaining appropriate safeguards for the information entrusted to us.