Hiring Organization Terms

These Company Terms (the "Terms") govern access to and use of Fika Jobs by companies and other organizations. Fika Jobs is operated by Coffee Chat AI AB, org. no. 559545-9164, Hovås Bautastensväg 9, 436 50 Hovås, Sweden ("Fika Jobs" or "Fika", "we", "us"). "Customer" or "you" means the organization accepting these Terms.

By creating a Customer account, connecting a Connected System, accepting these Terms electronically, or using Fika as a hiring organization, you agree to these Terms, including:

• Schedule 1 — Data Processing Agreement (the "DPA"), and

• Schedule 2 — Marketplace Data Sharing Schedule (the "Marketplace Schedule"),

both of which form part of these Terms. If you do not agree, do not use Fika.

If Fika and Customer have signed a separate written agreement, that agreement supplements these Terms and prevails over them to the extent of any conflict.

Plain-language summary. Fika gives you AI-supported recruitment software connected to your ATS, free of charge today. Separately, Fika may introduce candidates from its own talent pool — always identified as Fika introductions. You only pay when you or an affiliate engage a candidate Fika introduced — as an employee, consultant or otherwise: for employees, 10% of first-year base salary, with a 100% refund (subject to limited exclusions) if the employment ends within 6 months. We do not charge Success Fees for candidates from your own recruitment process. If anything in this summary conflicts with the full Terms, the full Terms govern.

1. Definitions

• "Affiliate" — any entity that controls, is controlled by, or is under common control with a party.

• "Candidate" — an individual whose information is processed through the Services, including applicants, prospective candidates and holders of Fika Profiles.

• "Connected System" — an applicant tracking system (ATS), HR system, calendar or other third-party system that Customer connects to Fika, directly or through an integration provider.

• "Customer Candidate" — a Candidate who, in relation to a given role or recruitment process, entered Customer's recruitment process otherwise than through or as a result of an Introduction — for example by applying to Customer directly or through a job posting or application link (including one distributed by Fika under Section 6), or through Customer's own sourcing. A Candidate does not become a Customer Candidate by applying to or engaging with Customer after, and in connection with, an Introduction of that Candidate. A Candidate's earlier application to, contact with, or presence in the systems of Customer does not prevent a later presentation of that Candidate from Fika's talent pool from being an Introduction; whether a pre-existing relationship removes the Success Fee is determined exclusively under Section 7.6.

• "Customer Data" — data made available to Fika by or on behalf of Customer, including data from Connected Systems, and materials Fika delivers about Customer Candidates into Customer's systems as part of the recruitment software.

• "Engage / Engagement" — to employ or otherwise obtain the services of a Candidate, directly or indirectly, in any capacity — including as an employee, consultant, contractor, freelancer, temporary or interim worker, or through an intermediary, staffing company or personal services company.

• "Fika Profile" — the profile and account a Candidate creates and holds directly with Fika under Fika's Candidate Terms.

• "Introduction / Introduced Candidate" — Fika presenting a Candidate from the Fika talent pool to Customer, or otherwise connecting a Candidate from the Fika talent pool with Customer or a Customer role as part of the talent marketplace — whether in the Services, by email, by insertion into a Connected System, by profile link or by any other means. The Candidate so presented is an "Introduced Candidate". Fika will identify each Introduction as such when it is made. An Introduction does not include the recruitment software: profiles, evaluations, links, statuses and other materials Fika delivers about a Candidate in connection with Customer's own recruitment process for that Candidate are not Introductions, and materials delivered without identification as an Introduction are not Introductions.

• "Services" — Fika's recruitment platform and related services, as they evolve over time, including the functionality described in Section 2.

• "Success Fee" — the fee payable under Section 7 for an Engagement of an Introduced Candidate, calculated under Section 7.2 (employees) or Section 7.4 (other Engagements).

• "Usage Data" — data derived from use of the Services that has been aggregated or anonymized so that it no longer constitutes personal data and does not identify any individual or Customer.

2. The Services

2.1 Fika provides AI-supported recruitment services, currently comprising two components:

(a) Recruitment software. Tools that work with Customer's own recruitment process, including Connected System integrations, candidate invitations, AI-supported candidate conversations and profiles, evaluations, summaries, matching, recommendations, search, analysis and related recruitment functionality; and

(b) Talent marketplace. Fika identifying and introducing Candidates from Fika's own talent pool that may be relevant to Customer's roles.

2.2 The Services are provided at the level of functionality made available from time to time. Fika may add, modify or discontinue features, provided that changes do not affect accrued fees or Introductions already made (Section 18.2).

2.3 The recruitment software described in Section 2.1(a) is currently provided at no charge. Fika's compensation model is the Success Fee under Section 7. Fika may offer additional or paid services on terms agreed separately in writing.

2.4 Fika provides support on a reasonable-efforts basis. No specific availability level, response time or support hours are guaranteed under these Terms; specific service levels may be agreed separately in writing.

3. Accounts and authority

3.1 The individual accepting these Terms or activating the Services confirms that they are authorized to bind Customer, including by accepting the DPA and the Marketplace Schedule on Customer's behalf.

3.2 Customer will keep its account information accurate and current, ensure its users keep credentials confidential, and is responsible for activity under its accounts.

4. Connected Systems

4.1 Authorization and instruction. By connecting a Connected System or enabling a feature that uses it, Customer authorizes and instructs Fika to access, read, import, store, structure, analyze, use, sync and write data to that Connected System as needed to provide the Services, in accordance with the DPA. This may include candidate records, applications, CVs and attached or derived information (including LinkedIn-derived information already in the system), jobs, notes, feedback, interview and pipeline data, statuses, scheduling data and other recruitment information, including historical records.

4.2 Customer warranties. Customer represents and warrants that it has collected and holds Customer Data in compliance with applicable law, and that it has, and will maintain, the rights, permissions, notices and lawful bases required for Fika to access and process Customer Data as described in these Terms and the DPA — including historical candidate and application data — and that its candidate-facing privacy information covers its use of service providers in its recruitment process. Each party is otherwise responsible for its own compliance with data protection law in its own role.

4.3 Access. Customer will maintain the Connected System access needed for the Services during the term. Fika is not responsible for the acts, omissions, availability, security or data quality of Connected Systems or their providers, or for the consequences of Customer disconnecting or misconfiguring them.

5. Candidate invitations and Fika Profiles

5.1 Where enabled, Customer instructs Fika to invite Customer Candidates — including by email and reminders sent from Fika's systems — to complete an AI-supported conversation and create a candidate profile in connection with Customer's recruitment process, and to prepare that experience using Customer Data.

5.2 Customer is responsible for informing its applicants about its recruitment process and the service providers used in it, as required by applicable law. Fika is responsible for informing Candidates about Fika's own processing.

5.3 Customer acknowledges that Candidates may choose to create a Fika Profile — an account held directly with Fika under Fika's Candidate Terms and Privacy Policy. From the point a Candidate creates a Fika Profile, Fika processes the Fika Profile as an independent controller as described in the DPA. Copies of candidate materials delivered into Customer's Connected System remain Customer's responsibility as controller.

6. Promotion of Customer roles

Customer grants Fika the right to publish, distribute and otherwise promote Customer's job openings and related public employer and role information (including name and logo) for recruitment purposes, through the Services and through third-party channels. Candidates who apply through job postings or application links distributed under this Section are Customer Candidates; a Candidate presented from Fika's talent pool as an identified Introduction remains an Introduced Candidate. Customer may withdraw this right for specific roles or channels by written notice.

7. Introductions and Success Fees

7.1 The deal. If Fika makes an Introduction and Customer or an Affiliate Engages that Candidate within 12 months of the Introduction, Customer pays Fika the applicable Success Fee. This applies regardless of the role, team, function or capacity in which the Candidate is Engaged, and even if the Candidate was earlier rejected or not progressed for another role. An Engagement is treated as made within the attribution period if, within 12 months of the Introduction, an offer is made, the engagement documentation is entered into, or the Candidate begins providing services — even if the other events occur later. An Engagement made indirectly through an intermediary, or by an Affiliate, is fee-bearing where Customer or the Affiliate selected or requested the Candidate or knew, or reasonably should have known, that the person was an Introduced Candidate.

7.2 Success Fee — employees. For an Engagement as an employee, the Success Fee is 10% of the Candidate's gross annual base salary for the role as at the start of the Engagement (or, if higher, as stated in the offer), unless otherwise agreed in writing. Base salary excludes bonus, commission, on-target earnings, equity, benefits, pension and other variable or non-cash compensation; however, guaranteed or minimum payments that substitute for base salary count as base salary. For part-time roles, the fee is calculated on the actual annualized part-time salary, not a full-time equivalent. If base salary or contracted working time is increased within 6 months of the start date, the fee is recalculated on the increased basis and the difference invoiced. The fee is calculated in the salary currency and payable per Section 7.7.

7.3 Refund guarantee — employees. If the Candidate's employment ends within 6 months of their start date, Fika will refund 100% of the Success Fee paid for that Candidate, provided that:

(a) Customer notifies Fika in writing within 30 days of the employment ending, with brief details; and (b) the Success Fee has been paid in full.

The guarantee does not apply where the employment ends because of: redundancy, restructuring, role elimination or a hiring freeze; expiry of a fixed term or other time-limited arrangement agreed at or before the start of the employment; a material adverse change by Customer or its Affiliate to the role, compensation, location or working conditions compared with the original offer; or Customer's or its Affiliate's breach of the employment agreement or applicable employment law. For clarity, the guarantee covers resignation by the Candidate and termination for reasons relating to the Candidate's performance or conduct. If the Candidate does not start the employment at all, no Success Fee is payable and any amount already invoiced or paid is cancelled or refunded.

Eligible refunds are paid in cash within 30 days of Fika receiving the notice under (a) and any information reasonably needed to confirm the guarantee applies. If Customer or an Affiliate re-Engages the Candidate within 12 months after a refund, the Success Fee becomes payable again. This guarantee is available once per Candidate and is Customer's exclusive remedy in respect of an Engagement ending.

7.4 Success Fee — consultants and other engagements. For an Engagement other than as an employee, the Success Fee is 10% of the fees and other compensation paid or payable for the Candidate's services during the first 12 months of the Engagement — whether paid to the Candidate or to an intermediary, but excluding VAT, documented pass-through expenses, and charges not attributable to the Candidate's services. Fika invoices this fee periodically in arrears based on amounts invoiced or payable for the relevant period. The refund guarantee in Section 7.3 does not apply to non-employee Engagements.

7.5 Conversion. If a Candidate first Engaged other than as an employee is Engaged as an employee within 12 months of the start of the original Engagement, at any time while the original Engagement (or a continuation of it) is ongoing, or within 3 months after it ends, the employee Success Fee under Section 7.2 becomes payable, less Success Fees already paid for that Candidate under Section 7.4.

7.6 Pre-existing relationships — no fee for your own candidates. No Success Fee is payable if, before the Introduction, Customer had a genuine pre-existing recruitment relationship with the Candidate, meaning any of the following:

(a) the Candidate applied to Customer within the 12 months before the Introduction; (b) Customer and the Candidate had substantive two-way communication about potential employment within the 12 months before the Introduction; (c) the Candidate was actively participating in Customer's recruitment process at the time of the Introduction; or (d) the Candidate was employed or otherwise engaged by Customer or an Affiliate within the 12 months before the Introduction.

The following do not by themselves establish a pre-existing recruitment relationship: the Candidate's mere presence in Customer's ATS, database, sourcing list or files; internal recruiter discussions or notes; passive sourcing or identification of the Candidate; an employee referral where there has been no meaningful recruitment engagement with the Candidate; automated or manual outbound, unanswered outreach, or other one-way communication that did not result in substantive engagement by the Candidate. What matters is meaningful engagement with the Candidate, not that Customer had previously identified or contacted them. A trivial response — such as an unsubscribe, a rejection, an automated reply or a similarly non-substantive reply — does not by itself create a pre-existing recruitment relationship.

To rely on this Section, Customer notifies Fika within 30 days of the Introduction being identified to Customer (or, where Fika asks about a specific Candidate, within 30 days of that request), identifying the record it relies on and providing reasonable supporting evidence. Fika may, at its discretion, accept a later claim supported by clear records. If Customer does not notify Fika within the applicable period, the Introduction is deemed the effective cause of any Engagement within the attribution period and the Success Fee is payable.

7.7 Disclosure, invoicing and payment.

(a) Customer will promptly notify Fika if Customer or an Affiliate makes an offer to, or Engages, an Introduced Candidate within 12 months of the Introduction (including offers later withdrawn or declined), and will on request provide accurate compensation and engagement details reasonably needed to calculate the fee. (b) If Customer does not provide the information within 10 business days of a written request to its designated contact, Fika may invoice based on its reasonable, documented estimate of the relevant compensation. The estimate is payable and will be adjusted — by credit or supplemental invoice — once actual figures are evidenced. (c) Fika invoices on or after the Candidate's start date (or, where Customer failed to notify under (a), when Fika becomes aware of the Engagement). Invoices are payable within 30 days. Fees are exclusive of VAT and similar taxes. Late payments accrue interest under the Swedish Interest Act (räntelagen). Invoice disputes must be raised in good faith within 15 business days of receipt; undisputed portions remain payable when due. (d) On Fika's request, Customer will confirm within 10 business days whether it or an Affiliate has made an offer to, or Engaged, a named Introduced Candidate within the attribution period, and will keep records reasonably sufficient to demonstrate compliance with this Section 7 during the attribution period and for 12 months after it.

7.8 Anti-circumvention. Introductions are made for Customer's own hiring. If Customer discloses an Introduced Candidate's information to a third party (other than its professional advisers and service providers bound by confidentiality and assisting with Customer's own hiring) and that third party Engages the Candidate within 12 months of the Introduction, the Success Fee is payable by Customer as if Customer had made the Engagement, and no refund applies. Customer will not, and will ensure its Affiliates do not, structure an Engagement or otherwise act so as to avoid or reduce a Success Fee that would otherwise be due; any Success Fee avoided or reduced in breach of this Section is payable by Customer as a debt.

8. Customer obligations

Customer will:

(a) use Candidate information received through the Services only for its own genuine recruitment purposes and in accordance with the Marketplace Schedule (for data disclosed by Fika as controller) and applicable law; (b) comply with applicable employment, anti-discrimination and data protection law in its recruitment; (c) keep profiles, evaluations and other materials about Introduced Candidates confidential per Section 12; and (d) use the Services only for its own internal hiring (or, where agreed in writing, hiring for identified clients), and not to provide recruitment services to third parties.

9. AI features and hiring decisions

9.1 The Services use artificial intelligence, including for the recruitment functionality described in Section 2.1. The Services are designed to assess job-relevant information about candidates as decision support for recruitment, and must not be used for any other purpose. Outputs of AI features ("Outputs") may be incomplete or inaccurate and must be independently assessed before being relied on.

9.2 Customer makes the hiring decisions. Fika does not make hiring or employment decisions. Customer is solely responsible for its recruitment and hiring decisions, will ensure appropriate human review of Outputs before decisions are made about a Candidate, and will not make a decision producing legal or similarly significant effects for a Candidate based solely on Outputs.

9.3 To the extent the Services include AI systems regulated under Regulation (EU) 2024/1689 (the AI Act) or similar law, each party is responsible for the obligations that apply to it in its role in the AI value chain, as and when those obligations become applicable. Fika will provide the information, documentation and instructions required of it under applicable law in respect of Customer's use of the Services; Customer will use the Services in accordance with Fika's documentation and instructions, ensure appropriate human oversight, provide Candidates with any notices required of it, and promptly inform Fika of any serious incident or malfunction of AI features that it identifies, reasonably cooperating with Fika's own legal obligations. Customer will not remove, suppress or obscure AI transparency disclosures, notices or markings that Fika presents or applies.

9.4 Fika may modify the Services and issue reasonable usage instructions where needed to comply with applicable law.

10. Acceptable use

Customer will not, and will not permit anyone to:

(a) use the Services or any Output in any manner prohibited by applicable law, including any practice prohibited under the AI Act, or to discriminate unlawfully; (b) modify, repurpose or integrate the Services in a way that changes their intended purpose; (c) reverse engineer, scrape, probe or benchmark the Services, build a competing product using them, or use them or any Output to train or improve a competing system; (d) interfere with the Services' security or integrity, or access data of other customers or of Candidates beyond what the Services intentionally make available; or (e) misrepresent to any Candidate the nature of the Services or of Customer's recruitment process.

Fika may suspend access where reasonably necessary to address a breach of this Section, security risk or legal requirement, restoring it when the issue is resolved.

11. Data protection

11.1 Roles. Where Fika processes personal data from Customer's sphere — including Connected System data, candidate invitations and customer-specific analysis and recommendations — Customer is the controller and Fika the processor, and the DPA (Schedule 1) applies. Where Fika, as an independent controller, discloses Candidate data to Customer — through an Introduction or at a Candidate's direction — the Marketplace Schedule (Schedule 2) applies. Fika is an independent controller of Fika Profiles (Section 5.3), of its own account, billing and business-contact data, and of Usage Data. Fika does not use Customer Personal Data (as defined in the DPA) to source, match or introduce candidates to any other customer (DPA Section 1.3).

11.2 Usage Data. Fika may create and use Usage Data to operate, analyze, develop, improve and secure the Services, including AI functionality. Fika does not use identifiable Customer Data to train generalized AI models (meaning models made available to other customers or third parties); customer-specific configuration and tuning used solely for Customer remains part of the Services.

12. Confidentiality

Each party will keep the other's confidential information confidential, use it only to perform under these Terms, and protect it with at least reasonable care. Profiles, evaluations and other materials about Introduced Candidates are Fika's and the relevant Candidate's confidential information; Customer's rights in Customer Data — including materials Fika delivers about Customer Candidates into Customer's systems — are unaffected. Confidential information may be disclosed where required by law (with notice where lawful) and to professional advisers under confidentiality. These obligations survive for 3 years after termination (indefinitely for trade secrets and personal data).

13. Intellectual property

13.1 Fika and its licensors own the Services and all related intellectual property, including software, interfaces, workflows, models, methods, algorithms, know-how, and improvements and derivatives. No rights are granted except as expressly stated.

13.2 Customer owns Customer Data. Customer grants Fika the rights in Customer Data needed to provide the Services in accordance with these Terms and the DPA, and the rights in Section 6 and Section 11.2.

13.3 Fika may use feedback without restriction. Fika may identify Customer by name and logo as a customer unless Customer objects in writing.

14. Warranties and disclaimers

14.1 Each party warrants it has the right and authority to enter into these Terms.

14.2 Except as expressly stated, the Services are provided "as is" and "as available". Fika does not warrant uninterrupted or error-free operation, the accuracy or completeness of any Output or candidate information, or any particular number of candidates, responses, interviews, offers or hires. Fika does not conduct background, reference, qualification, right-to-work or similar checks unless expressly agreed in writing, and does not employ Candidates or act as employer of record.

15. Indemnities

15.1 By Customer. Customer will defend and indemnify Fika against third-party claims (including by Candidates and authorities) and resulting damages, penalties and reasonable costs arising from: (a) breach of Customer's warranties in Section 4.2; (b) Customer's recruitment, hiring or employment decisions or conduct; (c) Customer's breach of Sections 8, 10 or the Marketplace Schedule; or (d) negligent or materially incorrect information or instructions Customer provides to Fika.

15.2 By Fika. Fika will defend and indemnify Customer against third-party claims that the Services, as provided by Fika and used in accordance with these Terms, infringe intellectual property rights, and will pay resulting damages and reasonable costs finally awarded or agreed in settlement. Fika may procure rights, modify or replace the affected Services, or terminate the affected Services. This Section states Customer's exclusive remedy for infringement.

15.3 The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and reasonably cooperate.

16. Liability

16.1 Neither party is liable for indirect or consequential damages, loss of profits, revenue, goodwill, business opportunity or data, except as stated in Section 16.3. Success Fees due under Section 7, and amounts equal to Success Fees that would have been payable but for Customer's breach, are payment obligations — not excluded loss of profits or revenue. The exclusion of loss of data does not apply to Fika's breach of the DPA or of its security obligations, which remains subject to the cap in Section 16.2.

16.2 Each party's total aggregate liability under or in connection with these Terms (including the DPA and the Marketplace Schedule, as a single combined cap) is limited to the fees paid or payable by Customer in the 12 months before the event giving rise to liability.

16.3 Nothing limits liability for intentional misconduct or gross negligence, for Customer's payment obligations (including amounts payable under Section 7.8), for Customer's indemnities and its breach of Section 4.2, or for anything that cannot be limited under applicable law.

17. Term, suspension and termination

17.1 These Terms apply from acceptance until terminated. Either party may terminate at any time with 30 days' written notice; either party may terminate immediately for material breach not cured within 14 days of notice. Fika may suspend or terminate immediately for serious misuse or where legally or security-wise necessary, and may suspend for non-payment where an undisputed amount is more than 14 days overdue after written notice (amounts disputed in good faith under Section 7.7(c) do not trigger suspension).

17.2 Termination does not affect accrued rights. Sections 7 (for Introductions made before termination, including the 12-month attribution period), 8, 11–16 and 19 survive. The DPA and the Marketplace Schedule survive in respect of personal data received or processed before termination, for as long as that data is processed. Data handling on termination follows the DPA and the Marketplace Schedule.

18. Changes

18.1 Fika may update these Terms. For changes that materially and adversely affect Customer, Fika will give at least 30 days' notice by email or in the Services, and the change takes effect only after that period. Other changes — including those required by law, new features or services, and changes that do not reduce Customer's rights or increase its obligations — may take effect on posting.

18.2 If Customer does not accept a materially adverse change, it may terminate before the change takes effect. Continued use after the effective date constitutes acceptance. Changes never apply retroactively to accrued fees or to Introductions already made, and any change to Success Fee levels applies only to Introductions made after the change takes effect.

18.3 The DPA and the Marketplace Schedule may be amended only as stated in those Schedules, not under this Section 18.

19. General

19.1 These Terms (including the Schedules and any signed agreement under the introduction above) are the entire agreement regarding the Services. If there is a conflict, a signed agreement prevails, then these Terms, except that the DPA prevails for the processing it governs and the Marketplace Schedule prevails for the sharing it governs.

19.2 Neither party is liable for delay or failure caused by events beyond its reasonable control, including outages of Connected Systems or third-party AI or infrastructure providers that the affected party could not reasonably avoid or work around, provided it works to mitigate and restore.

19.3 Customer may not assign these Terms without Fika's consent (not to be unreasonably withheld); Fika may assign to an Affiliate or in connection with a merger or sale. Customer may designate legal/privacy and billing notice addresses in its account; Fika will send deadline-bearing notices (changes under Section 18, DPA and subprocessor notices, invoices and fee-related notices) to the designated addresses, or otherwise to the email addresses on the account. Notices to Fika: support@fikajobs.ai.

19.4 If a provision is held invalid, the remainder stands. Failure to enforce is not waiver.

19.5 These Terms are governed by Swedish law. Disputes are subject to the exclusive jurisdiction of the courts of Stockholm, Sweden, with the Stockholm District Court as first instance, unless mandatory law provides otherwise.

Schedule 1 — Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Fika Jobs Company Terms (the "Terms") between Coffee Chat AI AB ("Fika") and Customer. It is entered into when Customer accepts the Terms and applies for as long as Fika processes Customer Personal Data. Capitalized terms not defined here have the meaning in the Terms. In case of conflict, this DPA prevails over the Terms for the processing it governs.

1. Scope and roles

1.1 This DPA governs Fika's processing of "Customer Personal Data": personal data that Fika processes on Customer's behalf in providing the Services, including personal data from Connected Systems and personal data processed in the invitation, candidate-conversation, analysis, recommendation and write-back activities described in Annex A. For this processing, Customer is the controller (or, where Customer acts for its own client, a processor instructing Fika as subprocessor, in which case Customer warrants that its instructions reflect its controller's instructions) and Fika is the processor.

1.2 This DPA does not govern:

(a) Fika Profiles. Where a Candidate creates a Fika Profile and accepts Fika's Candidate Terms, Fika processes the Fika Profile and related account data as an independent controller under Fika's Privacy Policy. Customer acknowledges this and, as part of the Services, instructs Fika to enable Candidates to create Fika Profiles (see Annex A, instruction 7). Candidate materials delivered into Customer's systems remain Customer Personal Data under Customer's control;

(b) Fika's disclosure of Candidate data to Customer as an independent controller under the Marketplace Schedule (through an Introduction or at a Candidate's direction). However, once such data has been delivered into Customer's systems (including a Connected System), the copy in Customer's systems is Customer Personal Data, and Fika's subsequent processing of that copy on Customer's behalf in providing the Services is governed by this DPA; and

(c) Usage Data, and personal data Fika processes as an independent controller for its own account administration, billing, business contacts, security and legal compliance.

1.3 Fika does not use Customer Personal Data to source, match, market to, or introduce candidates to any other customer. Fika's marketplace processing for a Candidate begins only from data the Candidate provides or imports under their own Fika Profile.

2. Instructions

2.1 Fika will process Customer Personal Data only on Customer's documented instructions, including regarding transfers, unless required otherwise by EU or Member State law (in which case Fika will inform Customer before processing, unless the law prohibits it).

2.2 Customer's documented instructions are: (a) this DPA and the processing described in Annex A; (b) the Terms; (c) Customer's use and configuration of the Services, including connecting Connected Systems and enabling features (each of which constitutes a documented instruction to carry out the associated processing described in Annex A); and (d) additional reasonable written instructions consistent with the Terms. Section 6 always governs the addition or replacement of subprocessors; feature enablement authorizes only subprocessors notified under Section 6.

2.3 Fika will immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law, and may suspend the instruction until it is confirmed or amended.

3. Customer responsibilities

Customer is responsible for: the lawfulness of the processing it instructs, including a valid legal basis; providing data subjects with the information required of it as controller (including informing its applicants about the use of service providers in its recruitment process); the accuracy and lawful origin of Customer Personal Data; and its configuration choices in the Services, including retention settings and which Candidates are invited.

4. Confidentiality

Fika ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations and process it only as needed to provide the Services.

5. Security

Fika implements and maintains appropriate technical and organizational measures as described in Annex B, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing and the risks involved. Fika may update these measures, provided the overall level of protection is not materially reduced.

6. Subprocessors

6.1 Customer provides a general authorization for Fika to engage subprocessors. Fika maintains a current list of subprocessors and makes it available to Customer on request; the list is incorporated into this DPA as Annex C.

6.2 Fika will give Customer reasonable advance notice, by email (to Customer's designated notice address where one has been designated under Section 19.3 of the Terms), of any intended addition or replacement of a subprocessor, giving Customer the opportunity to object in writing within 14 days of the notice on reasonable, documented data protection grounds. For a subprocessor engaged solely for a new feature or service that Customer must affirmatively enable, notice may instead be given no later than when the feature is made available, and that subprocessor processes Customer Personal Data only from Customer's enablement of the feature. In urgent cases (security or continuity), Fika may make a change immediately and notify Customer without undue delay, with the same objection right. Where Customer objects, the parties will discuss in good faith; if Fika cannot reasonably address the objection (including by offering an alternative), Customer may, as its sole remedy, terminate the affected Services.

6.3 Fika will impose data protection obligations on each subprocessor that are in substance the same as those in this DPA and remains fully responsible for its subprocessors' performance.

6.4 Connected System providers act on Customer's behalf, not Fika's, and are not Fika's subprocessors.

7. International transfers

7.1 Fika transfers Customer Personal Data outside the EU/EEA only in compliance with Chapter V GDPR. Where Fika engages a subprocessor outside the EU/EEA (or one that processes outside the EU/EEA), Fika will ensure the transfer is covered by an adequacy decision (including the EU–US Data Privacy Framework where applicable) or by the European Commission's Standard Contractual Clauses ("SCCs") concluded between Fika and the subprocessor (appropriate module, with supplementary measures where needed), or by another valid transfer mechanism. The mechanism per subprocessor is stated in the subprocessor list.

7.2 If Fika itself ever processes Customer Personal Data outside the EU/EEA, the SCCs (controller-to-processor module, or processor-to-processor module where Customer is a processor) are incorporated into this DPA by reference, with Customer as data exporter and the relevant Fika entity as data importer, completed by the information in Annexes A–C. If the SCCs are amended or replaced by the European Commission, the updated mechanism applies.

8. Assistance

8.1 Fika will promptly notify Customer of any data subject request it receives concerning Customer Personal Data and will not respond to it, except to refer the data subject to Customer or where legally required. Taking into account the nature of the processing, Fika will assist Customer with appropriate technical and organizational measures in fulfilling data subject requests.

8.2 Fika will reasonably assist Customer, taking into account the nature of the processing and the information available to Fika, with Customer's obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Fika may charge reasonable costs for assistance that goes materially beyond what the Services include, and will inform Customer before doing so.

9. Personal data breach

Fika will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed; information may be provided in phases as it becomes available. Fika's notification is not an acknowledgement of fault. Customer decides on notifications to authorities and data subjects for processing under this DPA.

10. Audits

10.1 Fika will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, in the first instance in documented form.

10.2 If that information is reasonably insufficient, Customer (or an independent auditor bound by confidentiality, not a competitor of Fika) may audit Fika's compliance with this DPA: no more than once per 12 months (except after a personal data breach affecting Customer Personal Data or where required by a supervisory authority), on at least 30 days' written notice, during business hours, without access to other customers' or candidates' data or to Fika's proprietary technology beyond what is necessary, and in accordance with Fika's reasonable security procedures. Each party bears its own audit costs. Fika will remediate any material non-compliance with this DPA identified by an audit without undue delay.

11. Deletion and return

11.1 During the term, Fika processes and retains Customer Personal Data in accordance with Customer's instructions and configurations, including deletions Customer makes in a Connected System that are synced to Fika.

11.2 Upon termination or expiry of the Services, Fika will, at Customer's written election made within 30 days, return and/or delete Customer Personal Data. If no election is made, Fika will delete it without undue delay after the 30-day period. Data in backups is deleted in the ordinary backup cycle and is not otherwise processed. Fika may retain Customer Personal Data where Union or Member State law requires storage.

12. Liability

Liability under this DPA is subject to the limitations and exclusions of the Terms, and the cap in the Terms applies once, in aggregate, across the Terms, this DPA and the Marketplace Schedule. Nothing in this Section affects data subjects' rights or either party's liability to data subjects or supervisory authorities under applicable law.

13. Amendments

This DPA may be amended only in writing, except that Fika may update it by notice where reasonably necessary to comply with data protection law or decisions of competent authorities; if such an update materially reduces Customer's protections, Customer may object and terminate the affected Services as its sole remedy. Updated SCCs or successor transfer mechanisms apply as described in Section 7 of this DPA. The general change mechanism in the Terms does not apply to this DPA.

Annex A — Description of processing

Subject matter and duration. Fika's processing of Customer Personal Data to provide the Services under the Terms, for the duration of the Terms plus the wind-down period in Section 11 of this DPA.

Nature and purposes of processing (documented instructions). Fika processes Customer Personal Data to provide recruitment services to Customer, including to:

1. Connect and sync. Access, read, import, store, structure and sync data from Customer's Connected Systems, and write recruitment-related information back to them (including candidate profile links, profile information, summaries, evaluations and statuses).

2. Invite candidates. Identify applicants to be invited, prepare and pre-populate the candidate experience using Customer Data (including CVs and application data), and send invitation and reasonable reminder communications from Fika's systems in connection with Customer's recruitment process. These communications identify the Customer as the party on whose behalf they are sent, are limited to Customer's recruitment process, and do not promote unrelated services.

3. Run candidate conversations. Conduct AI-supported conversations/interviews with Customer Candidates for Customer's recruitment process, and create recordings, transcripts, summaries, evaluations and structured profile information as part of the Services.

4. Analyze and recommend. Analyze Customer Data, including historical applications, candidates, jobs, outcomes, notes and feedback, to provide Customer-specific matching, evaluation, recommendation, search, ranking and related recruitment functionality. Insights derived from Customer Personal Data under this instruction are used solely to provide the Services to Customer and are not used for any other customer or for Fika's own products, except in the form of Usage Data.

5. Operate and support. Host, secure, maintain, troubleshoot and support the above.

6. Aggregate. Create data that has been aggregated or anonymized so that it no longer constitutes personal data and does not identify any individual or Customer (Usage Data).

7. Facilitate Fika Profiles. Where a Candidate chooses to create a Fika Profile, enable signup from the invitation and conversation flow and, at the Candidate's direction, make the candidate materials processed under this DPA (including CV and application data, recordings, transcripts, summaries, evaluations and structured profile information) available to the Candidate and their Fika Profile. From receipt into the Fika Profile, Fika processes that copy as an independent controller (Section 1.2(a) of this DPA); the copy in Customer's systems remains Customer Personal Data.

Fika does not use identifiable Customer Personal Data to train generalized AI models (meaning models made available to other customers or third parties).

Categories of data subjects. Customer's candidates and applicants (current and historical); Customer's personnel appearing in recruitment data (e.g., recruiters, hiring managers, interviewers); other individuals appearing in Connected System records (e.g., references).

Categories of personal data. Identification and contact details; CV/application data and attachments; professional background, education and skills; LinkedIn URLs and derived information already present in Customer's systems; job, pipeline, interview, evaluation, feedback and status information; communications and scheduling data; recordings, transcripts, summaries and evaluations created through the Services; technical identifiers.

Special categories. Not required by the Services and not requested. Recruitment data and free-form conversation content may incidentally contain special-category data volunteered by individuals; Customer is responsible for a lawful basis for any such data in its recruitment process.

Retention. Per Customer's instructions and configurations during the term (including sync of Customer-side deletions); on termination, per Section 11 of this DPA. Data processed to prepare an invited candidate's experience is retained only as needed for Customer's recruitment process and the operation of the Services.

Annex B — Technical and organizational measures

Fika implements and maintains technical and organizational measures appropriate to the risk, as required by Article 32 GDPR, including as appropriate:

• Access control: access to personal data limited on a need-to-know basis, with appropriate authentication and timely revocation.

• Encryption: encryption of personal data in transit and at rest.

• Separation: appropriate controls to keep different customers' data separate and to distinguish data processed on customers' behalf from data Fika processes as controller.

• Operations and development security: measures to identify and address vulnerabilities and to maintain the security of production systems and changes to them.

• Resilience and recovery: backups and measures to restore availability and access to personal data in a timely manner after an incident.

• Personnel: confidentiality undertakings and appropriate awareness of security and data protection responsibilities.

• Vendors: risk-based selection of subprocessors with contractual security obligations.

• Incident management: procedures for detecting, assessing, containing and notifying personal data breaches.

• Physical security: production infrastructure hosted with established providers maintaining appropriate physical and environmental controls.

Further information is available to Customer on reasonable request under Section 10.1.

Annex C — Subprocessors

Fika maintains a current subprocessor list, including each subprocessor's role, location and transfer mechanism, makes it available to Customer on request, and updates it in accordance with Section 6.

Schedule 2 — Marketplace Data Sharing Schedule

This Marketplace Data Sharing Schedule (the "Marketplace Schedule") forms part of the Fika Jobs Company Terms and governs "Shared Candidate Data": personal data of Candidates that Fika, as an independent controller, discloses to Customer — whether through an Introduction or at the Candidate's direction (for example an application or expression of interest made through Fika) — excluding data Fika processes as Customer's processor under the DPA. Capitalized terms have the meaning given in the Terms or, for "Customer Personal Data", in the DPA (Schedule 1). In case of conflict, this Schedule prevails over the Terms for the sharing it governs.

1. Roles

1.1 For Shared Candidate Data, Fika and Customer are each a separate and independent controller. The parties are not joint controllers, and neither processes Shared Candidate Data on the other's behalf — except that, once Shared Candidate Data has been delivered into Customer's systems (including a Connected System), the copy in Customer's systems is Customer Personal Data and Fika's subsequent processing of that copy on Customer's behalf in providing the Services is governed by the DPA.

1.2 Fika is responsible for the lawfulness of its disclosure to Customer. Fika discloses Candidate data on the basis of the Candidate's relationship with Fika, as described in Fika's Candidate Terms and Privacy Policy.

2. Customer obligations

Customer will, as controller of Shared Candidate Data:

(a) Purpose limitation. Process it only to evaluate and Engage the Candidate for the role(s) concerned or other genuine recruitment opportunities within Customer and its Affiliates, and for related administration — not for any unrelated purpose, and not for marketing;

(b) Transparency and rights. Provide the Candidate with its own privacy information as required by law, and handle data subject requests it receives as controller;

(c) Security. Protect it with appropriate technical and organizational measures, including limiting access to those involved in the recruitment;

(d) Breach notice. Notify Fika without undue delay after becoming aware of a personal data breach affecting Shared Candidate Data, with information reasonably sufficient for Fika to meet its own obligations;

(e) Deletion. Delete or anonymize Shared Candidate Data when it is no longer needed for the purposes in (a), and in any event on the Candidate's valid request or objection communicated by Fika or the Candidate, except where Customer has an independent legal ground to retain it (for example, an application the Candidate has made to Customer, or defense of legal claims);

(f) Access and retention limits. Where Fika gives Customer access to a Candidate's profile hosted by Fika rather than providing a separate copy, not extract, download, scrape or otherwise retain that data beyond what Customer records in its own recruitment file for the recruitment concerned, and respect the withdrawal of that access by Fika or the Candidate;

(g) No onward disclosure. Not disclose it to third parties other than its Affiliates and service providers assisting with the recruitment under confidentiality, or as required by law — Section 7.8 of the Terms (anti-circumvention) also applies; and

(h) Transfers. Not transfer it outside the EU/EEA except in compliance with Chapter V GDPR.

3. Fika obligations

Fika warrants that it has provided the Candidate with the transparency information required for its disclosure of Shared Candidate Data. Shared Candidate Data comprises the Candidate's profile information, together with materials generated through the Candidate's use of Fika (such as recordings, transcripts, summaries and evaluations), as described in Fika's Candidate Terms and Privacy Policy. Candidate-provided information is supplied by or derived from Candidates; Fika does not verify it (Section 14.2 of the Terms applies).

4. Duration, liability and changes

This Schedule survives termination or expiry of the Terms and continues to apply to all Shared Candidate Data received before termination, for as long as Customer processes it. Liability under this Schedule is subject to the limitations of the Terms and counts toward the single aggregate cap in the Terms. Fika may update this Schedule by notice where reasonably necessary to comply with data protection law; if such an update materially reduces Customer's protections or expands its obligations, Customer may object and terminate the affected Services as its sole remedy. The general change mechanism in the Terms does not apply to this Schedule.