Data export and EU Data Act information

1. Getting your data out

You can ask Omniteam in writing for a copy of your data, as your agreement describes: during the term, at its end, or when you switch to another provider or to your own systems. Customers on an online plan write to [email protected]; customers with a signed agreement send the request as that agreement provides. Omniteam prepares the export and supplies it as one download package within the periods in your agreement, without charge. The download link stays valid for 7 days; if it has expired, ask again and a new package is prepared without charge.

1.1 What the package contains

The package is one ZIP archive with these parts:

1.2 Which data is included

The package holds the data you and your users entered or uploaded and the data the service generated about your recruitment, as far as it is still held under your retention settings:

• organisation: profile, branding, departments, templates and settings (including retention, recording and AI-assistant settings and their history); users, roles and invitations;
• jobs: descriptions, requirements, competencies, interview guides, questions and stages, job summaries;
• candidates: records, CVs and cover letters (files and text), applications, stage history and decisions;
• talent pool: profiles, documents, job assignments and match results;
• CV and cover letter analyses;
• interviews: schedules, recordings, transcripts, speaker assignment, meeting details, guest join records, room join records, summaries, evidence, open points and corrections;
• team input: notes, ratings, comments, drafts and versions, and their AI summaries and translations;
• Ask Omni conversations;
• connected AI assistants: connections, consents, switch history and request records;
• integrations: calendar and meeting-platform data and applicant-tracking sync data;
• billing and usage: subscription, payments and usage counts;
• records: audit and activity logs, consent records, data subject requests, and retention and deletion records.

A type of data the service adds later is included from the moment it is stored. The data structure description in each package lists every file and field in it.

1.3 What is not included, and known limits

The package does not include Omniteam's software, models or other know-how, or the following data specific to the internal functioning of the Service: the text of prompts and instructions to AI models; processing queues; cached replies of AI providers; the internal step backups of Ask Omni; the internal control log of the AI interviewer; delivery logs of the meeting-recording provider; system logs and other records not tied to an organisation; internal deletion bookkeeping (the records of files and index entries being deleted); reference data that is the same for every customer; passwords, sign-in and invitation codes, keys and access tokens; public join codes and links; the external sign-in identifiers of connected AI assistants; short-lived sign-in steps; verification and correlation tokens; the internal stored value of possible-mismatch pairs, which is exported as a label with both statements; and the hashes kept only to prevent deleted persons from being imported again. For a member who also belongs to another organisation, the member's own feedback, marketing attribution, consent, assistant-link, external sign-in account, credit and payment records are not part of this organisation's export. In the export, IP addresses are masked in part, browser details are reduced to the browser and its major version, and signed access parameters are removed from links. Data in this list that is personal data is deleted at the end of the Service under the data processing agreement. These exclusions do not impede or delay switching. Files at an address outside Omniteam's storage are listed but not copied, and files that cannot be found in storage are listed in the manifest.

2. Where the service runs

Omniteam.ai B.V. is a company under Dutch law. The service runs on this infrastructure:

The Azure data centres used for the service and Recall.ai's region are in EU Member States, and their law and EU law apply there. Cloudflare, LiveKit and Stripe are not limited to the EU. All these providers are, or belong to, companies in the United States, so United States law can also apply to them. Sign-in with Google or Microsoft and calendar connections run through the customer's own accounts with those providers. The full list of sub-processors is at omniteam.ai/en/subprocessors.

3. Protection against access by authorities outside the EU

Article 32 of the Data Act requires Omniteam to take adequate measures to prevent access to, or transfer of, non-personal data held in the EU by authorities outside the EU where that would conflict with EU law or the law of the Member State concerned. For personal data, the GDPR and the Data Processing Agreement (omniteam.ai/en/dpa) apply. Omniteam uses these measures:

3.1 Technical measures

• Your stored data is held in Microsoft Azure data centres in the EU (section 2), and processed there apart from the providers that section 2 names as not limited to the EU. Microsoft may, in limited cases such as support, access data from outside the EU.
• Data is encrypted in transit with TLS 1.2 or higher. Cloudflare decrypts traffic to check it for attacks and re-encrypts it before it reaches Azure. At rest, storage and database are protected with Azure platform encryption.
• The database cannot be reached from the public internet. Secrets and keys are kept in Azure Key Vault.
• Access is role-based and limited to the staff who need it.
• LiveKit holds interview audio and video only transiently, and recording bot audio is deleted at Recall.ai after retrieval.

3.2 Organisational measures

Omniteam assesses each request from an authority outside the EU for access to non-personal data held in the EU against Article 32 of the Data Act. It gives access only where Article 32 permits it, and then only the minimum amount of data permissible. It informs you of the request before complying, unless the request serves law enforcement purposes, for as long as this is necessary to keep the law enforcement activity effective.

3.3 Contractual measures

• Microsoft commits in its Products and Services Data Protection Addendum not to disclose customer data to law enforcement unless required by law, to try to redirect such a demand to Omniteam, and, if compelled to disclose, to notify Omniteam promptly and give a copy of the demand unless the law forbids it.
• For personal data transferred to the United States, Omniteam relies on the EU-US Data Privacy Framework where the provider is certified and on the EU standard contractual clauses, with a transfer impact assessment (omniteam.ai/en/dpa).