Data Processing Addendum

Resurface · Version 0.1 · Effective 3 October 2026

This Data Processing Addendum (“DPA”) forms part of the Resurface Terms of Service (the “Agreement”) between Bulldog Media Solutions (בולדוג פתרונות מדיה), an Israeli sole proprietorship (עוסק מורשה) registered under no. 312352255, of Moshav Goren 158, 22850, Israel, represented by Dolev Hayut, Owner (“Resurface”, “we”) and the customer that accepted the Agreement (“Customer”). It applies whenever Resurface processes Customer Personal Data on Customer's behalf. It takes effect when Customer accepts the Agreement or signs this DPA, and lasts as long as Resurface processes Customer Personal Data.

The providers that process data for us are listed on the subprocessors page. How data moves through the service and how it is protected is on the trust center.

1. Definitions

• Customer Personal Data: personal data that Customer submits to the Resurface API, MCP server or dashboard (such as resumes and job descriptions), and the results derived from it.
• Account Data: personal data about Customer's own users, such as names, emails, sign-in details, API key metadata, billing details and usage records. Resurface processes Account Data as an independent controller under its Privacy Policy. This DPA does not cover it.
• Data Protection Laws: all laws on personal data that apply to the processing under the Agreement. These include Regulation (EU) 2016/679 (the “GDPR”); the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; the Israeli Protection of Privacy Law, 5741-1981, and its regulations, including the Protection of Privacy (Data Security) Regulations, 5777-2017; and the California Consumer Privacy Act as amended (the “CCPA”).
• Subprocessor: a third party that Resurface engages to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs, issued by the UK Information Commissioner.

Terms such as “controller”, “processor”, “data subject” and “processing” have the meanings given in the GDPR.

2. Roles

2.1 Customer is the controller of Customer Personal Data, and Resurface is its processor. If Customer acts as a processor for its own client (for example, as a recruitment agency or an applicant tracking system), Resurface is Customer's subprocessor. Customer confirms that its client has authorised it to engage Resurface on these terms.

2.2 Annex I describes the processing.

2.3 The contracting party. Bulldog Media Solutions is a sole proprietorship, not a limited company. Its obligations under this DPA are therefore its owner's own. The Hebrew registered name and the registration number identify the party. The Latin name is a transliteration, not a second registered name.

3. Customer's responsibilities

3.1 Lawful basis and notice. Customer is responsible for having a lawful basis to submit Customer Personal Data to Resurface, and for giving candidates any notices that Data Protection Laws require, including about automated processing.

3.2 Human decisions. Resurface's output is a score with quoted evidence, meant to support a human decision. Customer will not make a decision with legal or similarly significant effects on a candidate, such as a rejection, based solely on Resurface's output. Customer will ensure that a person reviews the output before any such decision.

3.3 Minimisation. Resurface does not need special categories of personal data, such as health, ethnicity, religion or union membership. Customer will not ask Resurface to evaluate them. Where practical, Customer will avoid submitting them.

4. Processing on instructions

4.1 Resurface processes Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise. If it does, Resurface will inform Customer first, unless the law prohibits that. Customer's instructions are the Agreement, this DPA, and Customer's use of the service, such as API calls, MCP calls and dashboard actions.

4.2 Resurface will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

4.3 No model training. Resurface does not use Customer Personal Data to train or improve machine-learning models. Under their published terms, Resurface's model Subprocessors do not train models on the data Resurface sends them.

5. Resurface's obligations

5.1 Confidentiality. Everyone authorised to process Customer Personal Data is bound by confidentiality.

5.2 Security. Resurface implements the technical and organisational measures in Annex II. Resurface may update these measures, provided the overall level of protection does not decrease.

5.3 Data subject requests. If Resurface receives a request from a data subject about Customer Personal Data, it will forward the request to Customer and will not answer it, unless Customer instructs otherwise. Resurface will provide reasonable help for Customer to answer such requests, taking into account the nature of the processing.

5.4 Assistance. Resurface will provide reasonable help with Customer's data protection impact assessments and prior consultations with supervisory authorities, as far as they concern Resurface's processing.

6. Subprocessors

6.1 Authorisation. Customer gives general authorisation for Resurface to engage Subprocessors. The current Subprocessors are listed on the subprocessors page (Annex III).

6.2 Contracts. Resurface will have a written agreement with each Subprocessor that protects Customer Personal Data at least as well as this DPA does. Resurface remains liable for each Subprocessor's performance.

6.3 Changes. Resurface will update the list and notify Customer by email at least 30 days before a new Subprocessor starts processing Customer Personal Data.

• An emergency replacement needed to keep the service running may be made sooner. In that case, Resurface will notify Customer as soon as possible.
• Customer may object on reasonable data protection grounds within 14 days of the notice. Resurface will then offer an alternative or drop the change.
• If no solution is found within 30 days, Customer may stop using the affected service without penalty. Resurface will then refund any prepaid credits that Customer has not used.

7. Security incidents

7.1 Resurface will notify Customer without undue delay, and in any case within 24 hours of discovering a Security Incident. The 24 hours run from the moment Resurface learns of the incident, whether from its own monitoring, from Customer or from a third party.

7.2 The notice will include, as far as known:

• the nature of the incident;
• the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed.

Resurface will update Customer as it learns more.

7.3 Resurface will take reasonable steps to contain and remedy the incident. A notification is not an acknowledgement of fault.

7.4 Under Israeli law, a controller that learns of a severe security incident may have to report it to the Privacy Protection Authority immediately, without waiting for its own checks to finish. Resurface's notice under section 7.1 is meant to let Customer do that. Resurface will send a first notice on the information it has, and add to it later, rather than wait until its investigation is complete.

8. International transfers

8.1 Locations. Resurface is established in Israel. The European Commission recognises Israel as providing an adequate level of protection (Decision 2011/61/EU). Customer Personal Data is hosted in the United States, and Subprocessors process it in the locations listed on the subprocessors page.

8.2 SCCs. To the extent that a transfer of Customer Personal Data from the EEA requires a transfer mechanism, the SCCs are incorporated into this DPA as follows:

• (a) Module 2 applies where Customer is a controller, and Module 3 where Customer is a processor;
• (b) Clause 7 (docking clause) applies;
• (c) under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in section 6.3;
• (d) the optional wording in Clause 11 does not apply;
• (e) under Clause 13, the competent supervisory authority is the one determined by Customer's establishment or representative;
• (f) under Clauses 17 and 18, Option 1 applies, with the law and courts of Ireland;
• (g) Annexes I, II and III of this DPA complete the corresponding annexes of the SCCs.

8.3 UK and Switzerland.

• For transfers from the UK, the UK Addendum applies, completed with the information in this DPA. Either party may end it as permitted by its Section 19.
• For transfers from Switzerland, the SCCs apply with these adjustments: references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

8.4 Onward transfers. Resurface's onward transfers to Subprocessors outside the EEA rely on an approved transfer mechanism, such as the SCCs or the Subprocessor's certification under the EU-US Data Privacy Framework.

9. Audits

9.1 Resurface will make available the information needed to show compliance with this DPA, namely:

• this DPA;
• the trust center;
• written answers to a reasonable security questionnaire, once in any 12-month period.

9.2 If that information is not enough to meet a requirement of a supervisory authority, or after a Security Incident, Customer may audit Resurface's processing, on these conditions:

• Customer gives 30 days' written notice;
• the audit takes place at most once a year, during business hours;
• it is carried out by Customer or by an independent auditor bound by confidentiality;
• Customer bears the cost.

9.3 Once Resurface holds a SOC 2 report or an ISO 27001 certificate, it may provide that report or certificate instead of an audit, unless a supervisory authority requires otherwise.

10. Return and deletion

10.1 Resurface does not store resume files or their full text. They are processed in memory for the duration of the request.

10.2 Results and rubrics remain in Customer's account until Customer asks Resurface to delete them or closes the account. Customer makes deletion requests by email to office@bulldog-adv.com.

10.3 After the Agreement ends, or on Customer's written request, Resurface will delete Customer Personal Data within 30 days, including backup copies, unless the law requires Resurface to keep it. Customer receives each result in the API response when it is created. On request, Resurface will also send an export of the stored results before deleting them. On request, Resurface will confirm the deletion in writing.

11. United States (CCPA)

11.1 Where the CCPA applies, Resurface acts as a service provider. Resurface will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose other than providing the service, or outside the direct business relationship with Customer;
• combine it with personal data from other sources, except as the CCPA permits.

11.2 Resurface will comply with the CCPA's obligations that apply to service providers, and will notify Customer if it can no longer meet them.

12. Israel

12.1 Under the Israeli Protection of Privacy Law, Resurface acts as a holder (מחזיק) of Customer's database. This DPA is the agreement required by Regulation 15 of the Protection of Privacy (Data Security) Regulations, 5777-2017.

12.2 On request, and at least once a year, Resurface will report to Customer on how it meets its security obligations under those regulations and this DPA.

13. General

13.1 Order of precedence. If documents conflict, they apply in this order: the SCCs (where they apply), then this DPA, then the Agreement.

13.2 Liability. Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow it.

13.3 Governing law. This DPA is governed by the laws of Israel, and the courts of Haifa have exclusive jurisdiction. This does not apply where the SCCs require otherwise.

13.4 Changes. Resurface may update this DPA to reflect changes in Data Protection Laws or in its service. Changes will not reduce the protection of Customer Personal Data. Resurface will notify Customer of material changes at least 30 days in advance.

Annex I: Description of the processing

Data exporter: Customer (controller, or processor for its client). Contact details: as given in Customer's account.

Data importer: Bulldog Media Solutions, operating Resurface (processor). Contact: office@bulldog-adv.com. Address: Moshav Goren 158, 22850, Israel.

Data subjects: job candidates whose resumes Customer submits, and any individuals named in job descriptions that Customer submits, such as hiring contacts.

Categories of personal data:

• Resume content as submitted by Customer. This typically includes name and contact details; work history, education, skills, certifications and languages; and any other information the candidate chose to include.
• Job descriptions.
• Derived data: a 0–100 score; a verdict for each screening question; the short resume lines quoted as evidence; a one-way SHA-256 hash of the resume text; the number of lines in the resume, and its language.

Special categories: none required (see section 3.3). A resume may contain them incidentally. They are processed only in memory, and appear in stored results only if a quoted evidence line contains them.

Frequency: continuous, for each request Customer makes.

Nature of the processing: extracting text from the submitted file; drafting screening questions from the job description with a language model; answering those questions for the resume with a classification model; storing the result.

Purpose: to score resumes against jobs at Customer's request, and to provide support and prevent abuse of the service.

Retention:

• Resume files and full text: processed in memory during the request. Not stored by Resurface.
• Results (score, verdicts, quoted lines, resume hash): until Customer asks for deletion or closes the account, then within 30 days (section 10).
• Rubrics (job descriptions and questions): until Customer asks for deletion or closes the account, then within 30 days.

Transfers to Subprocessors: as listed in Annex III, for the purposes stated there.

Annex II: Technical and organisational security measures

• Encryption: all traffic uses TLS (HTTPS), with HSTS on every page. The database is encrypted at rest with AES-256 by the database provider, which also keeps daily encrypted backups across multiple availability zones.
• Access control: only the owner, Dolev Hayut, has access to production systems. No one else does. Every administrator account at Resurface's providers uses multi-factor authentication. Secrets are kept in the hosting provider's encrypted environment settings, never in source code.
• Customer authentication: API keys are random, stored only as SHA-256 hashes, shown once at creation, and can be revoked at any time. MCP clients connect through OAuth with PKCE, provided by Clerk. Clients never receive the user's password.
• Isolation: every database query is scoped to the customer account that made the request.
• Data minimisation: resume files and their full text are not stored. Repeats are detected with a one-way hash. Application logs record errors, not request bodies or resume text.
• Abuse prevention: each account has rate limits on scoring and on drafting questions.
• Availability: the service runs on managed infrastructure (Vercel and Neon), with automated scaling and backups.
• Subprocessors: Resurface engages Subprocessors under written data protection terms (section 6).
• Incident response: security incidents are handled and reported as set out in section 7.
• Vulnerability reports: reports go to office@bulldog-adv.com, as published at /.well-known/security.txt.
• Responsible use: every verdict quotes the resume line it rests on, so a person can check it. The service returns no reject decision.

Annex III: Subprocessors

See the subprocessors page.

Annex IV: What Resurface does not offer today

This annex lists what larger providers often offer and Resurface does not yet. It is part of what Customer agrees to.

• Certifications: no SOC 2 report and no ISO 27001 certificate.
• People: no data protection officer, no separate security team and no staffed 24/7 on-call rota. The owner handles security and incidents.
• Data location: no choice of region. Customer Personal Data is hosted in the United States.
• Encryption keys: no customer-managed keys.
• Deletion: no self-service deletion of results or rubrics. Deletion is by email request (section 10).
• Access logs: no customer-visible audit log of access to Customer Personal Data.