Windgate Consulting, Inc. (d/b/a mosaic.ai) • Seattle, Washington • Last modified: October 11, 2026
This Data Processing Addendum ("DPA") is incorporated into the Master Service Agreement ("MSA") between Windgate Consulting, Inc., d/b/a mosaic.ai ("mosaic.ai" or "Processor"), and Customer ("Controller"), and applies to mosaic.ai's processing of Personal Data within Customer Data in connection with the Service. Capitalized terms not defined here have the meanings in the MSA.
"Personal Data" means information relating to an identified or identifiable natural person within Customer Data, including applicant and candidate information. "Processing," "Controller," "Processor," "Business," "Service Provider," "Sell," and "Share" have the meanings given in Applicable Data Protection Law. "Applicable Data Protection Law" means all privacy and data protection laws applicable to the Processing of Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and the EU/UK General Data Protection Regulation ("GDPR").
2.1 Customer is the Controller (or Business) and mosaic.ai is the Processor (or Service Provider) of Personal Data. mosaic.ai will process Personal Data only on Customer's documented instructions, including as described in the Agreement, and solely to provide the Service.
2.2 Details of Processing. Subject matter: provision of the Service. Duration: the Service Term plus the deletion period in Section 8. Nature and purpose: hosting, analysis, scoring, and extraction of information from resumes and HR documents, including generation of embeddings, extracted entities, scores, summaries, and answers. Categories of data subjects: job applicants, candidates, and Customer employees. Categories of Personal Data: identification and contact details, employment and education history, qualifications, and other information contained in resumes and HR documents.
mosaic.ai certifies that it will not: (a) Sell or Share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties; or (c) combine Personal Data with personal information received from other sources, except as permitted by the CCPA. mosaic.ai will comply with applicable obligations under the CCPA, provide the same level of privacy protection required of Businesses, notify Customer if it can no longer meet its CCPA obligations, and permit Customer to take reasonable steps to stop and remediate unauthorized use of Personal Data.
mosaic.ai will ensure that persons authorized to process Personal Data are bound by confidentiality obligations and access Personal Data only as needed to provide the Service.
mosaic.ai will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including encryption of data in transit and at rest, access controls, and logging. mosaic.ai hosts Personal Data on Microsoft Azure infrastructure in the US West region.
Customer authorizes the subprocessors listed below. mosaic.ai will give Customer at least thirty (30) days' notice of any new subprocessor, during which Customer may object on reasonable grounds; mosaic.ai remains responsible for its subprocessors' performance.
| Subprocessor | Purpose | Location |
|---|---|---|
| Microsoft Corporation (Azure) | Cloud hosting and storage | United States (US West) |
| OpenAI, L.L.C. | AI processing (embeddings and language models); API data is not used to train models per OpenAI's business terms | United States |
mosaic.ai will promptly notify Customer of any request received directly from a data subject (such as an applicant or candidate) and will not respond except on Customer's instruction or as required by law. Taking into account the nature of the Processing, mosaic.ai will assist Customer in fulfilling its obligations to respond to data subject requests (access, correction, deletion, portability, objection) and, as applicable, with data protection impact assessments and consultations with supervisory authorities.
Upon Customer's written request, or upon termination or expiration of the Agreement, mosaic.ai will, at Customer's election, delete or return all Personal Data, including derived embeddings, extracted entities, and scores, within thirty (30) days, except where retention is required by law. Residual copies in backups will be deleted in the ordinary course of backup rotation and remain protected under this DPA until deleted.
mosaic.ai will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data, and will provide information reasonably available to assist Customer in meeting its notification obligations.
No more than once per twelve (12) months, upon thirty (30) days' written notice, mosaic.ai will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by Customer or its independent auditor, limited to information and facilities relevant to the Processing of Customer's Personal Data and subject to mosaic.ai's confidentiality and security requirements.
Personal Data is processed in the United States. Where Applicable Data Protection Law requires a transfer mechanism for Personal Data originating in the EEA, UK, or Switzerland, the parties agree that the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor), and the UK Addendum where applicable, are incorporated by reference, with Customer as data exporter and mosaic.ai as data importer.
This DPA is effective for as long as mosaic.ai processes Personal Data under the Agreement. In the event of a conflict between this DPA and the MSA regarding the processing of Personal Data, this DPA controls. Liability under this DPA is subject to the limitations in the MSA, except where prohibited by Applicable Data Protection Law.
DRAFT TEMPLATE — for review by legal counsel before use. This document does not constitute legal advice.