Introduction

RSIGHT (a simplified joint stock company with share capital of €57.389,15, whose registered office is located at 17 RUE DUMONT D'URVILLE, 75016 PARIS, registered in the Paris Trade and Companies Register under number 890 710 478, represented by Mr Philippe BEUCHER, hereinafter "RSight") publishes a software platform incorporating artificial intelligence that helps its customers find the best talents (hereinafter the "AI Recruitment Solution" or the "Platform").

The AI Recruitment Solution is delivered through a set of specialised AI Agents (defined below) that, depending on the Customer's configuration, import, source, advertise, contact, screen and qualify candidates, and that can run the recruitment workflow end to end. The AI Recruitment Solution is accessible remotely by Users and is described at: www.rsight.com.

These General Terms and Conditions of Subscription (hereinafter the "General Terms and Conditions" or "GTC") govern the Customer's access to and use of the AI Recruitment Solution and its Agents.

The Customer has declared that it is interested in using the AI Recruitment Solution in connection with its professional activity. The Customer's relationship with RSight is formalised either by the purchase of Credits under the pay-as-you-go model or by an Order Form for an enterprise contract, each of which refers to these GTC. Any purchase of Credits, or any validation or acceptance by the Customer of an Order Form in any form whatsoever, implies full and complete acceptance of these GTC and its appendices, in the version in force on the date of that purchase or Order Form.

The Contract consists of the following documents, in descending order of priority:

1. The Order Form for an enterprise contract issued by RSight;

2. These General Terms and Conditions;

3. The appendices (including the Data Processing Appendix, the US State Privacy Addendum, the AI Act Responsibilities Appendix, and the list of authorised sub-processors).

In the event of any contradiction or discrepancy between these documents, the provisions of the higher-priority document shall prevail. The Contract excludes the application of the Customer's general terms and conditions of purchase or any other document exchanged between the parties.

1. Definitions
   
   

Agent - refers to a specialised functional component of the AI Recruitment Solution, incorporating artificial intelligence, that performs a defined set of recruitment operations. The Agents are described in Article 5. The Customer subscribes to one or more Agents.

Candidate - refers to any natural person whose data is processed within the AI Recruitment Solution, whether imported by the Customer, sourced by RSight, or having applied in response to a job advertisement.

Customer - refers to the legal entity using the AI Recruitment Solution.

Recruitment Request (or Requisition) - refers to the specific role that the Customer aims to recruit, defined by a set of criteria expressed by the Customer while using the AI Recruitment Solution. Each Recruitment Request is initiated by the Customer and may be validated by RSight where RSight performs sourcing. The Recruitment Request may be modified by the Customer at any time while the corresponding subscription remains active.

AI Recruitment Solution / Platform - refers to the software solution published by RSight, comprising the Agents, accessible remotely by Users and used in particular to create Recruitment Requests, run Agents, receive candidate and Talent information and manage recruitment.

Talent - refers to a Candidate who has been screened and qualified within the AI Recruitment Solution and submitted to, or made available for, the Customer's recruitment decision.

Credit - refers to the prepaid unit of account purchased by the Customer and consumed to perform actions within the AI Recruitment Solution. Credits are purchased and consumed on a pay-as-you-go basis as set out in Article 7. Each Credit has the validity period indicated at the time of purchase (or in the Order Form for an Entreprise contract), at the end of which any unused Credit expires.

Tariffs - refers to the prices applied by RSight, namely the price of Credits and of the actions they unlock under the pay-as-you-go model, and/or the prices agreed in an enterprise contract, as set out in Article 7 and/or, where applicable, the Order Form for an Enterprise contract.

User - a natural person authorised by the Customer to access and use the AI Recruitment Solution for recruitment purposes.

Applicable Data Protection Laws - refers to all laws and regulations applicable to the processing of personal data under the Contract, including in particular the EU General Data Protection Regulation (Regulation EU 2016/679, "GDPR") and French Law 78-17 of 6 January 1978 as amended ("Loi Informatique et Libertés"), and, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and other comparable US state privacy laws.

AI Act - refers to Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence.

2. Subject
   
   

The purpose of the Contract is the provision by RSight of the AI Recruitment Solution for the benefit of the Customer, through the Agents subscribed, consisting in the import, sourcing, advertising, contacting, screening and qualification of Candidates and Talents in accordance with the Customer's Recruitment Request. The AI Recruitment Solution is a recruitment-assistance service made available to legal entities wishing to recruit, for professional purposes.

3. Duration
   
   

The Contract takes effect when the Customer first purchases Credits or signs an enterprise contract, and the Customer's access is activated by RSight following payment of the Tariffs due.

Pay-as-you-go. Under the pay-as-you-go model, the Contract remains in force for as long as the Customer holds valid (unexpired) Credits. There is no fixed term and no automatic renewal: the Customer simply purchases further Credits when it wishes to continue using the AI Recruitment Solution.

Enterprise contract. Where the Customer enters into an enterprise contract, the term, renewal and notice conditions are those set out in that contract or the corresponding Order Form. Unless stated otherwise, an enterprise term renews automatically for successive periods of the same duration, unless either party gives written notice of non-renewal at least two (2) working days before the end of the then-current term (or any longer notice period stated in the Order Form).

Where the Customer benefits from a one-month trial period, the Customer may cancel at any time during the trial; cancellation takes effect at the end of the trial and the subscription will not renew.

The Contract terminates automatically when the Customer no longer holds any valid Credits and no enterprise term is active or pending.

4. Warning and human oversight
   
   

The Customer declares that it has taken note of all information relating to the use of the AI Recruitment Solution and the Agents subscribed, and in particular the documentation, prior to entering into the Contract. The Customer has thus been provided with all the information it needs to determine for itself whether the AI Recruitment Solution is suited to its needs.

The Customer is informed that the AI Recruitment Solution and its Agents use artificial intelligence systems, in particular for sourcing, matching, scoring, screening and qualification of Candidates and, where applicable, for interaction with Candidates. RSight has developed tools to monitor and control its algorithms in order to limit the risks of bias and discrimination. The Customer nonetheless acknowledges the innovative and autonomous nature of artificial intelligence systems and undertakes to implement effective human oversight of the results produced by the Agents and to review those results before taking any recruitment decision. No recruitment, rejection or other decision producing legal or similarly significant effects on a Candidate is taken automatically by the AI Recruitment Solution; all such decisions are taken by the Customer.

This human-oversight obligation is also a regulatory obligation of the Customer in its capacity as deployer of a high-risk AI system under the AI Act (see Article 13 and the AI Act Responsibilities Appendix).

The Customer undertakes to inform RSight of any incident, malfunction, unexpected output, or indication of bias relating to the AI systems as soon as it is identified, so that RSight can analyse and remedy it as soon as possible.

To obtain optimal results, the Customer undertakes to:

• have human-resources staff who manage the recruitment process and who are trained in the use of AI-assisted solutions;

• have Recruitment Requests created by the hiring manager, avoiding intermediaries;

• give particular attention to the quality, accuracy, relevance and lawfulness of the data and criteria transmitted to the Agents for each Recruitment Request. Where a Recruitment Request contains overly restrictive criteria, the Candidates returned may not correspond entirely to those criteria; the closest matching Candidates will be returned.

It is the Customer's sole responsibility, at its own expense, to acquire the technical resources (hardware, internet access) and skills necessary to access and use the AI Recruitment Solution.

5. Description of the AI Recruitment Solution and the Agents
   
   

5.1 The Agents

The AI Recruitment Solution is composed of the following Agents. The Customer subscribes to one or more of them. The data-protection role of each party for each Agent is set out in Article 12 and the Data Processing Appendix.

(a) The Import Agent. Imports Candidates into the AI Recruitment Solution from external sources that are owned by and under the responsibility of the Customer. For data sourced through the Import Agent, the Customer is the data controller and RSight acts as the Customer's processor. The Customer warrants that it holds the rights, legal bases and authorisations required to provide such Candidate data to RSight for processing within the Platform.

(b) The Search Agent. Searches for Candidates within sources made available by RSight - publicly available data and/or the databases of authorised suppliers - who provide such sourcing in accordance with the GDPR and the data protection laws in force. The search, matching and scoring are driven by the Customer's own criteria, keywords and instructions; the Customer therefore determines the purpose and the essential means of this operation and acts as data controller, while RSight acts as the Customer's processor for the search it performs on those instructions. The third-party sources and authorised suppliers remain independent controllers of the data in their own databases; RSight is responsible as controller only for its own acquisition, structuring and maintenance of the sourcing pool and for its supplier relationships, in accordance with the GDPR. When Candidates are surfaced to the Customer's Recruitment Request, the Customer reviews them and decides with whom to move forward; for this evaluation and selection the Customer acts as an independent data controller.

(c) The Posting Agent. Advertises the Customer's roles across relevant job boards, social media and aggregators under RSight's own brand. Applications received in response are collected and processed by RSight; for this advertising and applicant-collection operation, RSight acts as data controller. The Customer then reviews the applicants and decides with whom to move forward; for this evaluation and selection operation the Customer acts as an independent data controller (recipient at transmission, controller of its subsequent use). RSight and the Customer are therefore independent controllers, each for its own operation.

(d) The Contacting Agent. Contacts Candidates selected by the Customer - whether (i) from the sources provided by RSight or (ii) from external sources owned by the Customer - and screens and qualifies those Candidates strictly against the criteria given by the Customer. Contacting and screening may be carried out through different channels, including email, SMS, WhatsApp, voice/call, web or mobile. Because the Customer selects the Candidates and sets the screening criteria, the Customer determines the purposes and essential means of this operation: the Customer acts as data controller and RSight acts as the Customer's processor for the contacting and screening it performs on the Customer's documented instructions. The providers of the contacting channels (e.g. email, SMS, messaging, telephony, web and mobile providers) act as sub-processors under RSight. Where Candidates originate from RSight-provided sources, RSight remains controller of the upstream sourcing operation as described in (b), while acting as the Customer's processor for the contacting/screening of the Candidates the Customer has selected.

(e) The Hiring Agent. Runs the recruitment process end to end: it captures the Customer's criteria, provides recommendations regarding the Requisition, sources Candidates from publicly available data and/or authorised suppliers (provided in accordance with the GDPR and the data protection laws in force), and in parallel advertises the role across relevant job boards, social media and aggregators under RSight's own brand, then contacts, screens and qualifies Candidates. Contacting and screening may be carried out through different channels, including email, SMS, WhatsApp, voice/call, web or mobile. No Candidate is rejected by the Hiring Agent; the Customer reviews the qualified Candidates and decides with whom to move forward. The Hiring Agent is phased for data-protection purposes: (i) for the sourcing and advertising it performs, RSight acts as data controller (with third-party sources/suppliers as independent controllers); (ii) for the contacting and screening carried out against the Customer's criteria, RSight acts as the Customer's processor and the Customer as controller, with the channel providers as sub-processors; and (iii) for the review, evaluation and recruitment decision, the Customer acts as an independent data controller. The parties may, if they prefer, agree to treat the matching stage of the Hiring Agent as a joint-controllership arrangement under Article 26 GDPR, in which case they will put in place the transparency arrangement that provision requires.

5.2 Common terms applicable to the Agents

By subscribing to the AI Recruitment Solution, the Customer:

• is under no obligation to recruit;

• is not limited by the number of Candidates or Talents made available within the scope of its subscription;

• may modify a Recruitment Request after it has been created;

• may request that an Agent be paused or stopped - the relevant Agent will then cease sourcing, contacting or processing new Candidates (for example where the Candidates already provided are suitable);

• is not bound by any salary limit in its Recruitment Requests;

• remains the sole decision-maker as to which Candidates advance in the recruitment process.

The Customer acknowledges that RSight may:

• decline to accept an order or to validate a Recruitment Request (for sourcing Agents). Grounds may include, without limitation, insufficient clarity, incomplete, incoherent, discriminatory or non-compliant requests. RSight is not required to justify a refusal to validate a Recruitment Request;

• obtain, where RSight is controller, the relevant Candidate's information/consent as required before that Candidate's data is made available to the Customer.

  
  

5.3 Provision of the AI Recruitment Solution

Opening of User accounts. The Customer chooses the authorised Users and provides RSight with the data required to open User accounts. Integration with the Customer's SSO (single sign-on) systems may be offered as an option subject to technical constraints.

Onboarding. RSight offers onboarding sequences via online support (without human intervention) and/or training (with human intervention). For an Enterprise contract, the Order Form specifies the associated financial conditions.

Support. For the duration of the Contract, the Customer benefits from support for questions or incidents affecting normal use of the AI Recruitment Solution, via the dedicated support portal. The Customer must detail its request and provide the information required to resolve the incident.

Maintenance, hosting, migration. RSight may perform updates, upgrades or migrations necessary for the proper functioning of the AI Recruitment Solution. RSight cannot be held responsible for any temporary interruption of service caused by such operations.

6. Use of the AI Recruitment Solution

   6.1 Access

   RSight provides authorised Users with a login link enabling them to set their password. The User is responsible for the confidentiality of its connection identifiers and undertakes to take all useful measures to ensure that confidentiality and to avoid any identity theft or fraudulent or unauthorised use. The Customer undertakes to notify RSight as soon as possible of any loss of identifiers or any fraudulent use. Users use the AI Recruitment Solution under the control and responsibility of the Customer.

   6.2 Permitted use and restrictions

   The Customer is authorised to access and use the AI Recruitment Solution in accordance with these GTC and the documentation. The Customer shall refrain, and shall ensure that Users refrain, from:

   • applying any reverse-engineering method and/or reproducing all or part of the AI Recruitment Solution;

   • developing, internally or through a third party, a solution equivalent or identical to the AI Recruitment Solution;

   • any commercial exploitation of the AI Recruitment Solution with third parties; transferring, providing, lending, renting it, granting sub-licences or other rights of use, or communicating all or part of it to a third party or affiliated company;

   • integrating all or part of the AI Recruitment Solution into any computer system or software other than as provided under the Contract, without RSight's prior agreement;

   • extracting a qualitatively or quantitatively substantial part of the Platform's databases;

   • any fraudulent or unauthorised access (or attempt) to RSight's servers or any breach of RSight's automated data-processing systems.

   The right to access and use the AI Recruitment Solution is granted subject to effective payment of the Tariffs. The Customer further undertakes not to misuse the AI Recruitment Solution, and in particular not to: engage in any illegal or fraudulent activity; infringe public policy, public decency or third-party rights; violate any contractual, legislative or regulatory provision (including Applicable Data Protection Laws and the AI Act); or interfere with any third party's computer system. The Customer further undertakes not to copy, modify or misappropriate any element belonging to RSight, nor to undermine RSight's IT security, financial, commercial or moral rights and interests.

   
   

7. Financial conditions

   7.1 Pay-as-you-go model

   The AI Recruitment Solution is provided on a pay-as-you-go basis. The Customer purchases Credits, which it then consumes to perform actions within the AI Recruitment Solution, including but not limited to: AI-powered import, criteria search, AI prompt search, AI smart filter, enrichment, contacting, standard screening, advanced screening, posting, and the Hiring Agent. The number of Credits required for each action, and the price of Credits, are communicated to the Customer up front, prior to purchase, and may be set out in the Order Form for an Enterprise contract. Credits are activated and available for use once payment is received; payment is a mandatory precondition for RSight to make the corresponding Credits and actions available.

   7.2 Credit validity

   Each Credit is valid for the period indicated at the time of purchase (or in the Order Form for an Enterprise contract). Unused Credits expire at the end of that period and are not refundable, unless otherwise agreed in writing.

   7.3 Enterprise contract

   The pay-as-you-go model applies up to the volumes offered under it. For volumes greater than those offered under the pay-as-you-go model, the Customer shall enter into a separate enterprise contract with RSight, which sets out the applicable volumes, Tariffs, term and specific conditions.

   7.4 Changes to Tariffs

   RSight may change its Tariffs (including the price of Credits and the number of Credits required for an action) at any time. Any such change applies only to Credits purchased after the change takes effect. Credits already acquired remain valid until their expiration and retain the conditions in force at the time of their purchase, including the number of Credits required for the corresponding actions.

   7.5 Payment

   Payment is made exclusively by card, direct debit or bank transfer. In the event of non-payment, RSight is entitled to (i) suspend or decline to activate access to the AI Recruitment Solution, or the provision of Credits, by operation of law until actual payment; (ii) invoice any collection costs, including bank charges related to a rejected payment; (iii) invoice late-payment interest, due by the sole fact of the expiry of the term, at three (3) times the legal interest rate on the unpaid amount, plus a fixed indemnity of forty (40) euros for collection costs; and (iv) all of the foregoing without prejudice to any damages and to any termination provided below.

   
   

8. Responsibility

   8.1 The liability of either party may only be incurred in the event of proven gross negligence. Each party is released from all or part of its contractual liability if it proves that the non-performance or poor performance is attributable to a third party or to force majeure (Article 14.2). RSight is bound by an obligation of means to make the AI Recruitment Solution available under the conditions defined herein and is in no way bound by an obligation of result in the search for Talent.

   8.2 RSight and the Customer agree that each may only be held liable for direct damage; compensation for indirect damage is excluded, including loss of profit, loss of chance, loss of opportunity, third-party actions and damage to brand image. The maximum aggregate amount of damages payable by either party may not exceed the total amount invoiced and collected by RSight over a contractual year.

   8.3 RSight cannot be held responsible for:

   • temporary difficulty or impossibility of accessing the AI Recruitment Solution, in particular during maintenance;

   • misuse of the AI Recruitment Solution by the Customer or a User, or failure to comply with the technical prerequisites, warnings and documentation, including the human-oversight obligation in Article 4;

   • the unsuitability of identified or retained Talents for the Customer's needs, or a Talent's refusal to join the Customer;

   • any failure of the internet network or means of communication.

   
   

9. Confidentiality

   Each party undertakes not to disclose to any third party, without the other party's prior written consent, the other party's Confidential Information, for the duration of the Contract and for five (5) years after its expiry or termination for any reason.

   Each party warrants that its personnel and any sub-contractors involved in the performance of the Contract will comply with this obligation. "Confidential Information" includes all strategic, financial, technical and legal information, business secrets, and generally all information relating to a party's activities; know-how and data relating to the operation of the AI Recruitment Solution; and Customer data.

   Information is not Confidential Information where it: is or becomes public through no fault of the receiving party; was known to the receiving party before disclosure; is lawfully received from a third party without breach of a confidentiality obligation; is developed independently without use of the other party's Confidential Information; or must be disclosed by law, regulation or court order, to the extent strictly necessary.

   Each party will take at least the same level of precautions to protect the other party's Confidential Information as it takes for its own.

   The Customer acknowledges and accepts that RSight may use the Customer's anonymised data to train and improve its systems and algorithms. Anonymisation is carried out so that data subjects are no longer identifiable, in accordance with Applicable Data Protection Laws.

   
   

10. Evidentiary agreement

    In the event of a dispute over the use of the AI Recruitment Solution, the parties agree that the logs recorded by RSight's equipment during use will be deemed authentic and will constitute proof between the parties pursuant to article 1368 of the French Civil Code.

    
    

11. Intellectual property

    11.1 Intellectual property of the RSight® Solution

    RSight holds the intellectual property rights to the AI Recruitment Solution, including the infrastructure, databases, content of all kinds, graphic and user interfaces, source and object code, APIs, tree structure, algorithms (including the artificial intelligence systems and Agents), documentation, methods and models. The Contract transfers no ownership to the Customer. RSight grants the Customer and authorised Users a non-exclusive, personal and non-transferable right of access and use, for the duration set out in Article 3, within the strict framework of the Contract.

    RSight warrants that it holds all intellectual property rights necessary to enter into this Contract and that the AI Recruitment Solution does not infringe third-party rights. RSight undertakes to defend the Customer against any third-party action for infringement of intellectual property rights relating exclusively to the AI Recruitment Solution, subject to the Customer (i) giving immediate written notice and (ii) the alleged infringement not being attributable to the Customer or a User. RSight shall have sole control of the conduct, settlement or pursuit of such proceedings, and the Customer shall provide all necessary assistance.

    11.2 Ownership of Customer data

    The Customer's data hosted in the AI Recruitment Solution, in particular the Recruitment Requests and any Candidate data imported via the Import Agent, are the full property of the Customer. The Customer warrants that it holds the rights and authorisations necessary to process that data and to have it processed by the AI Recruitment Solution. The Customer shall indemnify and hold RSight harmless against any damages, costs and expenses (including defence costs, RSight choosing its counsel) arising from a third-party or authority claim due to the Customer's breach of this clause.

    11.3 RSight trademarks

    RSight owns the trademark RSight (French trademark 4781476 and international trademark 1645463).

    
    

12. Personal data - overview and allocation of roles

    12.1 Each party undertakes, insofar as it is concerned, to comply with all Applicable Data Protection Laws.

    12.2 The processing operations under the Contract, and the role of each party, are as follows. They are detailed in the Data Processing Appendix (GDPR) and, for US data subjects, in the US State Privacy Addendum (CCPA/CPRA).

    
    

    P1 - Contractual relationship

    Managing the contractual relationship between the parties

    RSight role: Controller

    Customer role: Controller (each independent)

    
    

    P2 - Platform access

    Opening User accounts and providing access to the Platform

    RSight role: Processor

    Customer role: Controller

    
    

    P3 - Sourcing pool & advertising by RSight

    RSight's own acquisition, structuring and maintenance of its candidate sourcing pool and supplier relationships; and advertising under RSight's brand with collection of resulting applications (Posting Agent, and the advertising stage of the Hiring Agent). Third-party sources and suppliers act as independent controllers of their own databases.

    RSight role: Controller

    Customer role: (recipient at transmission; see P5 for its own use)

    
    

    P4 - Customer-directed search, contacting & screening

    The search, matching and scoring performed on the Customer's own criteria, keywords and instructions (Search Agent); the contacting and screening of Candidates selected by the Customer against the Customer's criteria (Contacting Agent; the contacting/screening stage of the Hiring Agent), via email, SMS, WhatsApp, voice/call, web or mobile; and the processing of Candidate data the Customer imports from its own sources (Import Agent). Channel providers act as sub-processors under RSight.

    RSight role: Processor

    Customer role: Controller

    
    

    P5 - Review, evaluation & recruitment decision

    The Customer's review of Candidates/Talents and its decision with whom to move forward (all Agents)

    RSight role: (not involved, or processor for tooling only)

    Customer role: Controller (independent)

    
    

    12.3 The roles are allocated per processing operation, not per Agent: a single Agent's workflow may involve different roles at different stages. Where RSight acts as processor on behalf of the Customer (P2 and P4), it processes personal data only on the Customer's documented instructions and in accordance with the Data Processing Appendix, and engages sub-processors (including hosting and contacting-channel providers) under that role. Where RSight acts as controller (P3), it is responsible for the lawfulness of its own pool acquisition and advertising, including the legal basis for collection, transparency to Candidates, supplier agreements and the management of data-subject rights for that data. Where the Customer acts as controller (P4 and P5, and as recipient-then-controller of P3 output), it is responsible for the lawfulness of its instructions, its selection criteria, and its own use of Candidate and Talent data for recruitment. The Customer does not act as RSight's processor under any processing.

    12.4 For the Hiring Agent, the parties may alternatively agree to treat the matching stage as a joint-controllership arrangement (Article 26 GDPR), in which case they will conclude the transparency arrangement required by that provision.

    12.5 For California and other applicable US state data subjects, the parties additionally allocate the roles of Business and Service Provider as set out in the US State Privacy Addendum.

    
    

13. Artificial intelligence - AI Act compliance

    13.1 The parties acknowledge that the AI Recruitment Solution and certain Agents constitute, or include, AI systems intended for the recruitment or selection of natural persons (in particular for placing targeted job advertisements, analysing and filtering applications, and evaluating or screening candidates), which are classified as high-risk under Annex III of the AI Act. The corresponding obligations apply progressively in accordance with the AI Act's application timetable.

    13.2 RSight acts as the "provider" of the high-risk AI system within the meaning of the AI Act and, as such, undertakes, to the extent and as of the dates the AI Act requires, to implement and maintain in particular: a risk-management system; appropriate data-governance and bias-mitigation measures; technical documentation and record-keeping/logging; transparency and instructions for use; the design enabling effective human oversight; and appropriate levels of accuracy, robustness and cybersecurity; together with the applicable conformity-assessment, registration and corrective-action obligations.

    13.3 The Customer acts as the "deployer" of the high-risk AI system and undertakes, to the extent and as of the dates the AI Act requires, in particular to: use the AI Recruitment Solution in accordance with RSight's instructions for use; assign effective human oversight to competent, trained natural persons; ensure that input data and criteria under its control are relevant and sufficiently representative; monitor operation and inform RSight (and, where required, the competent authorities) of risks or serious incidents; keep the logs generated by the system to the extent they are under its control; inform affected workers and their representatives where required; provide the required transparency information to affected Candidates; and, where applicable to the Customer, carry out a fundamental-rights impact assessment.

    13.4 The detailed allocation of AI Act responsibilities between the parties is set out in the AI Act Responsibilities Appendix. Nothing in the Contract relieves either party of obligations that the AI Act imposes on it directly.

    
    

14. Termination

    14.1 Cancellation

    Under the pay-as-you-go model, the Customer is under no commitment to purchase further Credits and may stop using the AI Recruitment Solution at any time; existing Credits remain usable until their expiration. Where the Customer has an enterprise contract, it may cancel by sending a request by email to customer@rsight.com, with cancellation taking effect at the end of the then-current term; unless cancelled before the end of that term, the enterprise term renews automatically for the same duration. During a one-month trial, the Customer may cancel at any time, with cancellation effective at the end of the trial and no renewal.

    14.2 Termination for breach of an essential obligation

    The Customer's essential obligations ("Essential Obligations") are: payment of the Tariffs; use of the AI Recruitment Solution in accordance with these GTC, and in particular Articles 5 and 6; not engaging in any illegal or fraudulent activity or activity infringing the rights or safety of third parties, public order or applicable law; compliance with the human-oversight and AI Act deployer obligations in Articles 4 and 13; and respect for RSight's intellectual property rights. In the event of a breach of an Essential Obligation, RSight may suspend or cancel the Customer's access; inform and cooperate with any competent authority; and take any legal action - without prejudice to any damages.

    14.3 Termination for breach of another obligation

    In the event of a breach of any other obligation, the non-defaulting party shall notify the other by registered letter with acknowledgement of receipt, specifying the breach and the contractual references. The defaulting party must remedy the breach within thirty (30) days of receipt. At the end of that period, the parties shall meet to decide on continuation or termination of the Contract, without prejudice to any damages.

    14.4 Consequences

    From the date of termination, the Customer and Users will no longer be able to access the AI Recruitment Solution. Any attempt to access it thereafter will constitute illegitimate and wrongful access.

    
    

15. Miscellaneous

    15.1 The Customer authorises RSight to include the Customer as a commercial reference and to use the Customer's name and logo on RSight's website and in its marketing and commercial documents, unless the Customer gives written notice withdrawing this authorisation.

    15.2 A party is excused from an obligation if it can justify force majeure within the meaning of article 1218 of the French Civil Code and case law. If force majeure is temporary, performance is suspended for its duration. If it continues beyond thirty (30) days, either party may terminate without indemnity.

    15.3 The Customer may not transfer the Contract, in whole or in part (except to its subsidiaries), nor make the AI Recruitment Solution available to anyone else, even temporarily.

    15.4 Any document provided by the Customer to RSight (e.g. an expression of needs, study, specifications, general conditions of purchase) is, even if RSight has responded to it, devoid of contractual character and outside the scope of the Contract.

    15.5 RSight may sub-contract all or part of the Contract as it sees fit, remaining responsible to the Customer for proper performance.

    15.6 RSight may modify the Contract by notifying the Customer by any written means (including email). Changes - including to these GTC or to Tariffs - may be made at any time and apply to Credits purchased, and to enterprise contracts signed, after the change takes effect. Consistent with Article 7.4, Credits already acquired remain valid until their expiration and retain the conditions in force at the time of their purchase; Credits already purchased and current enterprise terms remain governed by the version of the Contract in force at the time of purchase or signature until their expiration or renewal.

    15.7 For any question relating to these GTC, RSight can be contacted at contact@rsight.com.

    
    

16. Settlement of disputes

The Contract is governed by French law.

IN THE EVENT OF ANY DISPUTE BETWEEN THE PARTIES CONCERNING THE VALIDITY, PERFORMANCE OR INTERPRETATION OF THE CONTRACT, THE PARTIES UNDERTAKE TO COOPERATE DILIGENTLY AND IN GOOD FAITH TO FIND AN AMICABLE SOLUTION.

IF NO AMICABLE AGREEMENT IS REACHED WITHIN ONE (1) MONTH OF RECEIPT OF A LETTER NOTIFYING THE OTHER PARTY OF THE DISPUTE, THE PARTIES EXPRESSLY AGREE THAT THE PARIS COMMERCIAL COURT SHALL HAVE JURISDICTION, NOTWITHSTANDING PLURALITY OF DEFENDANTS OR THE INTRODUCTION OF THIRD PARTIES. THIS TIME LIMIT DOES NOT APPLY TO EMERGENCY OR CONSERVATORY PROCEEDINGS, PROCEEDINGS IN CHAMBERS OR ON PETITION, FOR WHICH THE PARIS COMMERCIAL COURT IS ALSO EMPOWERED.

APPENDIX 1 - DATA PROCESSING (GDPR)

This Appendix (the "DPA") forms an integral part of the Contract and defines the conditions under which personal data is processed. The terms "Personal Data", "Processing", "Controller", "Processor", "Data Breach" and "Data Subjects" have the meanings given in the GDPR.

A. Processing operations

Five processing operations are identified (see the table in Article 12.2): P1 (contractual relationship - each party Controller), P2 (Platform access - RSight Processor, Customer Controller), P3 (RSight's own sourcing pool acquisition and advertising - RSight Controller; third-party sources independent controllers), P4 (Customer-directed search via the Search Agent, contacting & screening of Candidates the Customer selected, and Import of Customer-owned data - RSight Processor, Customer Controller), and P5 (the Customer's review, evaluation and recruitment decision - Customer Controller). The roles attach to the processing operation, not to the Agent; a single Agent may span several of these operations (the Hiring Agent in particular spans P3, P4 and P5).

B. Processing P1 - Contractual relationship

Each party processes the Personal Data of the other party's contacts as Controller. This processing is limited to identification data (surname, first name, email, telephone, company, role) of contact persons and is kept for the time strictly necessary to manage the contractual relationship. The parties' staff, supervisory departments (e.g. auditors) and sub-processors may have access. Contacts may exercise their GDPR rights (access, rectification, erasure, restriction, objection, portability, and complaint to a supervisory authority).

C. Processing P2 and P4 - RSight as Processor on behalf of the Customer

For P2 (User account and Platform access data: surname, first name, email of Users and connection logs) and P4 (the search, matching and scoring performed on the Customer's own criteria, keywords and instructions via the Search Agent; the Candidate data the Customer imports from its own sources via the Import Agent; and the contacting and screening of Candidates the Customer has selected, performed against the Customer's criteria by the Contacting Agent and by the contacting/screening stage of the Hiring Agent, through channels such as email, SMS, WhatsApp, voice/call, web or mobile), RSight acts as Processor and the Customer as Controller.

RSight's obligations. RSight undertakes to:

• process the Personal Data only on the Customer's documented instructions and solely for the purposes of providing the subscribed Agents and the Platform (including, for P2, opening accounts and providing access; for P4, importing, contacting, screening and qualifying the Customer's Candidates against the Customer's criteria);

• ensure that persons authorised to process the data are bound by confidentiality;

• implement appropriate technical and organisational measures to ensure the security, confidentiality, integrity, backup and restoration of the Personal Data;

• engage subsequent processors / sub-processors only from the authorised list (including hosting providers and the contacting-channel providers used by the Contacting and Hiring Agents - email, SMS, messaging such as WhatsApp, telephony/voice, web and mobile providers), giving the Customer prior written notice of any change and an opportunity to object, and imposing on them the same data-protection obligations; RSight remains fully responsible to the Customer for their performance;

• where Personal Data is transferred outside the European Union, ensure appropriate safeguards under Chapter V of the GDPR (e.g. an adequacy decision or Standard Contractual Clauses);

• assist the Customer, taking into account the nature of the processing, in responding to Data-Subject requests and in meeting its obligations regarding security, breach notification, data-protection impact assessments and prior consultation;

• notify the Customer without undue delay after becoming aware of a Data Breach affecting this processing, with all useful information;

• at the Customer's choice, delete or return the Personal Data processed under this processing on expiry of the Contract, and delete existing copies unless retention is required by law;

• make available to the Customer the information necessary to demonstrate compliance and allow audits as provided in section E.

Re-use of data by RSight. The Customer authorises RSight to process connection and browsing data collected through the Platform for the purpose of improving the AI Recruitment Solution, including producing usage statistics. For this purpose RSight acts as Controller and complies with Applicable Data Protection Laws. Any re-use for model training is carried out on anonymised data only.

Customer's obligations. The Customer undertakes to:

• provide only the Personal Data necessary, excluding irrelevant, disproportionate or unnecessary data and any "special category" data within the meaning of the GDPR unless lawfully justified and instructed;

• collect and provide the Personal Data lawfully, fairly and transparently, ensuring a valid legal basis and providing the required information to Data Subjects (in particular for Candidate data imported via the Import Agent);

• maintain a record of processing and comply with the principles of the Applicable Data Protection Laws;

• ensure compliance with its controller obligations before and throughout the processing.

D. Processing P3 - RSight as Controller of its sourcing pool and advertising

RSight collects, organises, stores, structures and cross-references the Personal Data of Candidates from publicly available data, recruitment sites or professional social networks, or provided by authorised suppliers from their own databases, in each case in accordance with the GDPR, in order to build and maintain its own candidate sourcing pool; and it collects applications generated by advertisements placed under its own brand. RSight collects and processes only data strictly necessary to provide the AI Recruitment Solution. The procedures for collecting and processing Candidate data are set out in RSight's Candidate Privacy Policy (Privacy Policy). RSight is Controller of this pool acquisition and advertising processing, including the acquisition and maintenance of its sourcing pool, the Posting Agent, and the advertising stage of the Hiring Agent. The third-party sources and suppliers are independent controllers of their own databases, and RSight maintains agreements with them confirming that the data is provided in accordance with the GDPR. The customer-directed search performed by the Search Agent is governed by P4 (RSight as Processor), not by this processing.

E. Processing P5 - the Customer as Controller of its evaluation and recruitment decision

When qualified Candidates and Talents are made available to the Customer, the Customer is the Recipient of the data required for recruitment, namely: a link to the professional profile; an interview/screening report; the CV; and contact details. As soon as the Customer reviews this data, evaluates Candidates and decides with whom to move forward, the Customer acts as an independent Controller of that processing. As such, the Customer undertakes to process the data in accordance with Applicable Data Protection Laws and its internal rules, solely for recruitment purposes, to provide Candidates with the required information and obtain any consent required where applicable, and to honour Candidates' rights in respect of its own processing. RSight is not responsible for the compliance of the processing carried out by the Customer.

F. Audit

RSight shall make available to the Customer, on request, the information and documents necessary to demonstrate compliance with its processor obligations and to enable audits. The Customer may carry out an audit once (1) per year at its own expense, with at least thirty (30) days' prior notice, giving preference to a desk audit. RSight may refuse an auditor belonging to a competing company. Audits are conducted during RSight's working hours, with minimal disruption, and must not prejudice RSight's security measures, the data of other customers, or RSight's operations. The parties agree the scope in advance. The draft report is shared with RSight for written observations, appended to the final report. Each audit report is Confidential Information.

APPENDIX 2 - US STATE PRIVACY ADDENDUM (CCPA/CPRA)

This Addendum applies where the Customer or RSight processes the Personal Information of residents of California or of other US states with comparable privacy laws, and supplements Appendix 1. Capitalised terms not defined here (e.g. "Business", "Service Provider", "Sell", "Share", "Business Purpose") have the meaning given in the CCPA/CPRA.

Roles. For processing in which RSight processes Personal Information on behalf of the Customer (corresponding to P2 and P4 - User accounts, the customer-directed search via the Search Agent, Customer-imported data, and contacting/screening of Candidates the Customer selected), the Customer is the Business and RSight is a Service Provider. For processing in which RSight determines the purposes and means of processing Candidate Personal Information - its own sourcing pool and advertising (corresponding to P3) - RSight acts as a Business in its own right. For its review, evaluation and recruitment decisions (corresponding to P5), the Customer acts as a Business in its own right.

Service Provider commitments. When acting as Service Provider, RSight shall: (a) process Personal Information only to perform the Business Purposes specified in the Contract and the Customer's instructions; (b) not Sell or Share the Personal Information; (c) not retain, use or disclose the Personal Information for any purpose other than the specified Business Purposes, or outside the direct business relationship with the Customer, except as permitted by the CCPA/CPRA; (d) not combine the Personal Information with information received from other sources except as permitted by the CCPA/CPRA; (e) provide the same level of privacy protection required of the Customer; (f) notify the Customer if it determines it can no longer meet these obligations; and (g) assist the Customer in responding to verifiable consumer requests (access, deletion, correction, opt-out) to the extent the data is under RSight's control as Service Provider. The Customer may take reasonable steps to ensure RSight uses the Personal Information consistently with these obligations.

RSight as Business. Where RSight is a Business (P3), RSight is responsible for providing the notices, honouring consumer rights and meeting the obligations imposed on a Business under the CCPA/CPRA with respect to the Candidate Personal Information it controls.

No sale. Neither party Sells or Shares the other's Personal Information disclosed under the Contract, and no monetary or other valuable consideration is exchanged for such disclosure other than the performance of the Contract.

APPENDIX 3 - AI ACT RESPONSIBILITIES

This Appendix details the allocation of responsibilities under Regulation (EU) 2024/1689 (AI Act) and supplements Article 13. The AI Recruitment Solution includes AI systems intended for recruitment/selection, classified as high-risk under Annex III. Obligations apply in accordance with the AI Act's phased application calendar.

RSight - Provider. RSight is responsible, with respect to the high-risk AI systems it develops and supplies, for: the risk-management system; data and data-governance measures (including measures to detect and mitigate bias); technical documentation; automatic record-keeping (logging); transparency and provision of instructions for use to the Customer; designing the system to allow effective human oversight; appropriate accuracy, robustness and cybersecurity; the quality-management system; conformity assessment, EU declaration of conformity and CE marking where required; registration in the relevant EU database; and taking corrective action and notifying authorities of risks and serious incidents at provider level.

Customer - Deployer. The Customer is responsible, as deployer, for: using the system in accordance with RSight's instructions for use; assigning human oversight to competent, trained natural persons with the authority to disregard, override or reverse the system's output and to decide not to use it; ensuring that input data and criteria under its control are relevant and sufficiently representative for the intended purpose; monitoring operation and suspending use and informing RSight where it identifies a risk or malfunction; informing RSight and, where required, the market-surveillance authority of any serious incident; keeping the logs automatically generated by the system to the extent under its control; informing affected workers and their representatives prior to deployment where required; providing the transparency information due to affected Candidates; and, where the Customer falls within the categories required to do so, carrying out a fundamental-rights impact assessment.

Cooperation. Each party shall provide the other with the information and cooperation reasonably necessary to enable the other to meet its respective AI Act obligations, including documentation, technical information and logs reasonably required. Nothing in the Contract relieves either party of an obligation that the AI Act imposes on it directly, nor transfers provider obligations to the Customer or deployer obligations to RSight, except as the AI Act expressly permits.

APPENDIX 4 - LIST OF AUTHORISED SUB-CONTRACTORS

• Microsoft:

  • Subcontracted processing activities:

    • Database (Cosmos DB in Azure)

    • User management (Entra ID)

  • Location of treatments:

    • European Union