API data-processing addendum

Version 2026-10

This API data-processing addendum (“Addendum”) forms part of the Data Processing Agreement (“DPA”) between Wipperoz Pty Ltd (ACN 623 500 603) (“Wipperoz”) and the organisation that holds an Orbit account (the “Customer”). It has a version of its own: a new version of the DPA is not a new version of this Addendum, and a new version of this Addendum changes nothing in the DPA. Terms defined in the DPA have the same meaning here.

1. Parties, scope and relationship to the DPA

This Addendum applies when the Customer uses the Orbit Applications API (POST /v1/jobs/{jobId}/applications and POST /v1/candidates) to send Wipperoz the details and CVs of candidates it collected on its own website or in its own systems. It adds to the DPA; where the two conflict about data sent over the Applications API, this Addendum prevails.

An Admin accepts this Addendum on the Customer’s behalf in Orbit, in Settings → API keys, before a key with the Receive applications scope can be created. Wipperoz records which version was accepted, by which Admin and when, in the account’s consent history, which it keeps until the account is deleted. The version that applies to a candidate’s data is the one published when that data is sent.

2. What changes

On the hosted apply page, Wipperoz shows the candidate its consent text and records their acceptance itself. Over the Applications API, the Customer collects that consent on its own page, so the Customer takes on the obligations in section 3.

What follows does not change. Wipperoz builds a Virtual CV for the candidate — as processor for the application record it holds for the Customer, and as controller of the candidate’s Virtual CV and account, under the Privacy Policy — and emails the candidate, in Wipperoz’s wording, a link to claim it. The Customer cannot suppress that email for applicants: it is how the candidate learns that a Virtual CV exists and is theirs.

3. The Customer’s obligations

The Customer will:

Show the consent text unmodified. Display the text that GET /v1/consent-text returns, in full and without change, at the point of application, in the language the candidate is using
Send an application only once the candidate has actively accepted it. No pre-ticked box, no acceptance implied from submitting the form. With each application, send a truthful receipt: the identifier and version of the text shown, and the time, IP address and user agent of the acceptance as the Customer’s own server saw them
Hold a lawful basis for each person sent to POST /v1/candidates, for sending their name, email address and CV to Wipperoz — the same attestation Orbit asks for in Import CVs — and attest it with every request
Tell candidates in its own privacy notice that their details go to Wipperoz and what Wipperoz does with them, with a link to the Wipperoz Privacy Policy
Keep API keys on servers it controls, never in a browser or a public repository, and revoke a key it believes exposed
Send only what the application needs. No special-category data (for example health, religion or ethnic origin) in free-text fields, beyond what the candidate put in their own CV
Not keep copies of the consent text to alter it later. The text is Wipperoz’s and is served by the API so that every candidate sees the current one

4. Wipperoz’s obligations

Wipperoz will:

Process the data sent over the Applications API only to create the application record or the My candidates entry, build and hold the Virtual CV, email the candidate, and provide Orbit to the Customer
Store the consent receipt and the Customer’s attestation verbatim with the application or the entry, and show them to the Customer in Orbit
Delete the uploaded PDF once the Virtual CV has been built, or once it is clear that it cannot be
Treat the candidate’s choice to claim, keep, decline or delete the Virtual CV as the DPA and the Privacy Policy set out
Email a person one claim invitation per 30 days at most, whichever Customers send them

5. Candidates’ rights

A candidate may claim the Virtual CV, keep it, delete it, and end the Customer’s access to it, as the Privacy Policy describes; a deleted Virtual CV is reported to the Customer as deleted, and nothing more. A person who has asked Wipperoz not to hold their CV is not held, whichever Customer sends them. The Customer will pass to privacy@wipperoz.com, without undue delay, any request it receives from a candidate that concerns data Wipperoz holds, and section 10 of the DPA applies.

The Customer is responsible for the lawfulness of the collection on its own site or systems: that the consent text was shown, that the acceptance was real, that the receipt is truthful, and that it holds the lawful basis it attests to. The Customer will indemnify Wipperoz against claims, fines and costs that arise from an application or a candidate sent without them. Wipperoz may suspend a key, or the account’s use of the Applications API, where it has reason to believe that applications are being sent without the consent text being shown, or that candidates are being sent without a lawful basis; it tells the account’s Admins when it does. Section 15 of the DPA applies to this Addendum.

7. Term

This Addendum applies for as long as the Customer holds a key with the Receive applications scope, and to all data sent under one. Revoking a key does not release the Customer from its obligations for data already sent. This Addendum ends when the DPA ends.

8. Changes

Wipperoz publishes each new version of this Addendum at wipperoz.com/en/about/api-addendum, with a new version number and date. Before a new Receive applications key can be created, an Admin is asked to accept the current version. Existing keys keep working: the obligations the Customer accepted continue to apply to them and, where a new version extends them, it applies to data sent after it is published (section 1).

Questions about this Addendum: privacy@wipperoz.com