Data Processing Agreement

1. Subject and purpose

Hosting and processing candidate, client and contact personal data entered by the Customer to run its recruitment operations.

2. Duration

The term of the Service plus the retention periods in our Privacy Notice, section 4.

3. Categories of data subjects and data

Candidates (identity, contact, CV and work history, availability, documents the Customer uploads); client contacts (business contact data); Customer users (see our Privacy Notice). No special-category data is required by the Service; the Customer must not enter it unless it has a lawful basis and tells us.

4. Instructions

We process only on the Customer’s documented instructions, which are the Service’s functions and our Terms of Service.

5. Confidentiality and security

Staff bound by confidentiality; workspace isolation; encryption in transit; encrypted storage for sensitive columns; access logging; backups; least-privilege access; no candidate data in logs.

6. Sub-processors

We use the service providers on our Sub-processors page to process data on the Customer’s behalf, under contracts that bind them to our instructions and to confidentiality. We notify changes 30 days in advance and the Customer may object on reasonable grounds.

The current list, with what each provider does, where, and the transfer basis, is on our Sub-processors page.

7. Assistance

We help the Customer respond to data-subject requests and to carry out impact assessments, at reasonable cost where the effort is significant.

8. Deletion and return

Export in the Service at any time; deletion per Terms section 11.3.

9. Audits

On request, once a year, by written questionnaire or, at the Customer’s cost, an independent auditor under confidentiality.

10. Transfers outside the EU/EEA

Only to sub-processors covered by an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses (see the table above).