Data processing addendum

This addendum forms part of the agreement between Qualifyed and the company using the platform ("Customer"). Qualifyed is the controller of candidate data it collects directly from candidates. Once a candidate sends their CV to the Customer, the Customer is an independent controller of that data for its own hiring decisions. Where Qualifyed processes the Customer's mandate data on its instructions, it acts as a processor. [Placeholder — confirm role allocation with counsel.]

Processing lasts for the term of the Customer's use of the platform, plus the retention periods described in the privacy notice. Subject matter: publication of mandates, requirement-based matching, and receipt of candidate applications.

Data subjects: candidates who apply to the Customer, and the Customer's own users. Data categories: identity and contact details, CV content, professional history, languages, work authorisation status, compensation expectations, and application outcomes. No special-category data is requested.

• Use candidate data only to assess and progress the specific application received.
• Do not re-share candidate data outside your hiring team, or enrich it with external sources without a lawful basis.
• Respond to candidate rights requests concerning data you hold as controller.
• Record hiring outcomes accurately, since these drive candidate-visible status.

• Encryption in transit (HTTPS) and at rest at the storage layer.
• Access control enforced at the database level, scoped per account.
• CV files stored privately and served only through short-lived signed links.
• Access to a candidate's CV and contact details ends 90 days after sending, or immediately on withdrawal or placement elsewhere.
• Rate limiting on authentication and sending, and an immutable audit log of privileged actions.

Qualifyed uses sub-processors for hosting, database and storage, transactional email, geocoding and AI-based CV parsing. [Placeholder — list each sub-processor, purpose and hosting region, and define the notice period for changes.]

Where personal data leaves the EEA or UK, transfers rely on the applicable standard contractual clauses and supplementary measures. [Placeholder — confirm mechanisms.]

Qualifyed will notify the Customer without undue delay after becoming aware of a personal data breach affecting its data, and will provide reasonable assistance with rights requests, impact assessments and audits. [Placeholder — insert notification windows and audit process.]

Accounts are anonymised rather than hard-deleted: identifying data is stripped while hiring outcome records are retained. Dormant candidate profiles are anonymised after 24 months, and application records are archived after 24 months.