Data Processing Agreement

Terms such as **controller**, **processor**, **personal data**, **processing**, **data subject**, **personal data breach** and **supervisory authority** have the meanings given in the UK GDPR or EU GDPR, as applicable.

• • **Data Protection Law** means all data protection law that applies to the processing, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the EU GDPR and national laws implementing the ePrivacy Directive, and, where relevant, the laws listed in Part 5.
• • **Venue Data** means personal data processed by RecruitCommis on the Venue's behalf, as described in Part 1 and Annex 1.
• • **Platform Data** means personal data for which RecruitCommis is controller, as described in Part 1.
• • **Sub-processor** means a third party RecruitCommis engages to process Venue Data.

---

| Activity | Data subjects | RecruitCommis | Venue |

|---|---|---|---|

| **A.** Applications to the Venue's jobs and the Venue's pipeline: CVs, screening answers, match scores for the Venue's jobs, shortlists, rejections, offers, notes, trial bookings and trial assessments | Applicants | Processor | Controller |

| **B.** Your Team: staff records, right-to-work documents, emergency contacts, alumni records, staff referral tracking and payroll exports | Staff, referrers, emergency contacts | Processor | Controller |

| **C.** Candidate accounts and profiles, candidate-side matching, visibility settings, consent records, data subject requests to RecruitCommis | Candidates | Controller | — |

| **D.** Candidate data disclosed to the Venue through the "Available Now" feed, cross-venue Talent Bank search and Table 2 Table introductions | Candidates | Controller (disclosing) | Independent controller once received |

| **E.** Messages sent to candidates through RecruitCommis channels (WhatsApp, SMS, email), including Pings, broadcasts and re-engagement | Candidates | Joint controller | Joint controller |

| **F.** Venue account users, verification, billing, support, security, fraud prevention, document access logs, and de-identified statistics | Venue users, all | Controller | — |

A candidate's information may move between rows. For example, a candidate's profile is Platform Data (row C); when they apply to the Venue, the application is disclosed to the Venue (row D) and then processed by RecruitCommis in the Venue's pipeline on the Venue's behalf (row A).

**Conversations outside the platform.** When a Venue user contacts a candidate by phone or personal WhatsApp using RecruitCommis's one-tap links, that conversation is outside RecruitCommis. The Venue is the sole controller of it. RecruitCommis records only that contact was started and any outcome the user chooses to record.

---

These terms meet Article 28(3) of the UK GDPR and EU GDPR.

**2.1 Instructions.** RecruitCommis will process Venue Data only on the Venue's documented instructions, including with regard to international transfers, unless the law requires otherwise (in which case RecruitCommis will tell the Venue first, unless the law prohibits it). The Venue's instructions are: this DPA, the Terms, and the Venue's use and configuration of the platform, including scoring weights, retention settings and deletion actions. RecruitCommis will tell the Venue if it thinks an instruction breaks Data Protection Law.

**2.2 Confidentiality.** RecruitCommis will ensure that everyone authorised to process Venue Data is bound by confidentiality.

**2.3 Security.** RecruitCommis will implement the technical and organisational measures in Annex 2, and keep them appropriate to the risk. It may update them as long as the overall level of protection doesn't go down.

**2.4 Sub-processors.**

• • The Venue gives general authorisation for RecruitCommis to use the Sub-processors listed at [recruitcommis.com/subprocessors](/subprocessors).
• • RecruitCommis will give at least **30 days' notice** before adding or replacing a Sub-processor, by email to the Venue's owner and to anyone subscribed on that page, and by listing it as a proposed change. In an emergency (for example, a provider failing), RecruitCommis may make the change sooner and will notify the Venue as soon as possible, with reasons.
• • The Venue may object on reasonable data protection grounds within **14 days** of notice, at **Settings → Legal**. The parties will discuss the objection in good faith. If it can't be resolved, the Venue may terminate the affected service and receive a pro-rata refund of prepaid fees for it.
• • RecruitCommis will impose data protection obligations on each Sub-processor that are no less protective than this DPA, and remains responsible to the Venue for its Sub-processors.

**2.5 Helping with data subject rights.** RecruitCommis provides tools for the Venue to find, export, correct and delete Venue Data. Where the Venue can't do something itself, RecruitCommis will help, taking into account the nature of the processing. If RecruitCommis receives a request about Venue Data directly, it will pass it to the Venue within **5 working days** and won't respond to it except to say it has been passed on, unless the Venue asks it to or the request also concerns Platform Data.

**2.6 Helping with compliance.** RecruitCommis will help the Venue meet its obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to RecruitCommis. RecruitCommis publishes a description of how CommisBot works, including its scoring components and default weights, and will provide further information reasonably needed for the Venue's impact assessment.

**2.7 Personal data breaches.** RecruitCommis will notify the Venue without undue delay, and in any event within **48 hours**, after becoming aware of a personal data breach affecting Venue Data. The notice will include what RecruitCommis knows at the time about the nature of the breach, the data and people affected, likely consequences, and measures taken or proposed, followed by updates as more is known. Notifying the Venue is not an admission of fault.

**2.8 End of processing.** On termination:

• • The Venue can export its data at any time using the platform's export tools, including the Your Team and right-to-work audit export. The right-to-work audit export is limited to one per venue in any 24-hour period, requires the exporter to confirm their identity at the point of export, notifies the Venue's owner each time, and includes a manifest identifying who produced the bundle, when and why. A second export within 24 hours requires the owner's approval.
• • By default, and as the Venue's instruction, RecruitCommis retains Venue Data for **12 months** after cancellation or during a Mise en Place pause, so the Venue can reactivate, and then deletes or anonymises it.
• • The Venue can instead instruct deletion sooner at **Settings → Legal → Delete our data**. RecruitCommis will then delete Venue Data within **30 days**, and it will be overwritten from backups within a further [BACKUP_RETENTION_DAYS not set] days.
• • RecruitCommis may keep data it's required to keep by law, and anonymised statistics that no longer identify anyone.

**2.9 Retention during the relationship.** The Venue sets retention for Venue Data using its regional retention settings. Where it hasn't, the defaults are: applications 12 months after the job closes; right-to-work documents for the period local law requires the Venue to keep them (UK: length of employment plus 2 years). When RecruitCommis anonymises a record, it removes the candidate link from hiring events and keeps the de-identified row so the Venue's reporting remains accurate.

**2.10 Audits.** RecruitCommis will make available the information reasonably necessary to demonstrate compliance with this Part 2, including completing one security questionnaire a year and sharing summaries of relevant third-party certifications held by its Sub-processors. The document access log, the candidate-facing access history and the export manifest described in Annex 2 are available as evidence of access control over right-to-work data. If that isn't enough, or a supervisory authority requires it, or after a personal data breach, the Venue may carry out an audit (itself or through an independent auditor bound by confidentiality) on at least 30 days' notice, during business hours, no more than once a year, at the Venue's cost.

**2.11 Processing for RecruitCommis's own purposes.** The Venue agrees that RecruitCommis may, as a controller, use Venue Data to keep the platform secure, prevent fraud and misuse, maintain document access logs, and create de-identified or aggregated statistics to operate and improve the platform. RecruitCommis will not use Venue Data to market to candidates on its own behalf, to train CommisBot on identifiable data from one venue for the benefit of another, or to disclose one Venue's data to another Venue.

---

When RecruitCommis discloses candidate data to the Venue through the "Available Now" feed, cross-venue Talent Bank search or a Table 2 Table introduction, each party is an independent controller. RecruitCommis discloses on the basis of the candidate's own choices, and only to verified Venues. The Venue will:

• • use the data only to consider the candidate for genuine roles at its venues;
• • not disclose it to anyone else, except its own advisers or where the law requires;
• • honour the candidate's choices shown in the platform, including opt-outs, hidden-venue settings and deletion;
• • keep it secure, and delete it when no longer needed for that purpose;
• • provide its own privacy information to the candidate where Data Protection Law requires; and
• • tell RecruitCommis promptly if it receives a request or complaint that concerns RecruitCommis's handling of the data.

When an applicant applies to the Venue, the application is disclosed under this Part and then processed under Part 2.

---

This Part sets out the arrangement required by Article 26 of the UK GDPR and EU GDPR for messages sent to candidates through RecruitCommis channels. RecruitCommis publishes the essence of it in its [Privacy Policy](/privacy#roles).

| Responsibility | RecruitCommis | Venue |

|---|---|---|

| Deciding which candidates to message, and why | | ✓ |

| Content of free-form messages and choice of template | | ✓ |

| Lawful basis for contacting each candidate | Consent records, opt-in and opt-out | Recruitment purpose of the message |

| Recording and honouring consent and STOP replies | ✓ | |

| Sending number, sender identity, template approval | ✓ | |

| Quiet hours, rate limits, blocking sends without opt-in | ✓ | |

| Transparency to candidates about messaging | ✓ (Privacy Policy section 6) | ✓ (own notice where required) |

| Responding to candidates' requests and complaints about messaging | ✓ (first point of contact) | Cooperate within 5 working days |

| Notifying breaches involving messaging data | ✓ (lead) | Cooperate |

Candidates may exercise their rights against either party. Each party is responsible for the parts allocated to it above.

---

**5.1 Transfers by RecruitCommis.** RecruitCommis may transfer Venue Data outside the UK or EEA, including to Sub-processors, only where a transfer safeguard recognised by Data Protection Law applies. The safeguard for each Sub-processor is listed on the Sub-processors page.

**5.2 Transfers from the EEA to RecruitCommis.** Where a Venue in the EEA transfers personal data to RecruitCommis in the UK, the parties rely on the European Commission's adequacy decision for the UK. If that decision no longer applies, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated into this DPA: Module 2 for Part 2 processing and Module 1 for Parts 3 and 4, with Clause 7 (docking) not included, the optional wording in Clause 11 not included, Clause 17 governed by Irish law, and disputes under Clause 18 before the courts of Ireland. Annex 1 and Annex 2 of this DPA complete the Appendix.

**5.3 Transfers to a Venue outside the UK or EEA.** Where RecruitCommis, as a processor in the UK, returns Venue Data to a Venue outside the UK, no restricted transfer arises as the data is going to the controller. Where a transfer of Platform Data under Part 3 is a restricted transfer, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies, with the tables completed by Annexes 1 and 2 and neither party able to end it under Section 19.

**5.4 United States.** For personal information of US residents, RecruitCommis is a "service provider" or "processor" under applicable state privacy law for Part 2 processing. It will not sell or share that information, retain, use or disclose it for any purpose other than providing the services, or outside the direct business relationship, or combine it with information from other sources except as permitted by law. It will comply with applicable obligations and notify the Venue if it can no longer meet them. The Venue is responsible for employer duties under local automated employment decision laws, such as New York City Local Law 144 (Terms clause 20.5).

**5.5 Canada.** RecruitCommis will protect Venue Data with safeguards comparable to those the Venue must provide under PIPEDA and, for Québec, the Act respecting the protection of personal information in the private sector. It will help the Venue give Québec candidates the information required about decisions based on automated processing, in French.

**5.6 Australia and New Zealand.** RecruitCommis will handle Venue Data consistently with the Australian Privacy Principles and the New Zealand Information Privacy Principles, and will support the Venue's assessment and notification obligations under the Australian Notifiable Data Breaches scheme and New Zealand's notifiable privacy breach rules.

**5.7 Gulf states.** For Venues whose region is set to GCC, RecruitCommis will process passport, visa, Iqama and national ID data only in the right-to-work vault, alert the Venue owner whenever a non-owner role opens one and include the purpose the viewer recorded, apply a shorter vault session (10 minutes, without extension) and require a fresh identity confirmation before each download, and cooperate with the Venue on the requirements of the UAE Federal Decree-Law No. 45 of 2021, the Saudi Personal Data Protection Law and the Qatar Personal Data Privacy Protection Law, including any data localisation or transfer conditions that apply to the Venue.

---

**6.1** This DPA lasts as long as RecruitCommis processes Venue Data.

**6.2** Liability under this DPA is subject to the limits in the Terms, except that nothing limits either party's liability to data subjects under Data Protection Law, or liability that can't be limited by law.

**6.3** RecruitCommis may update this DPA to reflect changes in law or in its services, with at least 30 days' notice, and the Venue's owner will be asked to accept the new version. Changes won't reduce the overall protection for Venue Data. Previous versions are at [recruitcommis.com/legal/dpa/versions](/legal/dpa/versions).

**6.4** This DPA is governed by the law of England and Wales, except where Part 5 says otherwise.

---

| | |

|---|---|

| **Subject matter** | Providing the RecruitCommis hiring platform to the Venue |

| **Duration** | The term of the Venue's account plus the retention period in Part 2.8 |

| **Nature and purpose** | Hosting, storing, organising, displaying, scoring, transmitting and deleting personal data so the Venue can advertise roles, receive and assess applications, book and assess trial shifts, make offers, manage right-to-work records and staff referrals, and report on hiring |

| **Data subjects** | Applicants to the Venue's jobs; the Venue's staff and former staff; staff who refer candidates; candidates' emergency contacts |

| **Personal data** | Identity and contact details; CVs, work history, skills and certificates; availability, location area and travel radius; screening answers; match scores and their breakdowns; trial bookings, check-ins, attendance and assessments; notes; offers; messages; right-to-work documents and share codes; food hygiene certificates; emergency contact details; referral milestones and reward amounts |

| **Special category data** | None intended. Right-to-work documents may reveal nationality and, from photos, characteristics that could indicate racial or ethnic origin; they are processed only for the right-to-work purpose and never used in scoring. The Venue must not enter health, criminal record or other special category data into notes or free-text fields |

| **Frequency** | Continuous |

| **Retention** | As set in Part 2.8 and 2.9 |

These are the technical and organisational measures required by Article 32. Right-to-work data is held to a higher standard than the rest of the platform, and the measures are set out separately below for that reason.

### General

• • **Access control:** each Venue can access only its own records, enforced by row-level security in the database for every venue-scoped table and storage bucket, not only in the interface. Roles (owner, ops director, GM, manager, viewer) limit what each user can do.
• • **Encryption:** TLS in transit; AES-256 encryption at rest.
• • **Authentication:** individual accounts, no shared logins, at any level. Multi-factor authentication is required for RecruitCommis administrative access.
• • **Staff access:** RecruitCommis personnel access production data only where needed to provide support or investigate an issue, and that access is logged.
• • **Resilience:** automated backups on a rolling [BACKUP_RETENTION_DAYS not set]-day cycle; outbound automation events are queued and retried so they're not lost if a provider fails.
• • **Integrity:** Ping ledger and hiring events are append-only records.
• • **Testing:** automated tests confirm that one Venue's users receive no rows from another Venue's data.
• • **Incident response:** documented breach response procedure, with notification to the Venue under Part 2.7.
• • **Suppliers:** Sub-processors are assessed before use and bound by written data protection terms.

### CVs and general documents

• • Stored in private buckets. Access is only through signed links issued on the server to authorised users, expiring after 5 minutes. Every issue of a link is logged with the user, candidate, document and time.

### Right-to-work documents

• • **Designated access.** A Venue role does not by itself grant access. A named individual must be granted document access by the Venue's owner or operations director, at one of three levels: view, view and download, or manage others' access. The `viewer` role cannot be granted any level. A grant may carry an expiry date for temporary cover.
• • **Automatic removal.** A grant is withdrawn, and any open vault session ended, when the person's membership is removed, their role changes, a temporary grant expires, their password changes or their credentials are revoked. Expiry is swept every 15 minutes rather than overnight.
• • **Step-up authentication.** Opening the vault requires the already signed-in user to re-authenticate with a passkey (WebAuthn) or a time-based one-time code. Where the Venue has an identity provider configured, a provider re-authentication carrying a multi-factor claim may be accepted instead, and the Venue's owner may require that route and disable the other two. Password re-entry is not accepted as a step-up method. The resulting session lasts 15 minutes, extended by activity to a maximum of 60, and 10 minutes without extension for Venues in the Gulf. Downloading a document requires the download permission; running the audit export, changing another person's access, or enrolling or revoking a credential requires a fresh re-authentication each time rather than an existing session.
• • **No biometric data.** Passkey authentication uses platform authenticators that retain the biometric template on the user's device. RecruitCommis receives a public key and a signature only. No biometric identifier is collected, stored, transmitted or sold.
• • **Purpose capture.** The viewer records once per session why they are opening documents. The purpose is written to every access-log row in that session.
• • **Signed links.** Links to right-to-work documents expire after 120 seconds, are valid once, and are bound to the session that requested them. A replayed or cross-session link is refused and the attempt recorded.
• • **View-only by default.** Documents are streamed through the server into an in-app viewer rather than delivered to the browser as a file. Download is a separate permission and a separately logged action. Vault responses are not cached on the device.
• • **Watermarking.** Every document rendered in the viewer and every individual download carries a server-applied overlay naming the viewer, the Venue and the UTC time. The audit export bundle is the exception, as an inspector may not accept a marked copy; it contains a manifest naming the exporter, their role, the purpose and a reference that can be quoted back to the log.
• • **Logging.** Every view and every download writes one access-log row recording the user, the document, the time, the authentication method, the session and the purpose. The log is retained for 12 months in identified form, then the actor is reduced to a role label, and it survives the deletion of the candidate it concerned in pseudonymised form so that a breach assessment remains possible.
• • **Candidate transparency.** Candidates can see, in their own account, each occasion a Venue opened one of their documents in the last 12 months, with the date and the recorded purpose. The individual viewer's name is not shown to the candidate.
• • **Heightened notification.** The Venue's owner is notified on every audit export, in every region; on any access to the documents of a candidate aged 16 or 17 by anyone other than the owner, in every region; and, for Gulf Venues, on any non-owner access.
• • **Anomaly detection.** A rolling job flags more than 20 document views by one person in an hour, access from a device not previously seen for that person, access more than four hours outside the Venue's recorded operating hours, and any refused link replay. Most flags raise a notification and nothing else: the unfamiliar-device flag notifies the user rather than the Venue's owner, because it concerns their credential, and the out-of-hours flag goes into a weekly owner digest. Exceeding 20 views in an hour additionally requires a fresh re-authentication before the person continues.
• • **Verification gate.** A Venue whose business has not been verified cannot open the vault, request documents from a candidate, or run the audit export.

The current list, including each Sub-processor's purpose, location and transfer safeguard, is at [recruitcommis.com/subprocessors](/subprocessors) and forms part of this DPA.