Data Processing Addendum

What is processed

• Subject matter — running automated job applications and outreach.
• Duration — for as long as the account is open, plus the retention periods in the Privacy Policy.
• Categories of data subject — the candidates whose accounts you administer, and the employer contacts we email on their behalf.
• Categories of data — identity and contact details, resume and career history, work authorisation status, and message content and delivery events.

Our obligations

• Process personal data only on your documented instructions, unless the law requires otherwise — in which case we tell you first, unless the law forbids that too.
• Bind everyone with access to confidentiality.
• Keep the technical and organisational measures described on the Security page.
• Help you answer data subject requests and, where needed, data protection impact assessments.
• Delete or return personal data at the end of the contract, on your choice.
• Make available what you need to verify all of the above, including an annual audit on reasonable notice.

Sub-processors

You give general authorisation for the sub-processors listed in the Privacy Policy. We will give 30 days' notice before adding one, and you may object on reasonable data protection grounds — in which case you can terminate the affected part of the service without penalty. Each sub-processor is bound by terms no weaker than these.

Transfers

Personal data may be processed outside your country. Where the GDPR applies, transfers rely on the EU Standard Contractual Clauses plus supplementary measures, and the UK Addendum where the UK GDPR applies.

Breach notification

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it.

To execute a signed copy, write to support@usesidedoor.com.