The Reference Checker (Recruitment) Ltd - Data Processing Agreement

This Data Processing Addendum (“Addendum”) forms part of the Terms and Conditions (the “Agreement”) between YOU (“Controller”) and The Reference Checker (Recruitment) (“Processor”). Any terms not defined in this Addendum shall have the meaning set forth in the Agreement. In the event of a conflict between the terms and conditions of this Addendum and the Agreement, the terms and conditions of this Addendum shall supersede and control. This Data Processing Addendum (“Addendum”) forms part of the Terms and Conditions (the “Agreement”) between YOU (“Controller”) and The Reference Checker (Recruitment) (“Processor”). Any terms not defined in this Addendum shall have the meaning set forth in the Agreement. In the event of a conflict between the terms and conditions of this Addendum and the Agreement, the terms and conditions of this Addendum shall supersede and control.

1. Definitions

1.1. “Anonymous Data” means information that does not relate to an identified or identifiable natural person, or Personal Data rendered anonymous in such a manner that the Data Subject is not or is no longer identifiable, taking account of all means reasonably likely to be used. Pseudonymised data remains Personal Data.

1.2. “Authorised Employee” means an employee of Processor who has a need to know or otherwise access Personal Data to enable Processor to perform their obligations under this Addendum or the Agreement.

1.3. “Authorised Individual” means an Authorised Employee or a person authorised by Processor or an Authorised Sub-processor to process Personal Data for the Services.

1.4. “Authorised Sub-processor” or “Sub-processor” means a third party engaged by Processor to process Personal Data on behalf of Controller in accordance with Section 4. A supplier that does not process Personal Data on behalf of Controller is not a Sub-processor merely by supplying services.

1.5. “Data Subject” means an identified or identifiable person to whom Personal Data relates.

1.6. “Instruction” means a direction, either in writing, in textual form (e.g. by e-mail) or by using a software or online tool, issued by Controller to Processor and directing Processor to Process Personal Data.

1.7. “Personal Data” has the meaning given in the applicable Data Protection Laws and includes any Personal Data processed by Processor on behalf of Controller under the Agreement. Pseudonymised data is not excluded.

1.8. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

1.9. “Process” or “Processing” means any operation or set of operations which is performed upon the Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.

1.10. “Special Category Data” means personal data within Article 9 UK GDPR (and, where applicable, EU GDPR). “Criminal Offence Data” means personal data relating to criminal convictions, offences or related security measures within Article 10. Other sensitive identifiers and financial data remain Personal Data and must receive security appropriate to their risk.

1.11. “Services” shall have the meaning set forth in the Agreement.

1.12. “Standard Contractual Clauses” means the standard contractual clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time, for the transfer of personal data to third countries under the EU GDPR. For transfers of personal data subject to UK GDPR, appropriate safeguards shall include, where applicable, the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, as approved by the UK Information Commissioner and amended or replaced from time to time.

1.13. “Supervisory Authority” means an independent public authority which is established by a member state of the European Union, Iceland, Liechtenstein, or Norway or, in the United Kingdom, the Information Commissioner's Office (ICO) as the relevant UK supervisory authority.

1.14. “Data Protection Laws” means all applicable laws and regulations relating to the protection of Personal Data and privacy, including the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (as amended), the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), where applicable, and any legislation amending, replacing or supplementing those laws, in each case only to the extent applicable to the relevant party and its Processing of Personal Data under the Agreement.

2. Processing of Data

2.1. Each party shall comply with Data Protection Laws applicable to it. Controller is solely responsible for determining the purposes and lawful basis of processing, providing privacy notices, satisfying any Article 9 or Article 10 conditions, obtaining necessary consents where applicable, the accuracy and legality of data supplied, and its documented instructions. Controller shall not submit data beyond the agreed Services or any prohibited or unnecessary sensitive data. To the extent permitted by law, Controller shall indemnify Processor against third-party claims, regulatory losses and reasonable costs arising from Controller’s unlawful instructions, lack of lawful basis, or breach of this clause, except to the extent caused by Processor’s own breach of this Addendum or applicable law. No indemnity limits a data subject’s or regulator’s statutory rights.

2.2. Processor shall process Personal Data only on Controller’s documented instructions (including the Agreement, use of the Services and authorised transfers), unless required otherwise by applicable UK or EU law. In that case Processor shall inform Controller of the legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Processor may rely on instructions that reasonably appear authorised, and shall immediately inform the Controller if, in its opinion, an instruction infringes applicable Data Protection Laws. Processor may reasonably suspend an affected instruction or processing activity pending clarification to avoid illegality or material security risk, notifying Controller where lawful; such good-faith suspension shall not itself constitute a breach of the Agreement, subject to mandatory law. Material out-of-scope instructions require agreement on reasonable fees, scope and timing. Processor may use genuinely anonymised information outside this Addendum, provided it cannot reasonably identify an individual.

2.3. The subject matter of processing is the provision of the online referencing and related Services under the Agreement. The nature and purpose of processing include receiving, storing, organising, verifying, communicating and reporting reference related information on Controller’s instructions. Data Subjects may include job seekers, referees, and other persons whose details Controller submits through the Services. Personal Data may include names, contact details, employment and education history, reference responses and other information submitted by the Controller, Data Subjects or referees through the Service. Special Category Data or Criminal Offence Data shall be processed only where the Services expressly support it and Controller has identified an appropriate lawful basis and condition. Processing lasts for the Agreement term and the limited exit, backup and legally required retention periods in clause 2.4. Controller shall not upload information unnecessary for the Services. Controller shall not submit Special Category Data or Criminal Offence Data through free-text fields or otherwise unless the relevant functionality expressly supports such processing and the Controller has satisfied applicable legal conditions. The description of processing does not authorise any unsupported category of data.

2.4. On expiry or termination of the Services, Controller shall choose whether Processor returns or deletes Personal Data, subject to applicable law. Controller may use standard self-service export functionality before termination where available. If Controller provides a practicable written instruction within 30 days after termination, Processor shall comply within 30 days after receipt; otherwise Processor may securely delete the data after that period. Processor may retain data where required by applicable UK or EU law and may retain residual inaccessible backup copies until overwritten in the ordinary documented backup cycle, in each case protecting the data and restricting further processing. Bespoke exports, restoration and non-standard assistance will be charged at reasonable rates agreed in advance, without prejudice to the Processor's mandatory obligations under applicable Data Protection Laws. Processor shall confirm deletion on reasonable written request.

3. Authorised Personnel

3.1. Processor shall ensure that persons authorised to process Personal Data are appropriately trained and subject to access controls proportionate to their duties.

3.2. Processor shall ensure that all persons authorised to process data are made aware of the confidential nature of Personal Data and have executed confidentiality agreements that prevent them from disclosing or otherwise Processing, both during and after their engagement with Processor, any Personal Data except in accordance with their obligations in connection with the Services.

3.3. Processor shall restrict access to Personal Data to personnel and approved Sub-processors who require access for the Services, applying least-privilege access and periodic review.

4. Sub-processors

4.1. The Controller grants the Processor general written authorisation to engage, appoint, replace and remove Sub-processors as the Processor considers reasonably necessary for the provision, maintenance and development of the Services, without requiring separate or individual approval from the Controller.

4.2. The Processor shall inform the Controller of intended additions or replacements of Sub-processors by electronic notification through the Services, by email or a recorded electronic form, allowing the Controller a reasonable opportunity to object before the relevant change takes effect. The Processor shall not be required to publish a publicly accessible list of its Sub-processors.

4.3. Any objection must be made in writing within ten (10) days of notification and must identify reasonable data protection grounds. The Processor shall consider such objections in good faith but shall not be required to accept objections that are unfounded or disproportionate.

4.4. Where the Controller raises a reasonable objection that cannot be resolved, the parties shall seek a commercially reasonable solution. The Processor shall not be required to retain any particular Sub-processor or implement an alternative arrangement that would impose disproportionate cost or operational burden. Where no reasonable solution is available, either party may terminate the affected Services in accordance with the Terms and Conditions.

4.5. The Processor shall ensure that each Sub-processor is bound by a written agreement imposing data protection obligations in accordance with Article 28(4) of the applicable Data Protection Laws. The Processor shall remain responsible to the Controller for the performance of those obligations as required by applicable law.

4.6. Information concerning the Processor's Sub-processors, including their identities, functions, contractual arrangements and relevant processing locations, shall be treated as confidential and commercially sensitive information. The Controller shall not publish, disclose or otherwise make such information available to any third party without the Processor's prior written consent, except where disclosure is required by applicable law or a competent regulatory authority, or where disclosure is reasonably necessary to the Controller's professional advisers or auditors for legitimate legal, regulatory or data protection compliance purposes, provided that such recipients are subject to appropriate confidentiality obligations. Any permitted disclosure shall be limited to the information reasonably necessary for the relevant purpose.

5. Security

5.1. Processor shall implement and maintain appropriate technical and organisational measures in accordance with Article 32, having regard to the risks of processing. Measures shall include, as appropriate, access controls, confidentiality obligations, secure transmission, backup and recovery arrangements, incident response procedures and periodic review of security controls. Processor may update these measures from time to time, provided that it does not materially reduce the overall level of protection of Personal Data.

6. International Transfers

6.1. Processor shall not make a restricted transfer of Personal Data under applicable UK or EU Data Protection Laws except on Controller’s documented instructions or as required by law, and only with a valid applicable transfer mechanism and supplementary measures where necessary. Transfers shall be assessed separately under UK and EU regimes where both apply.

6.2. The Processor may transfer Personal Data outside the United Kingdom where necessary for the provision of the Services, provided that such transfers comply with applicable Data Protection Laws. Where an international transfer requires additional safeguards under applicable Data Protection Laws, the Processor shall ensure that an appropriate lawful transfer mechanism is in place, which may include an applicable adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or the European Commission's Standard Contractual Clauses adopted under Implementing Decision (EU) 2021/914, as applicable. The Processor shall not be required to implement Standard Contractual Clauses or other additional transfer safeguards where the relevant transfer is permitted under an applicable adequacy decision or another lawful transfer mechanism.

6.3. Processor shall maintain information reasonably available to it concerning Sub-processor restricted transfers and appropriate onward-transfer safeguards. Controller authorises transfers and those notified under the Sub-processor change procedure, provided a lawful transfer mechanism is in place.

7. Data Subject Rights

7.1. Processor shall promptly forward to Controller any request from a Data Subject concerning Personal Data processed on Controller’s behalf, unless legally prohibited, and shall not respond substantively except on Controller’s documented instructions or where required by law.

7.2. Taking into account the nature of the Processing, the Processor shall, insofar as reasonably possible, assist the Controller through appropriate technical and organisational measures in responding to requests from Data Subjects exercising their rights under applicable Data Protection Laws. The Controller shall remain responsible for determining the validity of such requests and for responding to Data Subjects within the applicable statutory time limits. Where the Controller requires assistance beyond the functionality ordinarily available through the Services, the Processor will charge reasonable fees reflecting the additional work involved, provided that such charges do not prevent the Processor from fulfilling its mandatory obligations under applicable Data Protection Laws.

8. Assistance, Audit and Breaches

8.1. Taking into account the nature of processing and information available to it, Processor shall provide the assistance required by Article 28(3)(f) of applicable Data Protection Laws, including assistance concerning security of processing, personal data breach notifications, data protection impact assessments and prior consultation with supervisory authorities under Articles 32–36. Controller remains responsible for deciding whether notifications or consultations are required and for their content and submission. Processor will charge reasonable, agreed rates for assistance, except to the extent such charges would prevent fulfilment of mandatory duties or the work results from Processor’s breach.

8.2. Processor shall maintain records required by applicable Data Protection Laws and information reasonably necessary to demonstrate compliance with this Addendum. Relevant compliance records may be retained for up to three (3) years after termination where lawful and necessary; this does not extend the retention period for Controller Personal Data under clause 2.4.

8.3. Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data, using the designated contact details. Processor shall provide information reasonably available at the time and supplement it as further facts are established; an initial notification need not contain information not yet known. Processor shall take reasonable containment and remediation steps within its control. Notification is not an admission of fault or liability. Controller remains responsible for assessing and making its own regulatory and data-subject notifications.

8.4. Processor shall provide reasonable cooperation and information available to it to assist Controller with breach investigation and legally required notifications. Processor is not required to disclose privileged materials, other customers’ confidential information or information that would compromise security, but shall provide an appropriate alternative summary where feasible. Reasonable costs of extraordinary assistance may be recovered where the breach was not caused by Processor’s breach, subject to advance notice where practicable.

8.5. The notification and assistance obligations in clauses 8.3 and 8.4 apply irrespective of fault. As between the parties, responsibility for remediation costs, claims and losses shall be allocated according to the Agreement, applicable law and each party’s contribution to the incident; Processor is not responsible for security failures exclusively within Controller’s systems or caused solely by Controller’s unlawful instructions, except to the extent Processor independently breached its obligations.

8.6. Government and regulatory disclosure requests. Processor shall, unless legally prohibited, notify Controller of a binding request for disclosure of Personal Data processed on Controller’s behalf and disclose only information legally required. Processor may recover reasonable costs of responding to exceptional requests to the extent permitted by law.

8.7. The Processor shall make available to the Controller such information as is necessary to demonstrate compliance with its obligations under Article 28 of the applicable Data Protection Laws and shall allow for and contribute to audits, including inspections, as required by Article 28(3)(h).

The Processor may satisfy requests for compliance information through existing documentation, written responses, independent audit reports or other appropriate evidence, where sufficient to demonstrate compliance with Article 28.

The Processor shall not be required to disclose information relating to other customers, legally privileged material, commercially sensitive information or sensitive security information where an appropriate alternative can satisfy the applicable legal requirement. The Controller shall bear the reasonable costs of additional audits or assistance, except where prohibited by law or arising from the Processor's material breach.

Any audit or inspection shall, where reasonably practicable, be subject to reasonable prior written notice, appropriate confidentiality and security safeguards, and arrangements designed to minimise disruption to the Processor's operations, insofar as consistent with applicable law.

9. Liability

9.1. The total liability of each of Controller and Processor (and their respective employees, directors, officers, affiliates, successors, and assigns), arising out of or related to this Addendum, whether in contract, tort, or other theory of liability, shall not, when taken together in the aggregate, exceed the limitation of liability set forth in our Terms and Conditions. For the avoidance of doubt, any liability arising under or in connection with this Addendum shall count towards, and shall not be additional to, the aggregate liability cap applicable in our Terms and Conditions.

November 2026