Data processing agreement

This agreement is between the customer using SkillChecker to assess candidates, and the operator of SkillChecker named below.

TODO(RYAN): COMPANY_LEGAL_NAME + REGISTERED_ADDRESS

For participant data — the skills and experience entered, the questions generated, the answers written, the scores, the report and the integrity signals — the customer is the controller and SkillChecker is the processor. The customer decides that an assessment happens, who takes it, and what the result is used for.

For our own account, billing, security and service-log data, SkillChecker is an independent controller and this agreement does not apply. That split is set out in our privacy policy.

SkillChecker will:

1. Process participant data only on the customer’s documented instructions, including as to international transfers, unless required otherwise by law — in which case we will tell the customer before processing, unless the law forbids us from doing so.
2. Ensure that anyone authorised to process participant data is bound by a duty of confidentiality.
3. Implement and maintain the technical and organisational measures set out in Annex 2, appropriate to the risk.
4. Engage sub-processors only under the conditions below, imposing equivalent data protection obligations on each, and remaining liable for their performance.
5. Assist the customer, by appropriate technical and organisational measures, in responding to requests from participants exercising their rights. Where a participant contacts us directly, we will route the request to the customer as controller, and will not respond substantively on the customer’s behalf without instruction.
6. Assist the customer with security, breach notification and data protection impact assessments, taking into account the nature of the processing and the information available to us. We will notify the customer without undue delay after becoming aware of a personal data breach affecting participant data.
7. Delete participant data on the published retention schedule, on the customer’s instruction, or at the end of the agreement, at the customer’s choice — subject to the backup and log limitations stated in our privacy policy, which are described honestly there rather than disclaimed here.
8. Make available the information reasonably necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections, conducted by the customer or an auditor it mandates.

The customer gives general authorisation for the sub-processors listed on our sub-processor page, which is incorporated into this agreement by reference.

See the current sub-processor list

We will publish material changes to that list, and the customer may object on reasonable data protection grounds. Where an objection cannot be resolved, the customer may terminate the affected part of the service.

The measures below are in place today. They are listed because they are true, not because they are standard.

• Row-level security in the database restricts every assessment, response and report to the recruiter account that owns it. Isolation is enforced by the database, not only by the application.
• Row-level security denies the anonymous API role every read of participant records — it holds no policy on any participant table, so a request carrying only the public key returns nothing. Participant access runs through server-side code holding a separate, privileged credential that is never exposed to the browser.
• Participants reach an assessment through an unguessable random token rather than an account, and that token grants access to that assessment only.
• All traffic is served over TLS.
• Data is encrypted at rest by our hosting and database providers.
• Audit records are kept for events that matter to a participant: when the pre-assessment notice was shown and which version, when a recruiter first opened the full evidence behind a score, every run of the deletion job, and every rights request with its deadline.
• Deletion is automated and scheduled rather than manual, and each run is recorded, so the retention policy can be shown to have executed rather than asserted.
• No video, audio, image or biometric processing occurs at any point, and no emotion, personality or mental state inference is performed.
• Participant names and email addresses are never sent to the AI model as separate fields. The model receives the role, the skills being assessed, and the text of the answers.

This list is not a certification. It describes what the system does today, and it will be updated when that changes.

To execute this agreement, or to raise a question about it, contact us.

TODO(RYAN): PRIVACY_CONTACT_EMAIL — no contact address exists yet. Execution runs through the existing customer relationship until one does.