This Data Processing Agreement (“DPA”) satisfies Article 28 of the UK GDPR where DennisNowland Ltd acts as Processor for a Controller using ATS Engine.

PARTIES

THE CONTROLLER: the organisation named on the ATS Engine account through which this DPA is accepted, accepting through an account holder who confirms on acceptance that they have authority to bind that organisation (the “Controller”);

and

DENNISNOWLAND LTD, incorporated in Scotland under company number SC885995, registered office 145 Glamis Road, Kirkcaldy, Fife, KY2 6LP (the “Processor”), supplier of the recruitment software known as ATS Engine.

Each a “Party” and together the “Parties”.

BACKGROUND

A. The Processor supplies ATS Engine, a hosted applicant tracking and recruitment system, under a separate subscription agreement (the “Principal Agreement”).

B. In providing the Services, including any agreed migration of existing records, the Processor processes personal data on the Controller’s behalf.

C. This DPA forms part of the Principal Agreement and sets out the terms governing that processing.

1. Definitions

“Data Protection Legislation” means the UK GDPR, the Data Protection Act 2018, PECR 2003 and other UK laws relating to personal data, as amended or replaced.

“Protected Data” means the personal data described in Annex 1 processed by the Processor on behalf of the Controller.

“Sub-processor” means a third party engaged by the Processor to process Protected Data.

“Security Incident” means a breach of security causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Protected Data.

Other terms including controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the UK GDPR.

2. Status and Responsibilities

2.1 The Controller is the controller and the Processor is the processor of Protected Data.

2.2 The Controller determines the purposes and means of processing, establishes lawful bases, provides required privacy information and ensures it may lawfully transfer Protected Data to the Processor.

2.3 Nothing in this DPA relieves either Party of its own legal obligations.

2.4 The Controller remains responsible for recruitment decisions and for the lawfulness, accuracy and appropriateness of its instructions and data.

3. Processing on Documented Instructions

3.1 The Processor shall process Protected Data only on documented instructions from the Controller, including instructions concerning transfers outside the UK, unless applicable law requires otherwise.

3.2 The Controller’s ordinary use of ATS Engine, including uploading, editing, searching, scoring, matching, document generation, exporting and deleting records, constitutes an instruction for those purposes.

3.3 Where law requires processing contrary to an instruction, the Processor shall inform the Controller before processing unless prohibited by law.

3.4 The Processor shall inform the Controller if it reasonably considers an instruction to infringe Data Protection Legislation.

3.5 The Processor shall not sell Protected Data, use it for its own independent purposes, or make it available to another ATS Engine customer.

3.6 The Processor shall not use Protected Data to train, fine-tune or improve any AI or machine-learning model operated by the Processor or by a Sub-processor. Equivalent restrictions shall be imposed on Sub-processors.

3.7 Protected Data shall not be used to identify candidates for another customer, to create a shared candidate pool, or to combine customer datasets for recruitment purposes.

4. Personnel and Confidentiality

4.1 Persons authorised to process Protected Data shall be subject to an appropriate duty of confidentiality.

4.2 Access shall be limited to personnel who need it to provide, secure or operate the Services, comply with law, or perform the Principal Agreement.

4.3 The Processor shall ensure authorised personnel understand their confidentiality and data-protection obligations.

5. Security

5.1 Taking account of the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to data subjects, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

5.2 Annex 2 describes the measures in place at the effective date. The Processor may update them provided the overall level of protection is not materially reduced.

5.3 The Processor shall maintain measures designed to protect Protected Data against destruction, loss, alteration, unauthorised disclosure and unauthorised access.

6. Sub-processors

6.1 The Controller gives general written authorisation for the Sub-processors listed in Annex 3.

6.2 The Processor shall give at least thirty (30) days’ written notice before adding or replacing a Sub-processor. The Controller may object on reasonable data-protection grounds. If the objection is not resolved, the Controller may terminate the affected Services or the Principal Agreement without penalty, subject to the Principal Agreement.

6.3 The Processor shall impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA.

6.4 The Processor remains fully liable to the Controller for the performance of each Sub-processor’s obligations.

7. Data Subject Rights and Assistance

7.1 The Processor shall, taking account of the nature of processing, assist the Controller with Chapter III data-subject rights.

7.2 The Controller may at any time export from ATS Engine, without charge and without needing to contact the Processor, a complete copy of the records held in its account, comprising every record as a data file together with the original uploaded documents.

7.3 If the Processor receives a data-subject request relating to Protected Data, it shall not respond substantively except on instruction or where required by law, and shall notify the Controller without undue delay.

7.4 The Processor shall provide reasonable assistance concerning Articles 32 to 36 of the UK GDPR, taking account of the nature of processing and the information available to it.

8. Personal Data Breaches

8.1 The Processor shall notify the Controller without undue delay and, in any event, within forty-eight (48) hours after becoming aware of a personal data breach affecting Protected Data.

8.2 Notification shall include, so far as reasonably available, the nature of the breach, affected categories and approximate numbers, likely consequences and measures taken or proposed. Information may be supplied in phases.

8.3 The Processor shall reasonably cooperate with investigation, containment, remediation and documentation.

8.4 The Processor shall not notify a regulator or data subject unless instructed by the Controller or required by law.

9. International Transfers

9.1 Protected Data shall not be transferred outside the UK except as described in Annex 3 or on documented Controller instructions, and only where a lawful transfer mechanism applies.

9.2 For restricted transfers, the Processor shall ensure an appropriate mechanism under Data Protection Legislation is in place.

9.3 On reasonable request, the Processor shall provide information about the transfer mechanism, subject to confidentiality, security and third-party restrictions.

9.4 Where a Sub-processor provides its own recognised transfer mechanism for UK data, the Processor shall rely on it where applicable and maintain relevant documentation.

10. Information and Audit

10.1 The Processor shall make available information reasonably necessary to demonstrate compliance with Article 28.

10.2 The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Such audits shall take place on not less than thirty (30) days’ written notice, during normal business hours, not more than once in any twelve-month period except following a Security Incident or at the direction of a supervisory authority, and shall be conducted so as to cause the least practicable disruption.

10.3 Audits shall be subject to reasonable confidentiality and security controls.

10.4 Auditors shall not be competitors of the Processor. The Processor may withhold other customers’ information, credentials, secrets and information the disclosure of which would create an unreasonable security risk.

10.5 Where the Controller agrees, the Processor may satisfy an assurance request through security documentation, independent reports or summaries in place of an on-site inspection. This clause does not limit the Controller’s rights under Clause 10.2.

11. Return, Export and Deletion

11.1 On termination or expiry, the Processor shall, at the Controller’s election, delete or return Protected Data unless law requires retention.

11.2 The Controller shall make that election in writing within thirty (30) days of termination or expiry. During that period the Processor shall retain the Protected Data and shall make the export described in Clause 7.2 available to the Controller. If no election is made within that period, the Processor shall delete the Protected Data, subject to any legal retention requirement.

11.3 Protected Data held in the Processor’s routine backups shall be deleted in the ordinary cycle of those backups, during which it shall not be actively processed for any purpose other than restoration of the service or compliance with law.

11.4 The Processor shall provide written confirmation of deletion on reasonable request.

11.5 Protected Data shall not be retained longer than necessary for the Services, this DPA or legal retention.

12. Migration of Existing Records

12.1 Migration exports supplied by the Controller shall be processed solely to perform the agreed migration.

12.2 Supplied export files and working copies shall be deleted within ninety (90) days after migration completion and acceptance, unless a shorter period is agreed or law requires retention.

12.3 The Processor shall not contact data subjects as a result of migration. Communications occur only on Controller instruction.

12.4 The Controller confirms it is entitled to disclose migrated records and has met its applicable transparency obligations.

13. Liability

13.1 Liability under this DPA is subject to the liability provisions of the Principal Agreement, except where applicable law prevents limitation or exclusion.

13.2 Nothing limits liability or rights that cannot lawfully be limited or excluded.

13.3 The Parties intend the Principal Agreement and this DPA to operate consistently with Data Protection Legislation.

14. Term

14.1 This DPA takes effect on the date of last signature and continues while the Processor processes Protected Data.

14.2 Confidentiality, audit, return and deletion, liability and provisions intended by their nature to survive shall survive termination.

15. General

15.1 This DPA prevails over the Principal Agreement on data protection or processing of Protected Data to the extent of any conflict.

15.2 Invalid provisions do not affect the remainder.

15.3 Variations must be in writing and agreed by both Parties.

15.4 Non-Party enforcement rights are excluded except where expressly required by law.

15.5 This DPA is governed by Scottish law and subject to the exclusive jurisdiction of the Scottish courts, subject to mandatory rights or jurisdiction under applicable Data Protection Legislation.

ACCEPTANCE

16.1 This DPA is accepted electronically within ATS Engine. It is accepted once, by the Controller’s account owner, and binds the Controller’s whole organisation; individuals subsequently invited to that organisation are not separately asked and are not parties to it.

16.2 On acceptance the Processor records the version of this DPA, a SHA-256 hash of its exact text as displayed at that moment, the date and time, the ATS Engine account that accepted it, and the network address and browser from which it was accepted. That record is the Parties’ evidence of what was agreed and when, and a copy of it is available to the Controller on request.

16.3 The Processor accepts this DPA by supplying the Services to the Controller.

16.4 The Controller may instead request a countersigned paper copy, which the Processor shall provide on request.

ANNEX 1 — DETAILS OF PROCESSING

Subject matter

Provision of ATS Engine and any agreed migration of the Controller’s recruitment records.

Duration

For the term of the Principal Agreement and thereafter only for return or deletion and applicable legal retention.

Nature and purpose

Storing, organising, searching, retrieving, analysing, scoring, matching, generating documents from, communicating by reference to, exporting and deleting recruitment records for the Controller’s recruitment activities.

This includes automated analysis of curricula vitae and job descriptions by an authorised AI Sub-processor to extract skills and experience, assess fit and generate draft documents.

Scores, rankings and analyses are presented as information to authorised users. ATS Engine does not itself make decisions producing legal or similarly significant effects on data subjects.

Categories of data subjects

Category

Description

Candidates

Individuals whose details are held by the Controller as applicants for, or potential applicants for, a role.

Referees

Individuals nominated by a candidate to provide a reference.

Client contacts

Individuals at the Controller’s client companies whose contact details are held to submit candidates and manage vacancies.

The Controller’s own users

The Controller’s employees and contractors who hold an account on the Controller’s ATS Engine organisation.

Categories of personal data

Category

Examples

Identity and contact

Name, email address, telephone number, postal address or location.

Employment history

Curriculum vitae and its contents, current and previous job titles, employers and dates.

Education and qualifications

Institutions, dates, awards, certificates and professional registrations.

Recruitment record

Applications, pipeline status, interview notes and packs, match and fit scores, assessments, tasks and client submissions.

Correspondence

Messages and emails exchanged through the system, and their attachments.

Right-to-work and screening

Where the Controller chooses to record them: right-to-work document details and expiry dates, visa details, DBS status and recheck dates, and other screening records the Controller configures.

Account data

For the Controller’s own users: name, email address, role, permissions and audit records of actions taken.

Special category and criminal-offence data

ATS Engine is not intended to encourage unnecessary processing of special category or criminal-offence data. Recruitment documents may nevertheless contain such information. The Controller is responsible for identifying the applicable lawful basis and, where required, the applicable Data Protection Act 2018 condition. Where such data is present, it is Protected Data and is processed only under the Controller’s instructions.

ANNEX 2 — TECHNICAL AND ORGANISATIONAL MEASURES

Customer data separation

Each customer’s records are held against that customer’s own organisation identifier, and every database query for a customer-owned record is filtered by that identifier automatically at the framework level rather than by each individual query. A query cannot omit the filter.

The same filter is applied by default to every request reaching the application, and to background jobs, rather than being applied route by route.

Customers cannot access another customer’s candidates, vacancies, documents or correspondence.

Access control

Access to the system requires an individual named account and password. Accounts are not shared.

Passwords are stored using salted one-way hashing.

Role-based access controls restrict the actions each account may perform, and are enforced on every request rather than only in the user interface.

The Controller’s administrators assign roles and permissions within the Controller’s own organisation.

Application activity is recorded in audit records.

Administrative server access is restricted to authorised personnel using key-based SSH authentication.

Transmission and storage

Application access uses HTTPS/TLS; HTTP requests are redirected.

The application runs on a dedicated virtual private server behind firewall controls.

Uploaded documents are held outside the public web root and are served only through application controls.

Message content is encrypted at the application layer.

Database backups are taken and can be restored.

Software and platform

Maintained operating-system and language-runtime releases, with security updates applied.

Private source repositories, with read-only deployment credentials on production.

Secrets and keys are stored in server-side environment configuration, outside source repositories.

Organisational measures

Personnel with access are bound by confidentiality obligations.

Sub-processors are engaged under written data-protection terms.

Measures not currently in place

As at the effective date, ATS Engine does not claim ISO 27001, SOC 2 or Cyber Essentials certification and does not currently commission independent penetration testing. Single sign-on and multi-factor authentication are not currently offered as standard ATS Engine capabilities.

These statements are provided for transparency and do not reduce the technical and organisational measures described above. The Processor will notify Controllers of material changes to these measures, or of the introduction of relevant certifications or capabilities.

ANNEX 3 — AUTHORISED SUB-PROCESSORS

OpenAI — data minimisation and AI restriction

ATS Engine sends only the specific content required for the requested analysis, at the time of that analysis. It does not provide the Controller’s candidate database in order to perform an individual analysis.

Protected Data is processed under the applicable OpenAI Data Processing Addendum. Under those terms the data submitted is not used to train or improve that supplier’s models. Data submitted through its interface for developers is retained by that supplier for a limited period for the purpose of detecting misuse, and is then deleted.

For UK Protected Data transferred to the United States, the Processor relies on the transfer mechanism in the OpenAI Data Processing Addendum, including the EU Standard Contractual Clauses as amended by the UK International Data Transfer Addendum where applicable.

PayPal — scope

PayPal receives the billing and contact information required to collect the Controller’s subscription payments. ATS Engine does not send candidate, referee or client-contact data to PayPal.

Changes

Additions to, or replacements of, the Sub-processors above are notified in accordance with Clause 6.2.