Data Processing Addendum

Effective date: August 16, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Candidates Assessment (“Processor”, “we”) and the organization using the platform (“Customer”, “Controller”), and applies to the extent Candidates Assessment processes personal data on the Customer’s behalf, including data relating to the Customer’s candidates. This is our standard DPA template; contact us at contact@candidatesassessment.com to execute a signed copy.

1. Definitions

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, and “Sub-processor” have the meanings given in applicable data protection law, including the EU General Data Protection Regulation (GDPR) and UK GDPR where applicable.

2. Subject matter and duration

Candidates Assessment processes Personal Data on behalf of the Customer for the duration of the Customer’s use of the platform, as described in the Terms of Service.

3. Nature and purpose of processing

Personal Data is processed to provide, operate, and support the candidate assessment platform, including creating assessments, inviting candidates, scoring responses, and generating reports for the Customer.

4. Categories of data subjects

Job candidates invited to complete an assessment by the Customer, and authorized users of the Customer’s account.

5. Types of personal data

• Name, email address, and other contact details.
• Assessment responses, scores, and reports.
• Account and usage information.

6. Processor obligations

• Process Personal Data only on documented instructions from the Customer, unless required otherwise by law.
• Ensure personnel with access to Personal Data are subject to confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Assist the Customer in responding to data subject requests and in meeting its own data protection obligations, where reasonably required.
• Notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data.
• Delete or return Personal Data at the end of the engagement, unless retention is required by law.

7. Sub-processors

Candidates Assessment uses service providers to help operate the platform, such as hosting and email delivery infrastructure. We remain responsible for sub-processors’ compliance with the obligations in this DPA. Contact us for a current list of sub-processors.

8. International transfers

Where Personal Data is transferred outside the country in which it was collected, Candidates Assessment will rely on an appropriate transfer mechanism, such as Standard Contractual Clauses, where required by applicable law. As an early-stage company, our transfer arrangements are still being formalized; contact us before transferring sensitive candidate data internationally.

9. Governing law

This DPA is governed by the same governing law as the Terms of Service, to be finalized once Candidates Assessment completes incorporation.

10. Contact

Questions about this DPA, or requests for a signed copy, can be sent to contact@candidatesassessment.com.