Version 1.0-draft
Draft for review. These terms are not yet offered for acceptance, and marked fields are still to be completed.
Version 1.0-draft
To complete: Legal's next consolidated revision extends the DPA scope and the Customer Applicant Data definition to expressly include client-controlled records about introduced candidates (supplement v1, sections 3 and 7)
This Data Processing Agreement (DPA) is between To complete: Customer legal name, registration number and address, as identified in the acceptance record (Customer) and Birch & James Associates Ltd, trading as deciml and TechChain Talent, registered in England and Wales (company no. 09549374), registered office: Office Gold Building 7, Floor 5, 566 Chiswick High Road, Chiswick Business Park, London W4 5YG, United Kingdom To complete: Processor registration number and registered address, filled from the privacy notice (owner decision 2026-11-03); for the reviewing solicitor to confirm (Processor).
The DPA forms part of the Client ATS Terms accepted by the Customer. It takes effect on valid acceptance and applies whenever the Processor processes Customer Applicant Data, including during export and deletion. It prevails over conflicting service terms concerning that processing. No fee is required for these obligations to apply.
Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018 and other applicable UK data-protection legislation, as amended. Customer Applicant Data means personal data processed on the Customer's behalf within the agreed ATS service, including derived applicant assessments, associated communications, files and identifiable service records. Controller, processor, personal data, processing and personal data breach have their statutory meanings.
The Customer is controller and the Processor is processor for this scope. Those labels do not override the parties' actual activities. Account administration, independently controlled recruitment services and a candidate's separately opted-in deciml profile are outside this processing scope and require their own lawful basis and transparency. Creating an ATS record does not authorise creating a deciml talent-pool record.
The subject matter, duration, nature, purposes, data subjects and data categories are set out in Annex 1. The Customer determines recruitment purposes, lawful bases, authorised users, required data, recruitment decisions and lawful retention, and provides accurate applicant notices. It shall ensure that its instructions and disclosures to the Processor comply with Applicable Data Protection Law.
The Customer shall not upload special-category or criminal-offence data unless the parties have documented the relevant conditions, purpose and safeguards and agreed to support that processing. Incidental receipt must be handled securely under documented instructions; this restriction does not remove statutory responsibilities for data actually received.
The Processor shall process Customer Applicant Data only on the Customer's documented instructions, including instructions concerning international transfers, unless domestic law requires otherwise. In that event it shall inform the Customer of the legal requirement before processing unless the law prohibits doing so on important public-interest grounds.
Initial instructions comprise this DPA, its completed annexes and the Customer's authorised service settings and commands within that scope. Additional instructions shall be documented through support@deciml.io To complete: authorised support channel, filled as support@deciml.io, the platform's support address (lib/brand.ts), on the owner's decision of 2026-11-03; for the reviewing solicitor to confirm. The Processor shall immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and suspend the affected instruction pending resolution where necessary to avoid unlawful processing.
The Processor shall not sell Customer Applicant Data, add it to its own candidate pool, use it for cross-client recruitment or marketing, or train or improve general/shared models using it. It shall not authorise suppliers to do so. Any proposed separate purpose requires a separate lawful assessment and arrangement; a general product-improvement clause is not an instruction under this DPA.
The Processor shall ensure that persons authorised to process Customer Applicant Data are bound by confidentiality obligations or appropriate statutory duties, receive relevant training and access only what is necessary for their authorised tasks.
For STANDARD workspaces, agency recruiters and agency administrators shall have no routine recruitment access to direct applicants. Any exceptional processor-side technical or security access must be necessary, appropriately authorised, limited, recorded and subject to confidentiality. This clause does not assert that such an access mechanism is already implemented.
Taking account of the state of the art, implementation costs, processing context and risks to individuals, the Processor shall implement appropriate technical and organisational measures, including the completed measures in Annex 2. It shall maintain appropriate confidentiality, integrity, availability and resilience; restore access following incidents; and regularly test and evaluate the effectiveness of its safeguards. It shall not materially reduce protection during the service.
The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Applicant Data. It shall provide available information about the nature and scope, affected data and individuals, contact point, likely consequences, and containment and remediation; provide further information in phases without undue delay; preserve relevant evidence; and assist the Customer with assessment, notification and communication duties. Notification shall not await a completed investigation.
The Customer gives general written authorisation only for the completed, approved entries in Annex 3 relevant to its enabled service. The Processor shall notify the Customer in writing at least 30 days before adding or replacing a sub-processor, identifying the entity, service, data access, locations and transfer safeguards, and allow objections on reasonable data-protection grounds. This notice period is a proposed contractual choice.
The parties shall seek an effective alternative or safeguards. If an objection cannot be resolved, the affected processing shall not commence or continue using the disputed provider for that Customer; the Customer may terminate the affected service and exercise its return/deletion rights.
Before a sub-processor receives data, the Processor shall impose by binding contract equivalent applicable data-protection obligations, in particular sufficient guarantees and appropriate security. The Processor remains fully liable to the Customer for the sub-processor's performance of those obligations. Sub-processor changes shall not expand processing purposes or authorise model training.
Taking account of the nature of processing, the Processor shall assist the Customer through appropriate technical and organisational measures, insofar as possible, to respond to individuals exercising their rights. It shall promptly forward requests relating to Customer Applicant Data to the Customer and shall not determine the substantive response unless authorised or legally required.
Taking account of the nature of processing and information available to it, the Processor shall assist the Customer with security, breach notifications and communications, DPIAs and prior consultation obligations. Assistance includes data-flow, supplier, assessment-output and deletion information reasonably required for those tasks. The parties shall cooperate with the competent supervisory authority as legally required.
The Customer's rights contact is To complete: Customer rights contact. The Processor's security and privacy contact is privacy@deciml.io To complete: Processor security and privacy contact, filled as privacy@deciml.io from the privacy notice (owner decision 2026-11-03); for the reviewing solicitor to confirm. Operational handling must leave the Customer sufficient time to meet applicable statutory deadlines.
The Processor shall not make a restricted international transfer except on documented instructions and in compliance with Applicable Data Protection Law. Annex 3 shall identify relevant locations, remote access and the applicable transfer mechanism. Where required, binding transfer terms, assessments and supplementary measures must be completed before the transfer. This DPA is not itself an international transfer mechanism.
The Customer instructs applicant-specific inactivity deletion using its configured period: 180 days by default, configurable up to two years from qualifying last activity. The Processor shall give the Customer a warning 14 days before scheduled retention deletion. Qualifying activity must be a genuine, recorded recruitment interaction concerning that applicant, not a background job, AI regeneration, routine page view or administrative attempt to retain records indefinitely. The precise qualifying event set must be documented and reflected accurately in the product before this instruction is activated.
The two-year figure caps the configurable inactivity interval, not necessarily total record age. Genuine renewed recruitment activity can restart that interval. The Customer must periodically assess necessity and must not preserve records indefinitely through artificial resets. Any absolute long-stop is to be agreed separately; none is represented as already built.
On termination, the Processor shall stop new applicant intake and ordinary recruitment processing and provide the Customer a 30-day export window, solely for restricted export and necessary administration. The Customer may elect return/export or earlier deletion. At the end of the window the Processor shall delete remaining Customer Applicant Data and copies, whether or not export was requested, unless domestic law requires storage. An export shall include the available applicant data, files and assessments reasonably needed for a usable return, in To complete: verified export format and delivery method.
For this draft, the termination export window pauses scheduled inactivity deletion for data present at termination, solely to preserve the promised export opportunity. This is a proposed instruction requiring implementation confirmation, not a statement of current behaviour. A legally required earlier erasure or a lawful Customer instruction to delete earlier takes precedence. No warning or export period authorises unlawful retention.
Deletion shall cover storage objects identified by workspace prefix, corresponding database records, assessments, indexes, caches, exports, identifiable logs where applicable and sub-processor copies. Deleting an object-storage prefix alone is not performance of this clause. Shared infrastructure must be handled without deleting other customers' data.
Before acceptance, Annex 2 shall state any backup isolation, restoration re-deletion procedure and maximum backup-erasure period. No undefined backup exception applies. Any legally required retained data shall be segregated, protected, used only for that legal requirement and erased when it ends. The Processor shall document completion and provide confirmation on request. The DPA continues to apply until deletion is complete.
The Processor shall make available all information necessary to demonstrate compliance with its applicable Article 28 obligations and allow and contribute to audits, including inspections, by the Customer or its mandated auditor.
The parties may use documentation and independent assurance first and agree reasonable scope, confidentiality and notice to protect other customers and security. These arrangements shall not prevent an effective audit, urgent investigation, inspection required by a regulator or investigation of suspected non-compliance. No absolute annual limit, supplier certificate or disproportionate charge shall remove these rights.
Only enabled, documented AI functions listed in Annex 1 are authorised. Prompts, input extracts, derived strengths/gaps, checklists and summaries remain Customer Applicant Data where identifiable. The Processor shall restrict transmission to necessary data and approved providers and shall support correction, rights handling and deletion of inputs and outputs.
The Customer shall ensure trained reviewers meaningfully evaluate relevant applicant information and AI outputs and have authority to change recruitment outcomes. This DPA does not authorise solely automated rejection, undisclosed ranking or a new automated decision workflow. Such changes require documented assessment, safeguards, revised transparency and instructions before activation. The absence of a visible 0–100 score is not assurance that processing is not profiling or automated decision-making.
Acceptance may be by an authorised electronic acceptance of the Client ATS Terms incorporating this DPA, or by signature. The acceptance record shall identify the Customer and applicable document versions. Continued use alone shall not be used to manufacture historic acceptance.
Proposed contractual choice: this DPA is governed by the law of England and Wales and its courts have jurisdiction, without restricting applicable statutory rights or regulatory jurisdiction. The reviewing solicitor must confirm this choice and consistency with the Client ATS Terms before use. It does not displace mandatory laws applicable to overseas processing.
To complete: governing-law confirmation by the reviewing solicitor; the owner chose the law of England and Wales on 2026-11-03, matching the privacy notice's company details
For signed acceptance: Customer name [ ]; authorised signatory [ ]; capacity [ ]; signature [ ]; date [ ]. Processor authorised signatory [ ]; capacity [ ]; signature [ ]; date [ ].