Legal
Data processing agreement
The processor terms that apply to every account, without having to ask for them.
This agreement applies automatically when you use SharpAssessment to assess candidates. A countersigned copy for your own records is available by emailing [email protected], and asking for one is normal rather than a nuisance.
1. Roles
You are the controller of candidate personal data: you decide who is assessed and why. We are the processor and act only on your instructions. Using the service in the ordinary way is a documented instruction to process candidate data for the purpose of running assessments and reporting the results to you.
2. What is processed
| Subject matter | Running skills assessments on candidates you invite, and reporting the results to you |
|---|---|
| Duration | For as long as you have an account, plus the retention period in section 7 |
| Nature and purpose | Collection, storage, scoring, reporting, export and deletion of assessment data |
| Categories of data subject | Candidates you invite, and the users in your own team |
| Types of personal data | Name, email address, assessment answers, scores, timestamps, and anything else you choose to put into a candidate record |
| Special category data | Not requested and not required. If you choose to record it, for example an accommodation need, you are responsible for the additional conditions that apply to it |
3. Our obligations
- Process candidate data only on your instructions, and tell you if an instruction appears to breach data protection law.
- Keep it confidential, and bind everyone with access to confidentiality.
- Apply the technical and organisational measures described on the security page, which is part of this agreement.
- Not sell candidate data, not share it between customers, not use it for advertising, and not use it to train AI models.
- Help you respond to candidate requests for access, correction, deletion, restriction, objection and portability.
- Help you with data protection impact assessments and with consultations with a supervisory authority, to the extent the information is ours to give.
4. Sub-processors
You give general authorisation for the sub-processors listed on the sub-processors page. Before a new one starts handling candidate data, customers are notified at least 30 days in advance. If you object on reasonable data protection grounds, tell us within those 30 days: we will look for an alternative, and if there is none, you may terminate and receive a refund for unused credits. Every sub-processor is bound by terms no weaker than these, and we stay liable to you for what they do.
5. Location and transfers
Candidate data is stored on infrastructure in Germany (EU). Where a sub-processor involves a transfer of personal data outside the EEA or the UK, that transfer relies on the European Commission's standard contractual clauses together with the UK addendum, and the sub-processors page says which services this applies to.
6. Personal data breaches
If we become aware of a breach affecting your candidate data, we notify you without undue delay and in any case within 48 hours of becoming aware. The first notice contains what is known at that point rather than waiting for a complete picture, and is updated as the investigation progresses. It will include what happened, the categories and approximate number of people affected, the likely consequences, and what is being done.
7. Retention, return and deletion
- Candidate results are deleted 12 months after completion by default.
- You can delete any candidate's data at any time, and deletion is immediate in the live system.
- On account closure, you have 30 days to export, after which candidate data is deleted.
- Copies inside backups age out on the backup cycle and are gone within 90 days.
- We keep data past these points only where the law requires it, and only for as long as it requires.
8. Audit
On request we will give you the information needed to demonstrate compliance with this agreement. There is no SOC 2 or ISO report to send instead, which the security page states plainly. An on-site or remote audit can be arranged once in any twelve months with reasonable notice, or more often if a supervisory authority requires it.
9. Your obligations
- Have a lawful basis for assessing each candidate, and tell candidates what is happening. The candidate page exists to make that easy.
- Do not upload personal data you have no right to process, and do not use the service for automated decisions that produce legal or similarly significant effects without human involvement.
- Keep your own account access under control, and remove users who leave.
10. Precedence and changes
Where this agreement conflicts with the terms of service, this agreement wins for anything concerning candidate personal data. Material changes are emailed to account holders at least 30 days before they take effect.
11. Contact
Data protection questions, requests and signed copies:[email protected].