Data Processing Agreement

This agreement is between Syphtr Ltd ("Syphtr", "we") and the organisation that holds a Syphtr account ("you"). It applies whenever you upload, import or otherwise put personal data about your candidates, applicants or contacts into Syphtr. For that data you are the controller and we are your processor, as those terms are used in the UK GDPR and the Data Protection Act 2018. It forms part of your agreement with Syphtr and takes effect when you first use the service. If you would like a countersigned copy, email paul@syphtr.com.

It does not cover our own searchable index of public professional profiles, for which Syphtr is the controller — that is described in our Privacy Policy.

Subject matter and purpose: storing, reading, searching, matching and scoring candidate information so that your team can find, assess and contact people for roles — the Syphtr service, and nothing else.

Duration: for as long as your organisation has a Syphtr account, then deletion as set out in section 7.

Types of personal data: what your CVs, applications, imports and notes contain — typically names, contact details, work history, education, skills, the CV documents themselves, application answers, and your team's notes and pipeline activity. The service is not designed for special category data (health, ethnicity, religion and the like); please don't add it.

People the data is about: your candidates and applicants, your clients' contacts, and the members of your team who use Syphtr.

• We process your data only to provide the service and on your documented instructions — which your use of the service and your settings are — and we tell you if we believe an instruction breaks data protection law.
• Everyone who can access your data is bound by confidentiality.
• We keep it secure with the measures in section 6.
• We use only the sub-processors in section 5, each under a written contract with data protection terms no less protective than these.
• We help you respond to requests from the people your data is about — access, correction, deletion, objection — and your admins can search, correct and remove candidates themselves.
• We help you meet your own obligations on security, breach notification and data protection impact assessments, as far as the information we hold allows.
• At the end, we delete your data as set out in section 7.
• We give you the information you reasonably need to show you are meeting your obligations, and allow reasonable audits: on at least 30 days' notice, no more than once a year unless a regulator requires it or there has been a breach.

If we become aware of a breach affecting your data we will tell you without undue delay, and in any case within 48 hours, with what we know: what happened, the data and people likely affected, the likely consequences, and what we are doing about it. We will keep you updated as we learn more, so that you can meet your own 72-hour duty to the ICO where it applies.

You authorise us to use the following providers. Before we add or replace one, we will update this list and email your organisation's admins at least 14 days in advance; if you object on reasonable data protection grounds and we cannot resolve it, you may end your subscription and have your data deleted.

Where personal data is processed outside the UK, we rely on the safeguards UK law provides for that transfer: the UK–US data bridge for certified US providers, or the ICO's International Data Transfer Addendum to the provider's standard contractual clauses. OpenAI does not use data sent through its API to train its models.

• All traffic to and from Syphtr, and between Syphtr and its providers, is encrypted in transit (TLS). The database and file storage are encrypted at rest by their providers.
• Every organisation's data is kept separate: each request is tied to the signed-in user's organisation, and one organisation cannot read another's candidates.
• Access is by individual accounts with roles; an organisation's admins decide who is in the team and what they can do.
• Credentials for connected systems, such as your applicant tracking system, are stored encrypted.
• Access to production systems is limited to the people who run the service.
• The database is backed up with point-in-time recovery, so data can be restored after an incident.
• Errors are monitored so that problems are seen and fixed quickly.

Your admins can remove individual candidates at any time, and can delete your whole organisation — every candidate, CV, file and record in it — from the Organisation page. That deletion starts immediately, cancels your subscription and removes your data from the live service; copies in our backups expire within 30 days. If you would like a copy of your data first, ask us before deleting and we will provide an export. We keep a record that a deletion happened and when, without any of the data itself, so that we can confirm it to you.

Each party's liability under this agreement is subject to the limits in your agreement with Syphtr. If this agreement and that agreement conflict on data protection, this one wins. It is governed by the laws of England and Wales.

Questions, requests and notices: paul@syphtr.com.