Data Processing Agreement
Last updated: 5 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and Career Catalyst & Recruitment Ltd, trading as The Career Catalyst, a company registered in England and Wales (number 16689261), registered office 82a James Carter Road, Mildenhall, Suffolk, England, IP28 7DE (“Processor”). It sets out the terms required by Article 28 of the UK GDPR for the personal data the Controller uploads to Career Catalyst Screener.
1. Details of the processing
- Subject matter and purpose: screening, scoring and shortlisting job applications, producing reports and sending recruitment emails on the Controller's instructions.
- Duration: while the Controller uses the Service, and until the data is deleted as set out in section 8.
- Data subjects: job applicants and candidates; referees named in application documents; the Controller's staff who use the Service.
- Types of personal data: names, contact details, employment history, education, qualifications, skills, professional registrations and any other information applicants include in their documents; scores, statuses and notes added in the Service.
- Special category data: not required by the Service. The Controller will not upload it without a lawful condition under Article 9 UK GDPR.
2. Processing on instructions
The Processor will process the personal data only on the Controller's documented instructions, which are these terms and the Controller's use of the Service's features, unless UK law requires otherwise (in which case the Processor will tell the Controller first unless the law prohibits it). The Processor will tell the Controller if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone authorised by the Processor to process the personal data is bound by confidentiality and only accesses it where needed to provide or support the Service.
4. Security
The Processor implements appropriate technical and organisational measures under Article 32 UK GDPR, including those described on the Security page: encryption in transit and at rest, private file storage, access controls that keep each customer's data separate, and secure management of credentials.
5. Sub-processors
The Controller gives general authorisation for the Processor to use the sub-processors below. The Processor has written contracts with each that impose data protection obligations equivalent to this DPA, and remains responsible for their performance. The Processor will give at least 30 days' notice of a new sub-processor by updating this page and notifying account holders; the Controller may object on reasonable data protection grounds and, if we can't resolve it, cancel the affected Service.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database and private file storage | All Service data, including uploaded CVs and application forms | European Union (Frankfurt, Germany) |
| Netlify | Website and application hosting | Data passing through the application while it is used; technical logs | United States, with global edge locations |
| Clerk | Sign-in and account security | Account holders’ names, email addresses and sign-in sessions | United States |
| Paddle | Payments, invoicing and sales tax (merchant of record) | Account holders’ billing details only; no candidate data | United Kingdom |
| Resend | Sending emails you ask the Service to send (reports, candidate emails) | Recipient email addresses and email content | United States |
6. International transfers
Where personal data is transferred outside the UK, the Processor ensures it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified providers) or by the International Data Transfer Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed.
7. Helping the Controller
- Data subject requests: the Service lets the Controller find applicants, delete them (including their uploaded documents) and download reports. The Processor will help with corrections and full data exports on request, and will pass on any request it receives directly from an applicant.
- Breaches: the Processor will notify the Controller without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own 72-hour reporting duty.
- Impact assessments: the Processor will provide reasonable information to help the Controller carry out data protection impact assessments and consult the ICO where required.
8. Deletion and return
The Controller can delete jobs, candidates and documents at any time. When the Controller's account closes, the Processor deletes the Controller's personal data within 30 days, and from rolling backups within a further 30 days, unless UK law requires it to be kept. On request before closure, the Processor will provide a copy of the Controller's data.
9. Audits and information
The Processor will make available the information reasonably needed to show compliance with this DPA, and allow for audits by the Controller or an independent auditor it appoints, on reasonable notice, at most once a year (unless required by a regulator or following a breach), and subject to confidentiality.
10. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms of Service, except where UK data protection law does not allow liability to be limited. If this DPA conflicts with the Terms, this DPA takes precedence for the processing of personal data.
Need a signed copy for your records, or have a question? Contact us through privacy@careercatalystscreener.com.