Data Processing Agreement

Important - please read before registering This Data Processing Agreement (DPA) governs the responsibilities of employers who access candidate personal data through the Restart Talent platform. By registering as an employer and unlocking candidate profiles or receiving candidate documents, you agree to be bound by this DPA. This agreement protects candidates whose data you access and sets out your legal obligations as a Data Controller of that data.

1. The Parties

This Data Processing Agreement is entered into between:

Both Restart Talent and the Employer act as independent Data Controllers in respect of candidate personal data accessed through the Platform. This agreement sets out the obligations of each party and the protections in place for candidates whose data is shared.

2. Definitions

In this DPA, the following definitions apply:

3. Context and Purpose of This Agreement

3.1 How candidate data flows through the Platform

The Restart Talent Platform operates a tiered data-sharing model:

• All verified employers can view candidate profiles including name and professional information (skills, work history, education, references, CV, portfolio projects) - candidates create profiles specifically to be found.
• An employer who spends one credit to unlock a candidate profile gains access to that candidate's contact details (email, phone, LinkedIn URL), photographs, and introduction video.
• Supporting documents (identity documents, DBS certificate, proof of address, qualifications etc.) are locked at all times and are only accessible when the candidate individually and explicitly chooses to release a specific document to a specific employer.

3.2 Data Controller status

From the point at which an Employer unlocks a candidate profile or receives candidate documents, the Employer becomes an independent Data Controller of that candidate's data. This means:

• The Employer independently determines the purposes for which they use the candidate's data (e.g. contacting the candidate, conducting interviews, making a hiring decision);
• The Employer is independently responsible for complying with UK GDPR and DPA 2018 in relation to that data;
• Restart Talent is not responsible for how the Employer uses, stores, or shares candidate data once it has been disclosed via the Platform's unlock mechanism.

Both parties are independent Data Controllers This is not a controller-to-processor agreement. Both Restart Talent and the Employer act as independent Data Controllers. Restart Talent controls the data on the Platform and determines how it is collected, stored, and made available. The Employer independently controls the data they receive through unlocks and document releases, and is solely responsible for their own use of that data.

4. Employer Obligations as Data Controller

By registering as an employer and accessing candidate data through the Platform, you agree to the following obligations:

4.1 Lawful basis for processing

You must have a valid lawful basis under UK GDPR Article 6 for every purpose for which you process candidate data. Appropriate lawful bases for recruitment-related processing include:

• Legitimate interests (Article 6(1)(f)) - assessing a candidate's suitability for a role, contacting a candidate to arrange an interview, or making a hiring decision;
• Pre-contractual necessity (Article 6(1)(b)) - processing necessary to take steps at the request of the data subject prior to entering into an employment contract;
• Legal obligation (Article 6(1)(c)) - where applicable law requires you to verify right-to-work or conduct DBS checks.

4.2 Purpose limitation

You must only use candidate data for the purpose of assessing the candidate's suitability for employment or engagement and, where applicable, proceeding with a hiring process. You must not:

• Use candidate data for any purpose unrelated to the recruitment process;
• Use candidate data to contact the candidate for marketing, sales, or any non-recruitment purpose;
• Share candidate data with any third party other than those directly involved in your internal recruitment process (e.g. your own HR team or hiring managers);
• Sell, rent, or transfer candidate data to any other organisation.

4.3 Data minimisation

You must only process the candidate data that is necessary for your recruitment purposes. You should not request or encourage candidates to unlock documents that are not reasonably necessary for the role in question.

4.4 Accuracy

You must take reasonable steps to ensure that the candidate data you hold is accurate. If a candidate informs you of a change or correction to their data, you must update your records promptly.

4.5 Storage limitation and data retention

You must not retain candidate data for longer than is necessary for the purpose for which it was collected. In particular:

• If you decide not to proceed with a candidate following contact, you should delete their data within a reasonable period - we recommend no longer than 6 months from the date of your last interaction;
• If you make a successful hire, you may retain the candidate's pre-employment data as part of your employment records, subject to your own data retention obligations as an employer;
• DBS certificates and identity documents shared by candidates should be retained only for as long as required to verify suitability for the role, and must be securely deleted once no longer needed.

4.6 Security

You must implement appropriate technical and organisational measures to protect candidate data against unauthorised access, loss, or disclosure. This includes:

• Storing candidate data securely - do not leave candidate CVs, contact details, or identity documents in unsecured locations;
• Limiting access to candidate data within your organisation to those who need it for the recruitment process;
• Not transmitting candidate data via unencrypted channels (e.g. unencrypted email attachments containing identity documents);
• Securely deleting candidate data when it is no longer required.

4.7 Data subject rights

As an independent Data Controller, you must be able to respond to requests from candidates exercising their data protection rights in relation to data you hold about them. These rights include the right of access, rectification, erasure, restriction, and objection. You must have a process in place to handle such requests within 30 days.

4.8 Special category and criminal offence data

Some candidate documents - such as passport photographs, DBS certificates, or medical certificates - may contain special category data or criminal offence data. Where you receive such data:

• You must identify and document your lawful basis and Schedule 1 condition (for DBS data) before processing;
• You must handle such data with heightened care and restrict access within your organisation;
• You must not use special category data as a basis for discriminatory hiring decisions;
• You must securely delete such data as soon as it is no longer required for verification purposes.

5. Restart Talent's Obligations

Restart Talent commits to the following in its capacity as Platform operator and Data Controller:

• We will verify all candidate profiles before they appear in employer search results, to maintain the integrity of the Platform and the accuracy of candidate data;
• We will implement and maintain appropriate technical and organisational security measures to protect candidate data held on the Platform;
• We will ensure that the consent-based unlock and document-release mechanism operates as described in our Privacy Notice - no candidate data is released to an employer without the appropriate consent or credit-based unlock;
• We will maintain an up-to-date Privacy Notice that is available to candidates at all times;
• We will notify the ICO and affected candidates of any data breach on the Platform in accordance with UK GDPR Articles 33 and 34;
• We will respond to candidate data subject rights requests in relation to data held on the Platform within the timescales required by UK GDPR.

6. International Transfers of Candidate Data

Where an employer is based outside the United Kingdom, the act of unlocking a candidate profile or receiving candidate documents constitutes an international transfer of personal data. Employers based outside the UK must ensure that such transfers comply with UK GDPR Chapter V.

By registering as an employer and unlocking candidate data, employers outside the UK confirm that:

• They are based in a country for which the UK has issued an adequacy decision; OR
• They agree to be bound by the UK International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses, which is incorporated into this DPA by reference for all employers based outside the UK in countries without UK adequacy decisions.

Standard Contractual Clauses - incorporated by reference For employers based in countries without UK adequacy decisions, the UK International Data Transfer Agreement (IDTA) as issued by the ICO under Section 119A of the DPA 2018 is incorporated into this agreement by reference and governs the transfer of candidate personal data to the employer. The Employer accepts the role of importer and Restart Talent accepts the role of exporter. A copy of the applicable transfer mechanism is available on request at privacy@restarttalent.co.uk.

7. Data Breach Obligations

7.1 Employer obligations on breach

If an employer becomes aware of, or suspects, a personal data breach involving candidate data they have received through the Platform (for example, loss or unauthorised disclosure of a candidate's CV, contact details, or identity documents), the employer must:

• Notify Restart Talent at privacy@restarttalent.co.uk without undue delay and in any event within 72 hours of becoming aware of the breach;
• Provide Restart Talent with sufficient information to assess the scope and impact of the breach, including the nature of the data affected, the approximate number of individuals affected, and the likely consequences;
• Cooperate with Restart Talent in any investigation or notification to the ICO or affected candidates;
• Separately notify the ICO if required by UK GDPR Article 33 in your capacity as Data Controller.

7.2 Restart Talent obligations on breach

If Restart Talent becomes aware of a data breach on the Platform affecting candidate data that has been disclosed to employers, Restart Talent will:

• Notify the ICO within 72 hours where the breach is likely to result in a risk to individuals' rights and freedoms;
• Notify affected candidates without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
• Notify affected employers where the breach involves data that has been shared with them through the Platform.

8. Handling Candidate Rights Requests

Where a candidate exercises a data protection right (such as the right of access, erasure, or restriction) and directs that request to an employer in relation to data the employer holds, the employer must:

• Acknowledge the request within 5 working days;
• Respond fully within one calendar month (extendable by a further two months for complex requests, with explanation);
• Not charge a fee for responding to the request unless it is manifestly unfounded or excessive;
• Notify Restart Talent at privacy@restarttalent.co.uk if the request relates to data also held on the Platform, so that Restart Talent can fulfil its own obligations.

9. Term and Termination

9.1 This DPA takes effect on the date the Employer registers their account on the Platform and remains in force for as long as the Employer holds any candidate personal data received through the Platform.

9.2 Termination of an employer's Platform account does not terminate this DPA - the DPA continues to govern the Employer's obligations in respect of any candidate data they continue to hold following account closure.

9.3 Upon termination of the employer account, the Employer must securely delete all candidate personal data received through the Platform unless the Employer is required by law to retain it for a specific period.

9.4 Restart Talent may terminate or suspend an employer's access to the Platform if Restart Talent reasonably believes the Employer is in material breach of this DPA or of applicable data protection law.

10. Liability and Indemnity

10.1 Each party is independently responsible for its own compliance with UK GDPR and DPA 2018 in respect of the candidate data it controls.

10.2 Restart Talent is not liable for any breach of data protection law committed by an Employer in their capacity as an independent Data Controller of candidate data received through the Platform.

10.3 The Employer agrees to indemnify and hold harmless Restart Talent against any claims, fines, penalties, or losses arising from the Employer's failure to comply with this DPA or applicable data protection law in respect of candidate data the Employer holds.

10.4 Nothing in this DPA limits either party's liability for death or personal injury caused by negligence, fraud, or any liability that cannot be excluded by law.

11. Governing Law and Disputes

This DPA is governed by and construed in accordance with the laws of England and Wales. Any dispute arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales, without prejudice to any mandatory rights under applicable law.

Schedule A - Description of Processing

This schedule sets out the details of the processing of candidate personal data by employers, as required by UK GDPR Article 28(3) and the UK IDTA.

Schedule B - Execution

This Data Processing Agreement is entered into by the parties as of the date of the Employer's account registration on the Restart Talent Platform, or the date of signature below if executed separately.

Restart Talent Ltd | Company No. 15945851 | 86-90 Paul Street, London, EC2A 4NE | privacy@restarttalent.co.uk