Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of every order or licence agreement (the "Order") under which a university, career service, training provider, employer or other organisation (the "Customer") purchases access to the Candidate Falcon services (the "Services") from Candidate Falcon ("Provider", "we", "us"). It sets out how we process personal data on the Customer's behalf, as required by Article 28 of the GDPR and the UK GDPR.

The DPA applies automatically to every Order. To receive a copy signed by both parties and naming your institution, email hi@candidatefalcon.com.

1. Definitions

• "Data Protection Law" means the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, and any other data protection law that applies to the processing under the Order.
• "Customer Data" means the personal data that the Customer supplies to us, or that we generate for the Customer, to set up and administer its licence. Annex 1 describes it.
• "Member" means a student, member or employee of the Customer who creates a Candidate Falcon account using an access code or invitation issued under the Order.
• "Sub-processor" means a third party we engage to process Customer Data on our behalf.
• "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in Data Protection Law.

2. Roles and Scope

For Customer Data, the Customer is the controller and we are the processor. We process Customer Data only on the Customer's documented instructions, which are the Order, this DPA, and any further written instructions the Customer gives us that are compatible with the Order.

Members create their own accounts and use the Services for their own career preparation. Their account data, practice recordings, transcripts, answers, CVs, scores and feedback are not Customer Data: we process them as an independent controller under our Privacy Policy, and we do not disclose them to the Customer. The Customer receives only the licence administration information and aggregate statistics described in Annex 1.

3. Our Obligations as Processor

• Instructions. We process Customer Data only as instructed, unless the law requires otherwise, in which case we inform the Customer before processing where the law allows. We tell the Customer if we believe an instruction breaches Data Protection Law.
• Confidentiality. Everyone we authorise to process Customer Data is bound by a confidentiality obligation and has access only to the data needed for their role.
• Security. We implement the technical and organisational measures in Annex 3 and keep them up to date with the state of the art and the risk of the processing.
• Sub-processors. The Customer authorises the Sub-processors in Annex 2. We give the Customer at least 30 days' notice by email before adding or replacing a Sub-processor. If the Customer objects on reasonable data protection grounds and we cannot resolve the objection, the Customer may terminate the affected Order and we refund any prepaid fees for the unused period. We impose on each Sub-processor data protection obligations equivalent to those in this DPA and remain responsible for its performance.
• Data subject requests. We forward to the Customer, without undue delay, any request we receive from a data subject about Customer Data, and we help the Customer respond, taking into account the nature of the processing. Requests from Members about their own accounts are handled by us under the Privacy Policy.
• Assistance. We help the Customer meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation, taking into account the information available to us.
• Personal data breaches. We notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Data, with the information the Customer needs to meet its own notification duties, and we keep the Customer updated as the investigation proceeds.
• Deletion. Within 30 days after the end of the Order, we delete Customer Data from our live systems, unless the law requires us to keep it. Backup copies expire according to the retention periods of our providers. Members' own accounts are not deleted at the end of the Order: they belong to the Members, who may keep using any remaining access and may delete their accounts at any time.
• Information and audits. We make available the information the Customer reasonably needs to demonstrate compliance with Article 28 GDPR, including this DPA, our Privacy Policy, the Annexes and our Sub-processors' compliance documentation. Where that information is not sufficient, the Customer may, once in any 12-month period and with 30 days' written notice, audit our processing of Customer Data through written questions or, where a supervisory authority requires it, through an on-site inspection conducted during business hours, at the Customer's cost and under confidentiality.

4. Customer Obligations

• The Customer is responsible for the lawfulness of the Customer Data it gives us and for having a legal basis to share it with us, including for inviting Members by email.
• The Customer supplies only the data needed to set up and administer the licence (Annex 1) and does not send us special categories of data.
• The Customer informs its Members that they will create their own accounts with us under our Terms of Service and Privacy Policy, and that the Customer does not have access to their practice content.

5. International Transfers

Customer Data is stored in the European Union (Ireland). Some Sub-processors in Annex 2 process data in the United States or in other countries outside the EEA and the UK. For those transfers we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum included in each Sub-processor's data processing terms and, where the Sub-processor is certified, on the EU-U.S. Data Privacy Framework and its UK extension. We do not transfer Customer Data outside the EEA or the UK on any other basis without the Customer's written agreement.

6. Liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Order. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under Data Protection Law.

7. Term, Precedence and Governing Law

This DPA applies for as long as we process Customer Data under the Order and survives its termination until that processing ends. If this DPA conflicts with the Order on a data protection matter, this DPA prevails. This DPA is governed by the law that governs the Order.

Annex 1: Details of the Processing

• Subject matter and purpose: setting up, administering and reporting on the Customer's licence to the Services.
• Duration: the term of the Order plus the deletion period in Section 3.
• Nature: collection, storage, use for issuing access codes and invitations, matching redemptions to the Customer's licence, producing aggregate usage statistics, and deletion.
• Data subjects: the Customer's staff who administer the licence; students, members or employees the Customer invites.
• Categories of personal data: name, work email address and role of the Customer's administrators; email address of invited Members where the Customer invites them by email; which access codes were issued to the Customer and whether and when they were redeemed; aggregate, non-identifying usage statistics for the Customer's group.
• Special categories of data: none intended.
• Frequency: continuous during the Order.

Annex 2: Authorised Sub-processors

Customer Data itself is processed by Supabase, Cloudflare and Brevo. The other Sub-processors process Members' own data under the Privacy Policy and are listed here for completeness. The current list is always in Section 10 of the Privacy Policy.

Annex 3: Technical and Organisational Measures

• Data location: the database, authentication records and uploaded files are hosted on Amazon Web Services in Ireland (eu-west-1).
• Encryption: all traffic uses TLS; stored data and backups are encrypted at rest by the hosting provider.
• Access control in the application: row-level security rules in the database allow each account to read only its own records; recordings and CVs sit in private storage buckets and are served through short-lived signed links; plan and billing fields can be written only by server-side functions, never by the browser.
• Authentication: accounts use email and password or Google sign-in through the authentication provider; passwords are stored hashed; access tokens for the AI assistant integration are short-lived.
• Secrets and least privilege: API keys and service credentials are stored in the hosting providers' secret stores, not in source code, and administrative access to the providers' consoles is limited to named personnel.
• AI processing: only the audio track and text of practice content are sent to AI providers, under business API terms that exclude training on the data; video and account identifiers are not sent.
• Backups and availability: the database provider keeps automated backups; the website is served from a global content delivery network with DDoS protection.
• Logging and monitoring: server-side functions log errors for troubleshooting, and alerts are raised when email delivery or background jobs fail.
• Deletion: account self-deletion removes the user's files, practice history and contact record across our systems in one operation; the same procedure is run for deletion requests received by email.
• Incident response: incidents are investigated, contained and documented, and affected customers are notified as set out in Section 3.
• Review: these measures are reviewed when the Services change materially and at least once a year.

Contact

Questions about this DPA, requests for a signed copy, sub-processor objections and breach reports: hi@candidatefalcon.com.