Data processing agreement
Last updated [date]
This agreement forms part of the Tempbench terms of service between the agency ("controller", "you") and [Company legal name] ("processor", "we"). It meets the requirements of Article 28 of the UK GDPR.
1. Details of the processing
| Subject matter and duration | Providing Tempbench to you for as long as your account is open, plus the deletion period below. |
|---|---|
| Nature and purpose | Hosting, storing, searching, displaying and deleting the data you put into Tempbench so you can run your recruitment business. |
| Types of personal data | Names, contact details, postcodes and approximate location, work history, positions, skills, availability, notes, and documents you upload such as CVs, right to work and licence records. |
| Data subjects | Your candidates, client contacts and team members. |
2. Our obligations
- We process the data only on your documented instructions, which are given through your use of Tempbench and these terms, unless the law requires otherwise (in which case we will tell you unless that is prohibited).
- Everyone at our end who can access the data is bound by confidentiality.
- We keep the data secure with appropriate technical and organisational measures, including encryption in transit, hashed passwords, separation of each agency's data, access controls and regular backups.
- We help you respond to requests from data subjects and with your security, breach notification and impact assessment duties, taking into account what we can reasonably do.
- We tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data.
- When your account is deleted we delete your data from the live system straight away and from backups within [35] days, unless the law requires us to keep it. You can export everything before then.
- We make available the information needed to show we meet this agreement and allow reasonable audits, at your cost and with reasonable notice.
3. Sub-processors
You authorise us to use the sub-processors below. We will give you at least 30 days' notice by email before adding or replacing one, and you may object; if we cannot resolve the objection you may cancel without penalty.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger | Application and database hosting | [data centre location] |
| Cloudflare | Network security and delivery | Global, with UK/EU safeguards |
| [Email provider] | Sending account emails (invites, password resets) | [location] |
| postcodes.io (Ideal Postcodes) | Turning postcodes into map positions; receives postcodes only | UK |
4. International transfers
Where data leaves the UK we make sure an adequacy decision or the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, is in place.
5. Your obligations
You are responsible for having a lawful basis for the data you store, for telling data subjects how you use it, and for the accuracy of what you enter.
6. Liability and law
Liability under this agreement is subject to the limits in the terms of service. This agreement is governed by the law of England and Wales.