How we process candidate data on your behalf.

For candidate personal data, you are the controller and Recruit360 is the processor. You determine what is collected, why, and for how long. We process only on your documented instructions, of which your configuration of the product forms part.

Subject matter: provision of interview, assessment, scoring and offer software.

Duration: the term of your agreement, plus the retention period you configure.

Categories of data subject: candidates, interviewers, and your own users.

Categories of data: identity and contact details, CV content, recorded answers and transcripts, code and written submissions, assessment scores, and assessment integrity signals.

Recruit360 does not require special category data. Video and audio recordings may incidentally reveal such characteristics; we do not infer them, score on them, or make them available as a filter. If you intend to collect special category data deliberately, you need a lawful basis for it and should tell us first.

Everyone with access is bound by confidentiality obligations that survive their engagement. Access to production data is limited to those who need it to operate and support the service.

Tenant isolation enforced at the database layer by PostgreSQL row-level security, HTTPS in transit, encryption at rest by the managed storage, role enforcement server-side per endpoint, and application secrets held in a managed secrets store. The current detail, including the parts not yet built, is on the security page, which forms part of this addendum.

You give general authorisation for us to engage subprocessors for hosting, object storage, transcription, model inference, email delivery and error monitoring. The current list, with the processing each performs and its location, is available on request. We give 30 days’ notice before adding one, and you may object.

Data is held in a single region — Singapore (ap-southeast-1) — for all customers; we do not currently offer a choice of region. Transfers rely on standard contractual clauses or another lawful mechanism, with supplementary measures where the assessment requires them. If regional hosting is a requirement, raise it before signing.

We assist you with data subject requests, impact assessments and regulator consultations, taking account of the nature of the processing and the information available to us.

We notify you without undue delay on becoming aware of a personal data breach affecting your data, with the detail available at the time and updates as the investigation proceeds.

On termination, you may export all candidate data in open formats. We delete it on your confirmation and confirm in writing when it is done, except where law requires retention. Automated retention schedules are not yet implemented — deletion is actioned on request rather than enforced on a timer.

We make available the information needed to demonstrate compliance and will accommodate a reasonable audit on notice, no more than once a year unless a regulator or a breach requires otherwise. We hold no third-party certification at present. Requests: legal@recruit360.co.