Data processing addendum.

Last updated: 1 November 2026

This Data Processing Addendum (“DPA”) forms part of the Terms and Conditions between Behavioural Intelligence Ltd, whose registered office is at The Mill, Pury Hill Business Park, Alderton Road, Towcester, England, NN12 7LS (“the Provider”), and the Client. It sets out the terms required by Article 28(3) of the UK GDPR and, where the EU GDPR applies, Article 28(3) of the EU GDPR. If this DPA conflicts with the Terms and Conditions about the processing of Personal Data, this DPA applies.

1 Definitions

1.1 “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where it applies to the processing, the EU GDPR, each as amended or replaced from time to time.

1.2 “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process” and “Supervisory Authority” have the meanings given in Data Protection Law.

1.3 “Client Personal Data” means the Personal Data in Client Data and User Data that the Provider Processes on behalf of the Client in providing the Services. Terms defined in the Terms and Conditions and the Privacy Policy have the same meaning here.

1.4 “Sub-processor” means a third party engaged by the Provider to Process Client Personal Data.

2 Roles and scope

2.1 For Client Personal Data, the Client is the Controller and the Provider is the Processor. The Provider is the Controller of the Personal Data it Processes for its own purposes, as described in the Privacy Policy, and this DPA does not apply to that Processing.

2.2 Annex 1 describes the subject matter, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.

2.3 The Client is responsible for having a lawful basis to Process Client Personal Data, for giving Data Subjects the notices that Data Protection Law requires, and for the instructions it gives.

3 Instructions

3.1 The Provider will Process Client Personal Data only on the Client's documented instructions. The Terms and Conditions, this DPA and the Client's use and configuration of the Services, including the connection of mailboxes and applications and the creation of tokens and webhooks, are the Client's complete instructions at the date of this DPA.

3.2 If the Provider is required by law to Process Client Personal Data otherwise, it will tell the Client before Processing, unless the law prohibits this. If the Provider believes an instruction infringes Data Protection Law, it will tell the Client without undue delay and may suspend the instruction until the Client confirms or changes it.

4 Confidentiality

4.1 The Provider will make sure that everyone it authorises to Process Client Personal Data is bound by a duty of confidentiality, by contract or by law, and Processes it only as needed to provide the Services.

5 Security

5.1 The Provider will put in place appropriate technical and organisational measures to protect Client Personal Data, taking account of the matters set out in Article 32 of the UK GDPR. Annex 2 describes the measures in place at the date of this DPA.

6 Sub-processors

6.1 The Client gives the Provider general written authorisation to engage the Sub-processors listed in section 3.5 of the Privacy Policy, which is available at https://app.hireinsight.io/pp.

6.2 The Provider will give the Client at least 15 days notice before it adds or replaces a Sub-processor, by email to the Client's account administrators and by updating section 3.5 of the Privacy Policy. The Client may object on reasonable data protection grounds within that period by emailing support@hireinsight.io. The parties will discuss the objection in good faith. If the Provider cannot accommodate it, the Client may terminate the affected Services and the Provider will refund the prepaid fees for the remainder of the term.

6.3 The Provider will impose on each Sub-processor, by contract, data protection obligations no less protective than those in this DPA, and remains liable to the Client for the Sub-processor's performance of those obligations.

6.4 Applications that the Client's users connect to the Services and that are not listed in section 3.5 of the Privacy Policy are chosen and controlled by the Client and are not Sub-processors.

7 International transfers

7.1 Client Data is stored in the United Kingdom and the European Union. User Data is stored in the region the Client chooses, as described in the Terms and Conditions.

7.2 The Provider will not transfer Client Personal Data to a country outside the United Kingdom, and, where the EU GDPR applies, outside the European Economic Area, unless there is an adequacy decision or regulation for that country or the transfer is covered by appropriate safeguards required by Data Protection Law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. The Provider will enter into those safeguards with Sub-processors where needed, and will give the Client a copy of the relevant terms on request, with commercial terms redacted.

8 Assistance

8.1 Taking account of the nature of the Processing, the Provider will help the Client, by appropriate technical and organisational measures, to respond to requests from Data Subjects to exercise their rights under Data Protection Law. The Services include tools for access, correction, restriction, objection, export and erasure of contact records. If a Data Subject contacts the Provider directly about Client Personal Data, the Provider will pass the request to the Client without undue delay and will not respond except to say it has done so.

8.2 The Provider will help the Client to comply with its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking account of the nature of the Processing and the information available to the Provider.

9 Personal Data Breaches

9.1 The Provider will tell the Client without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Client Personal Data. The notice will describe, as far as the Provider then knows, the nature of the breach, the categories and approximate numbers of Data Subjects and records concerned, the likely consequences and the measures taken or proposed. The Provider will give further information as it becomes available.

10 Deletion and return

10.1 The Client can export and delete Client Personal Data through the Services at any time.

10.2 When the Services end, or when the Client asks in writing, the Provider will, at the Client's choice, return or delete Client Personal Data. The Provider will delete it within 90 days after the Services end, unless the law requires the Provider to keep it. Backups are deleted in line with their normal cycle. The Provider will delete the stored credential for a connected mailbox when the mailbox is disconnected.

11 Audits

11.1 The Provider will give the Client the information needed to show that the Provider has complied with this DPA, and will allow and contribute to audits, including inspections, by the Client or an auditor the Client appoints, as Article 28(3)(h) of the UK GDPR requires.

11.2 The Client will give at least 30 days written notice of an audit, will not make one more than once in any 12 months unless a Personal Data Breach or a Supervisory Authority requires it, will keep what it learns confidential, will carry the audit out in working hours without disrupting the Provider's business, and will bear its own costs. The Provider may first satisfy a request by providing its current security documentation or an independent report where that answers the Client's questions.

12 Liability and term

12.1 The limits and exclusions of liability in the Terms and Conditions apply to this DPA. Nothing in this DPA limits liability that cannot be limited by law, including a Data Subject's rights under Data Protection Law.

12.2 This DPA starts when the Client first accepts the Terms and Conditions and lasts for as long as the Provider Processes Client Personal Data. Sections 9 and 10 continue after that for as long as needed.

12.3 The Provider may update this DPA, and will tell the Client in the way set out in section 11 of the Privacy Policy before a change takes effect.

Annex 1 Details of the Processing

Subject matter and nature. Hosting, storing, organising, displaying, retrieving, synchronising, transmitting and deleting Client Personal Data to provide the recruitment and executive search Services described in the Terms and Conditions.

Purpose. To provide the Services to the Client and its users, to support them, and to keep them secure.

Duration. For as long as the Provider provides the Services to the Client, and until deletion under section 10.

Categories of Data Subjects. The Client's users and staff; candidates and applicants; the Client's own clients and their staff; referees and other contacts the Client records; and people who correspond by email with a mailbox the Client connects.

Types of Personal Data. Names, email addresses, telephone numbers, postal addresses, job titles and employers, career history, curricula vitae and other documents, notes, compensation and salary information, assessment and psychometric results, application and campaign records, LinkedIn profile information that users import, email messages (senders, recipients, subjects, bodies and attachments) from connected mailboxes, and account and usage data of the Client's users such as login details, access tokens and audit records.

Special category data. The Services are not designed for special category data, and the Client should not record it. Free text fields, documents and email content may nonetheless contain it, and the Client is responsible for that content.

Annex 2 Security measures

The Provider maintains these measures at the date of this DPA.

1. Data in transit is encrypted with TLS.

2. Each Customer Service is separated from the others by access rules enforced in the database on every query, using the permissions of the signed-in user, rather than only in application code.

3. Personal access tokens and OAuth tokens are shown once and stored only as one-way hashes. Tokens for the API are exchanged for session credentials that expire after 2 minutes, and revoked tokens stop working within a few minutes.

4. Google credentials for connected mailboxes are stored in AWS Secrets Manager and not in the database, and the mail service holds no standing database login.

5. Production secrets are held in AWS Secrets Manager, and access is limited by role.

6. Contacts that have restricted processing or objected to it are excluded from API and MCP results, and views of contact records through the API are recorded in an audit log.

7. Data is encrypted at rest.

8. Data is backed up daily.

9. Hosting is with Amazon Web Services and SurrealDB Cloud, which operate their own physical and infrastructure security programmes.