Data Processing Addendum (DPA)

1. Definitions

• "Applicable Data Protection Law" means the UK GDPR, Data Protection Act 2018, and any other data protection legislation applicable to the Controller's processing activities in the territories where the Controller operates. TSA's obligations under this DPA are framed by UK GDPR standards; the Controller remains responsible for determining and complying with any additional local requirements.
• "Controller" means the Customer (organisation).
• "Data Subject" means an identified or identifiable natural person whose personal data is processed.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• "Processor" means The Safeguarding Alliance Limited ("TSA").
• "Processing" means any operation performed on personal data, whether or not by automated means.
• "Special Categories of Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation.
• "Sub-processor" means any third party engaged by TSA to process personal data on behalf of the Controller.

2. Scope and Duration

2.1 Subject Matter

This DPA governs the processing of personal data by TSA in connection with the provision of The Safeguarding Alliance Limited's Safer Recruitment Suite (SafeRecord, SafeApply, and/or SafeVerify) services to the Controller.

2.2 Duration

The processing will continue for the duration of the MSA and any post-termination period required for data deletion as specified herein.

2.3 Nature and Purpose

TSA processes personal data solely for the purpose of:

• Providing hosting, storage, and retrieval services for The Safeguarding Alliance Limited's Safer Recruitment Suite
• Enabling document organisation and management
• Providing assistive document analysis features (non-decisioning)
• Supporting recruitment and staff management processes
• Maintaining system security and operational integrity
• Providing customer support and service improvements

3. Categories of Data Subjects and Personal Data

3.1 Data Subjects

• Authorized users (organisation staff members)
• Job applicants and candidates
• References and referees
• Other individuals whose data is submitted through the services

3.2 Categories of Personal Data

• User Account Data: Names, email addresses, roles, organisational affiliations, login credentials, usage logs
• Application Data: Contact details, employment history, education records, references, application materials
• Safeguarding & suitability data: Disciplinary history, safeguarding concerns, allegations, and related free-text submitted via application, reference, or vetting workflows (as configured by the Controller)
• Reference Data: Referee contact information, relationship details, reference responses
• Special Categories & criminal offence data: (a) criminal record check metadata only (reference number, date, status/outcome, issuer — no DBS/CRB certificate documents); (b) health data submitted through the dedicated medical vetting workflow in SafeVerify or SafeRecord (including documents uploaded by the Controller to that workflow); (c) other special category data only where the Controller configures the Services to collect it (e.g. through bespoke application or reference form questions, free-text safeguarding responses, or document uploads). TSA does not determine the lawfulness of Controller-configured collection.
• Technical Data: IP addresses, device information, browser data, system logs

3.3 Restrictions on Special Categories

CRITICAL LIMITATIONS: (i) TSA prohibits the upload or storage of criminal record certificates (DBS, CRB, etc.) and equivalent certificate documents — only metadata about such checks may be recorded; (ii) medical or psychological reports must not be uploaded except through the dedicated medical vetting workflow in SafeVerify or SafeRecord; (iii) the Controller must not configure the Services to collect special category or criminal offence data unless it has identified a lawful basis and, where required, an Article 9 condition and/or Schedule 1 DPA 2018 condition, and provided appropriate notices to data subjects. The Controller is solely responsible for determining the lawful basis under UK GDPR Article 6, and where applicable, the condition under Schedule 1 of the Data Protection Act 2018, for any special category or criminal offence data it configures the Services to process. TSA acts solely as Processor and does not determine lawfulness, conditions, or compliance obligations for such data.

4. Processor Obligations

4.1 Processing Instructions

TSA will process personal data only on documented instructions from the Controller, except where required by applicable law. TSA will immediately inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law. The Controller is solely responsible for determining lawful basis, conditions, and compliance for special category and criminal offence data (including Schedule 1 DPA 2018 conditions). The Controller must identify and document an applicable Schedule 1 DPA 2018 condition before processing criminal offence data through the Services. TSA acts solely as Processor and does not determine lawfulness or compliance obligations.

4.2 Confidentiality and Personnel

TSA ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to personal data is restricted to personnel who require such access for legitimate business purposes.

4.3 Security Measures

TSA implements and maintains appropriate technical and organisational measures as detailed in Annex 1 to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

4.4 Assistance to Controller

TSA will assist the Controller in ensuring compliance with obligations regarding:

• Data subject rights requests (access, rectification, erasure, restriction, portability, objection)
• Data Protection Impact Assessments (DPIAs)
• Consultation with supervisory authorities
• Security incident response and breach notifications

LIMITATION: Such assistance is subject to reasonable limitations based on technical feasibility and will be provided at the Controller's expense for requests exceeding standard support levels.

4.5 Deletion and Return

Upon termination of services or upon Controller's instruction, TSA will delete or return all personal data to the Controller and delete existing copies unless storage is required by applicable law. Deletion timelines are specified in Annex 2.

4.6 Demonstrating Compliance

TSA will make available to the Controller information necessary to demonstrate compliance with this DPA and Applicable Data Protection Law.

TSA may first satisfy audit obligations by providing third-party attestations, certificates, or summary audit reports. Onsite audits shall occur no more than once per 12 months (unless required by a competent authority), during business hours, on 30 days' prior written notice, subject to appropriate confidentiality undertakings, and without unreasonably disrupting operations. Audits must be proportionate and risk-based, and cannot compromise the security or confidentiality of other customers' data. Controller shall bear its own costs and TSA's reasonable support costs for audits exceeding standard documentation.

5. Sub-processors

5.1 Authorized Sub-processors

Customer authorizes TSA to appoint the following sub-processors:

• Amazon Web Services (AWS): EU-West-2 hosting, authentication (Cognito), document text extraction (Textract), and AI inference (Bedrock); no training on Customer Personal Data
• Google (Gmail API): email delivery
• Paddle.com Market Ltd: subscription billing and invoicing carried out on TSA's instructions, where applicable. Paddle's separate role as merchant of record is not a sub-processor activity — see section 6.3
• Waxley Graham LLC: software development and platform operation
• IONOS Cloud Limited: email hosting for TSA's own mailboxes, in which correspondence relating to the Services is received and retained

A current list with additional detail is maintained at Sub-Processors. All sub-processors are bound by written contracts with GDPR-compliant clauses and, where applicable, Data Processing Agreements. International transfer safeguards (International Data Transfer Agreement (IDTA)) are in place where required.

5.2 Changes and Objections

TSA will notify Customer of material sub-processor changes at least 30 days in advance. Customer may object on reasonable data-protection grounds within 30 days of notice; the parties will work in good faith to mitigate or modify processing, or, if unresolved, permit termination of the affected Services.

5.3 Sub-processor Obligations

TSA ensures that sub-processors meet obligations equivalent to those in this DPA. TSA has a data processing agreement with Waxley Graham LLC with obligations equivalent to this DPA.

6. International Transfers

6.1 Data Location

TSA stores application data in the United Kingdom (AWS London, eu-west-2) and does not ordinarily transfer such data outside the UK/EEA. If access occurs outside the UK/EEA (e.g., for technical support), appropriate safeguards will be in place, including International Data Transfer Agreement (IDTA) where required.

6.2 Transfer Safeguards

Where transfers by authorized sub-processors are necessary, TSA will ensure appropriate safeguards are in place (including International Data Transfer Agreement (IDTA), adequacy decisions, or other lawful transfer mechanisms).

6.3 Payment Processing

Paddle.com Market Ltd acts in two distinct capacities, and each is governed by a different instrument.

• As TSA's processor. Where the parties agree to invoicing, TSA discloses to Paddle the billing details needed to raise the invoice — billing contact name and email address, billing address, and any VAT or tax registration number provided — and retrieves those billing records back. TSA holds the resulting Paddle customer reference against the Customer's account. This processing is carried out on TSA's documented instructions under Paddle's Data Processing Addendum (EU Standard Contractual Clauses Module Two with the UK Approved Addendum).
• As an independent controller. Paddle is the merchant of record for the sale. For taking payment, calculating and remitting sales tax, fraud screening, and meeting its own financial and regulatory obligations, Paddle determines the purposes and means of the processing and does not act on TSA's instructions. TSA does not control that processing. It is governed by Paddle's separate Data Sharing Addendum (EU Standard Contractual Clauses Module One with the UK Approved Addendum) and Paddle's own privacy policy.

Card and bank details are entered by the Customer directly into Paddle's checkout and are never received or stored by TSA. Paddle.com Market Ltd is established in the United Kingdom; where Paddle transfers data outside the UK/EEA under either capacity, it does so under its own safeguards as described above.

6.4 International Controllers

Where the Controller is established outside the United Kingdom or processes personal data of individuals located outside the UK/EEA, the Controller is responsible for determining lawful bases, providing required notices to data subjects, and complying with local data protection requirements. TSA will provide the transfer safeguards described in this DPA where personal data is accessed or processed outside the UK/EEA.

7. Security Incidents and Breach Response

7.1 Breach Notification

TSA will notify the Controller without undue delay after becoming aware of a Personal Data Breach. Such notification will include, to the extent available:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

TSA may provide information in phases as it becomes available and will provide reasonable updates to the Controller.

7.2 Assistance

TSA will provide reasonable assistance to the Controller in investigating and remediating security incidents, including cooperation with regulatory investigations and data subject notifications.

7.3 Allocation of Responsibility

TSA is not responsible for a Personal Data Breach to the extent caused by: (i) the Controller's failure to implement appropriate security measures in its systems; (ii) unauthorized access using the Controller's compromised credentials; (iii) security vulnerabilities in the Controller's systems or networks; (iv) force majeure; or (v) third-party actions not attributable to TSA.

8. Data Subject Rights

8.1 Controller Responsibility

The Controller is primarily responsible for responding to data subject rights requests. TSA will assist the Controller in fulfilling such requests to the extent technically feasible and within reasonable limits.

8.2 Request Processing

When TSA receives data subject requests directly, it will forward such requests to the Controller within 3 business days. TSA will not respond directly to data subjects unless explicitly instructed by the Controller. This aligns with the Controller's primary responsibility for responding to data subject rights requests under UK GDPR.

8.3 Technical Limitations

Certain data subject requests may be subject to legal or technical constraints. TSA will not be responsible for inability to fulfill a request where fulfillment would contravene Applicable Data Protection Law, exceed available technical capabilities, or require changes to the Services' core architecture; however, TSA will provide reasonable assistance to the extent feasible.

9. Liability and Indemnification

9.1 Limitation of Liability

Liability under this DPA is subject to and shall count toward the limitations and exclusions set out in the MSA.

9.2 Excluded Damages

IN NO EVENT SHALL TSA BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, DATA LOSS, BUSINESS INTERRUPTION, REGARDLESS OF THE THEORY OF LIABILITY.

9.3 Controller Indemnification

The Controller will indemnify and hold harmless TSA against third-party claims, damages, losses, and expenses arising from the Controller's proven violation of Applicable Data Protection Law, including:

• Controller's failure to obtain necessary consents or establish lawful basis for processing
• Controller's use of the services for unlawful purposes
• Controller's breach of this DPA
• Final regulatory penalties or fines imposed on TSA to the extent they arise solely from the Controller's proven violations of Applicable Data Protection Law

9.4 Force Majeure

TSA is not liable for any failure or delay in performance due to circumstances beyond its reasonable control, including acts of God, natural disasters, war, terrorism, government actions, cyber attacks, or infrastructure failures.

10. General Provisions

10.1 Governing Law

This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.

10.2 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions will remain in full force and effect.

10.3 Survival

Provisions relating to confidentiality, liability limitations, indemnification, and data deletion will survive termination of this DPA.

10.4 Amendments

This DPA may only be amended by written agreement signed by both parties.

10.5 Precedence

In case of conflict between this DPA and the MSA, this DPA takes precedence with respect to data protection matters.

10.6 Data Protection Officer and privacy contact

TSA has appointed a Data Protection Officer. All data protection matters under this DPA — including data subject requests, breach notifications, audit and assistance requests, and complaints — should be directed to the Data Protection Officer at dpo@thesafeguardingalliance.org.uk. Operational support requests and formal contractual notices continue to be sent to the addresses set out in the MSA.

Annex 1 – Technical and Organisational Measures (TOMs)

A.1 Technical Measures

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest
• Access Controls: Multi-factor authentication, role-based access control, least privilege principles
• Network Security: VPC isolation, firewall protection, network monitoring and alerting
• Monitoring: Comprehensive logging, real-time monitoring, automated alerting
• Backup Security: Encrypted backups with secure storage and regular testing
• Vulnerability Management: Regular security scans and patch management

A.2 Organisational Measures

• Personnel Security: Background checks, confidentiality agreements, security training
• Incident Response: Documented procedures, designated response team, regular testing
• Business Continuity: Disaster recovery plans, regular testing, alternative processing capabilities
• Data Governance: Data classification, retention policies, regular audits
• Third-Party Management: Vendor assessments, contract reviews, ongoing monitoring

A.3 Compliance and Certification

• ISO 27001-aligned controls (where applicable)
• Regular compliance assessments
• Independent security audits
• Regulatory compliance monitoring

Annex 2 – Data Deletion and Retention

B.1 Deletion Timeline

• Active Systems: 30 days after termination or Controller instruction
• Database backups: automated backups are retained on a rolling 7-day cycle, so personal data leaves the backup estate within 7 days of its deletion from active systems
• Document storage: superseded object versions are permanently removed 90 days after they cease to be current
• Operational system logs (e.g. CloudWatch request/debug logs): up to 14 days, then automatically purged
• Security and audit logs (where personal data is included): up to 12 months, unless a shorter period applies for operational logs as described above

B.2 Legal Retention

Personal data may be retained longer where required by applicable law, regulatory requirements, or legitimate business interests (such as dispute resolution).

B.3 Deletion Methods

Deletion includes:

• Logical deletion from active systems
• Physical destruction of storage media
• Secure overwriting of data
• Removal from backup archives
• Irreversible anonymisation

B.4 Certification of Deletion

Upon request, TSA will provide written certification of data deletion within 30 days of completion.