PRODICTA Data Processing Agreement
PRODICTA Ltd
Website: https://prodicta.co.uk/
Effective date: 5 November 2026
Version: 1.0
1. Parties and Application
This Data Processing Agreement ("DPA") is entered into between:
Processor: PRODICTA Ltd ("PRODICTA").
Customer: The employer, recruitment agency, HR organisation or technology partner identified in the applicable service agreement ("Customer").
This DPA forms part of the agreement governing the Customer's use of PRODICTA where incorporated by reference or otherwise accepted by both parties.
It applies to personal data processed by PRODICTA on behalf of the Customer in connection with the services.
2. Definitions
"Applicable Data Protection Laws" means the EU GDPR, UK GDPR, UK Data Protection Act 2018 and other applicable privacy or data protection legislation.
"Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings assigned by applicable data protection legislation.
"Subprocessor" means a third party engaged by PRODICTA to process Customer Personal Data on PRODICTA's behalf.
3. Roles and Responsibilities
For Customer Personal Data processed solely on behalf of the Customer:
- The Customer acts as Controller, or as Processor where acting on behalf of another Controller.
- PRODICTA acts as Processor, or Subprocessor where applicable.
The Customer determines the lawful purpose and legal basis for recruitment-related processing.
PRODICTA processes Customer Personal Data only on documented instructions, including instructions concerning international transfers, unless otherwise required by applicable law.
PRODICTA acts as a processor, only on the Customer's instructions, and does not use candidates' data to train models.
PRODICTA shall inform the Customer if, in its opinion, an instruction infringes applicable data protection law, unless prohibited from doing so.
Processing undertaken by PRODICTA for its own independent purposes covers only the Customer's account and usage information (billing, security and running the service) and the content of job descriptions (but not any personal details in them), and never candidates' answers, scores or recordings. It shall be governed by the applicable privacy notice and relevant controller obligations.
4. Processing Instructions
The Customer instructs PRODICTA to process personal data as reasonably necessary to provide the contracted assessment services, including:
- Receiving vacancy information and authorised candidate details.
- Generating role-specific assessment scenarios.
- Delivering assessments to candidates.
- Receiving and processing candidate responses.
- Producing structured assessment reports.
- Returning authorised assessment information to customer or partner systems.
- Providing contracted technical support and security operations.
- Deleting or returning data in accordance with this DPA.
Any additional processing must be supported by documented instructions or another lawful basis where PRODICTA acts independently as Controller.
5. Confidentiality
PRODICTA shall ensure that personnel authorised to access Customer Personal Data are bound by appropriate confidentiality obligations.
Access shall be restricted to personnel and service providers with a legitimate operational requirement.
6. Security Measures
PRODICTA shall implement technical and organisational measures appropriate to the nature, scope, context and risks of processing.
Measures shall include, as applicable and as described in Schedule B:
- Access control and authentication.
- Encryption during transmission.
- Appropriate encryption or equivalent protection for stored information.
- Logging and monitoring.
- Security incident management.
- Backup and recovery arrangements.
- Vulnerability management.
- Personnel confidentiality and access restrictions.
- Supplier security oversight.
PRODICTA shall review these measures periodically and maintain records appropriate to its obligations.
7. Subprocessors
The Customer grants PRODICTA general authorisation to engage subprocessors listed in the current Subprocessor Register, subject to the Customer's contractual right to object to changes.
PRODICTA shall:
- Maintain a register identifying subprocessors, processing functions and relevant locations.
- Provide advance notice of proposed additions or replacements within the period specified in Schedule C.
- Give the Customer a reasonable opportunity to object on legitimate data protection grounds.
- Impose appropriate written data protection obligations on subprocessors.
- Remain responsible to the Customer for the performance of its subprocessors' obligations under this DPA.
Where an objection cannot reasonably be resolved, the parties shall follow the termination or alternative-service provisions of their agreement.
8. International Transfers
PRODICTA shall not transfer Customer Personal Data internationally except in accordance with documented instructions and applicable data protection law.
Where required, transfers shall be supported by a valid transfer mechanism, including:
- Applicable adequacy decisions or regulations.
- EU Standard Contractual Clauses.
- The UK International Data Transfer Addendum or International Data Transfer Agreement.
- Other legally recognised safeguards.
The parties shall complete and incorporate the appropriate transfer instruments and annexes where required.
Where applicable, PRODICTA shall assist with transfer risk assessments and supplementary safeguards.
This DPA does not itself replace any required international transfer instrument.
9. Data Subject Rights
Taking into account the nature of processing, PRODICTA shall provide reasonable assistance to the Customer in responding to requests concerning:
- Access to personal data.
- Rectification of inaccurate information.
- Erasure.
- Restriction of processing.
- Data portability.
- Objections to processing.
- Rights concerning automated decision-making, where applicable.
Where PRODICTA receives a request relating to Customer-controlled data, it shall promptly refer the request to the Customer unless legally required to respond directly.
10. Personal Data Breaches
PRODICTA shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notification shall include information reasonably available concerning:
- The nature of the incident.
- Categories and approximate numbers of affected individuals and records, where known.
- Likely consequences.
- Mitigation and remediation measures.
- Contact arrangements for further information.
PRODICTA shall provide reasonable cooperation to support the Customer's applicable notification obligations.
11. Assistance and Regulatory Obligations
Taking into account the nature of the processing and information available to it, PRODICTA shall reasonably assist the Customer with:
- Data protection impact assessments.
- Prior consultation with supervisory authorities where required.
- Security and breach-related obligations.
- Requests from competent data protection authorities.
- Relevant information concerning processing activities and safeguards.
12. Assessment Information and Human Decision-Making
Candidate responses, scores, reports and associated assessment evidence constitute personal data where they relate to an identifiable individual.
The Customer is responsible for establishing a lawful basis for using assessment information in recruitment decisions and for complying with applicable employment and automated decision-making laws.
PRODICTA provides decision-support information. The Customer retains responsibility for final hiring decisions.
13. Data Retention and Deletion
Customer Personal Data shall be retained in accordance with the documented retention periods in Schedule A, the applicable service agreement and lawful processing instructions.
Upon termination or expiry of services, PRODICTA shall, at the Customer's choice, return or delete Customer Personal Data unless applicable law requires continued storage.
Where immediate deletion from backup systems is technically impracticable, residual data shall remain protected and be deleted according to the documented backup lifecycle.
PRODICTA shall provide reasonable confirmation of deletion upon request.
14. Audit and Compliance Information
PRODICTA shall make available information reasonably necessary to demonstrate compliance with its processor obligations.
PRODICTA shall allow and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, as required by applicable law.
The parties shall reasonably coordinate audit scope, confidentiality, security, timing and measures to minimise disruption, without restricting mandatory statutory audit rights.
15. United States Privacy Requirements
Where US privacy laws apply and PRODICTA acts as a service provider, contractor or processor, the parties shall comply with the requirements applicable to their respective roles.
PRODICTA shall not sell or share Customer Personal Data for cross-context behavioural advertising or use it for unrelated commercial purposes under this DPA.
PRODICTA shall not retain, use or disclose Customer Personal Data outside the permitted business purposes and other lawful exceptions specified by the applicable agreement and legislation.
Where state law requires additional contractual provisions, the parties shall incorporate the necessary state-specific terms.
16. AI Training and Own Purposes
PRODICTA does not use Customer Personal Data to train any AI model, whether its own or a third party's.
PRODICTA does not use Customer Personal Data to test, tune or improve its scoring, prompts or thresholds, or for any other purpose of its own.
17. Liability and Order of Precedence
Liability under this DPA shall be governed by the applicable service agreement, subject to any mandatory rights and liabilities under data protection law.
In the event of conflict concerning personal data processing, this DPA shall take precedence over the general commercial terms.
Where incorporated international transfer clauses conflict with this DPA, those clauses shall prevail to the extent required by their terms.
18. Governing Law
This DPA shall be governed by the law specified in the applicable service agreement, without prejudice to mandatory data protection laws and the governing-law provisions of any applicable international transfer instrument.
19. Contact
Data protection enquiries:
PRODICTA Ltd
Website: https://prodicta.co.uk/
Email: admin@prodicta.co.uk
Schedule A: Details of Processing
Subject matter: Delivery of AI-assisted recruitment assessments.
Duration: The period during which PRODICTA provides services and any documented post-termination retention period.
Nature and purpose: Assessment generation, candidate participation, response processing, scoring, reporting, customer access, integration delivery and contracted support.
Categories of data subjects:
- Job applicants and candidates.
- Recruiters and hiring managers.
- Authorised customer and partner users.
Categories of personal data:
- Names and contact details.
- Vacancy and professional information.
- Candidate assessment responses.
- Assessment scores and reports.
- Account and authentication information.
- Relevant technical and usage records.
- Audio, transcripts or other assessment media where the relevant functionality is enabled.
Special-category data: Not intentionally required for ordinary assessment delivery. Any incidental or expressly authorised processing must have an appropriate legal basis and safeguards.
Retention periods: For EU and US accounts, 30 days for unstarted assessments and 6 months for completed assessments, applied to assessment responses, reports, candidate records and account-related candidate data. A Customer contract can set a different period. Video and audio recordings of candidates' answers are deleted automatically 30 days after the assessment result is delivered to the employer, or 90 days after upload if no result is delivered. Written transcripts are kept with the assessment responses. Backups are kept for around a week. Account data is deleted on request within one month after an account is closed, unless the law requires it to be kept.
Processing locations: United Kingdom, European Union, United States. Voice answers are processed in the European Union.
Schedule B: Technical and Organisational Security Measures
Schedule C: Subprocessor Register
PRODICTA shall maintain a current public or customer-accessible Subprocessor Register identifying:
- Legal name of each subprocessor.
- Service or processing function.
- Categories of personal data processed.
- Processing and storage locations.
- Applicable international transfer safeguards.
Subprocessor change notice period: 30 days.
Subprocessor Register location: Provided to customers on request from admin@prodicta.co.uk
Schedule D: International Transfer Mechanisms
Where applicable, the parties shall incorporate and complete:
- The European Commission's applicable Standard Contractual Clauses under Decision (EU) 2021/914.
- The appropriate transfer modules and annexes.
- The UK International Data Transfer Addendum or International Data Transfer Agreement, where required.
- Any applicable supplementary safeguards and transfer assessments.
The parties shall identify the relevant exporter, importer, roles, categories of data, processing locations and competent supervisory authority as required by the chosen instrument.
Acceptance and Incorporation
This DPA becomes binding when incorporated into an enforceable customer agreement or otherwise validly accepted by the parties.
For separately executed agreements:
PRODICTA Ltd
Authorised signatory: __________________
Date: __________________
Customer
Legal entity: __________________
Authorised signatory: __________________
Date: __________________
PRODICTA is a product of PRODICTA Ltd · Registered in England and Wales · admin@prodicta.co.uk
© 2026 PRODICTA. All rights reserved.