Customer data processing schedule

Scope, roles and instructions

This schedule applies where Gravitate Recruitment Ltd (trading as Finance Hiring Lab, company number 14202736) processes personal information in customer-supplied role material solely on behalf of the business customer to provide the Health Check. The customer is the controller and we are the processor. It does not change our independent controller responsibilities for billing, buyer administration, security and legal obligations.

The subject matter and purpose are the secure receipt, storage, malware scanning, text extraction, drafting, specialist review, delivery and clarification of one finance vacancy report. Processing includes collecting, organising, using, transmitting, storing, retrieving and deleting the material. It lasts for the order and the retention period in the terms, subject to the customer's lawful return or deletion instructions and any legal retention requirement.

Data subjects may be the customer's staff or business contacts incidentally identified in role material. Data types are limited to ordinary business identity and professional role information needed for the service. Candidate records, special category data and criminal offence data are outside the agreed scope. If we discover such material, we escalate it and delete or redact it under control rather than continuing routine processing.

Our obligations

We process this information only on the customer's documented lawful instructions, including for international transfers, unless UK law requires otherwise. We tell the customer about such a legal requirement before processing unless prohibited, and immediately tell the customer if we consider an instruction infringes data protection law. The contract and this schedule are the standing instructions; a material new purpose needs further lawful instructions.

We make sure authorised personnel are bound by confidentiality and apply security appropriate to the risk, including private storage, access limited to authorised people, strong authentication for administration, encrypted transmission, access logging, recovery arrangements and a documented incident procedure.

Taking account of the nature of processing and the information available to us, we help the customer with data subject requests, security obligations, personal data breaches, data protection impact assessments and required regulatory consultation. We notify the customer without undue delay after becoming aware of a personal data breach affecting its material, and provide the details and updates it needs. We do not wait for a complete investigation before notifying.

At the end of the service, we return or delete the personal information and copies at the customer's choice, unless UK law requires retention. While the customer uses the 12-month access period, it instructs us to keep the service material for that period. The customer can give earlier return or deletion instructions by contacting us. Restricted backups are handled under the provider's backup cycle and are not restored into ordinary use without reapplying deletions.

We provide the information needed to demonstrate compliance with this schedule and allow and contribute to audits and inspections by the customer or its appointed auditor, on reasonable notice and with appropriate confidentiality and security arrangements.

Subprocessors and transfers

The customer gives general written authorisation for these subprocessors, which receive customer material on our behalf:

• Supabase: database and private file storage (London, UK)
• DigitalOcean: application hosting (London, UK)
• Cloudmersive: malware scanning of uploaded files (United States)
• OpenAI: AI-assisted drafting from extracted text (United States)
• Resend: transactional email containing order links, not brief or report content
• Microsoft 365: our business mailbox, where you send us material by email

Stripe processes payment information as an independent controller for its own payment, fraud prevention and regulatory activities, and is not made a subprocessor by this schedule.

We impose the required data protection obligations on each subprocessor by written contract and remain responsible to the customer for their performance. We give at least 30 days' written notice before a new or replacement subprocessor receives customer material. The customer may object on reasonable data protection grounds during that period. We look for a workable solution; if none is available, the affected service may be ended with a refund for the undelivered part. We do not send affected material to the new provider while a timely objection remains unresolved.

International processing must comply with the UK transfer rules and documented safeguards. We do not use customer material to train general AI models, build recruitment prospect lists or deliver a separate recruitment service.

The customer remains responsible for lawful collection, minimisation, instructions and information to individuals where required. The mandatory data protection terms and any applicable transfer instrument take priority over inconsistent general contract wording.