Data processing agreement
When you request a reference, you are the controller and we are your processor. Article 28(3) of the GDPR requires that relationship to be written down. This is that document.
It is published rather than sent on request, and it forms part of the terms you accept when you open an account, so there is nothing to chase, sign or wait for before you can run your first reference. If your legal team needs it signed as a separate instrument, write to support@checkedwell.com and we will sign it.
- We process candidate and referee data only on your instructions, and never for our own purposes.
- We tell you about a personal data breach without undue delay, your 72 hours starts when we tell you, so this is the clause that matters most to you.
- We tell you before we add a sub-processor, and you can object.
- We help you answer the requests your candidates and referees make of you.
- At the end, we delete or return everything.
- The application and its database are in Australia, which has no adequacy decision, so transfers run on Standard Contractual Clauses. Files are held in storage that is not tied to one country. Section 9 is the honest version.
1. Who this is between
This agreement is between IHR Group sp. z o.o. (KRS 0000788567, NIP PL8883141067), of ul. Długa 61, 87-800 Włocławek, Poland (“we”, “us”, the processor) and the organisation that holds a CheckedWell account (“you”, the controller).
It takes effect when you open an account and lasts as long as we hold personal data for you. Where it conflicts with the terms of service, this document wins on anything to do with personal data.
2. Which of us is which
You are the controller of candidate and referee personal data. You decided to seek the reference, you chose the questions, you decide who sees the report and how long it is kept. The obligation to have a lawful basis and to tell the candidate is yours, and nothing we do discharges it.
We are your processor for that data. We act on your instructions and we do not use it for any purpose of our own.
Separately, we are the controller of your account holders' data, names, work emails, sign-in records, the audit trail and billing contacts, because those decisions are ours. That is covered by our privacy policy, not by this agreement.
3. We process only on your instructions
We process personal data only on your documented instructions, including about transfers to a third country. Your instructions are: this agreement, the terms, the settings you choose in the product, and anything else you tell us in writing. Using the product is an instruction, requesting a reference instructs us to send it, chase it and produce the report.
If we think an instruction breaks data protection law, we will tell you rather than quietly carrying it out or quietly refusing (Article 28(3), final paragraph). Where the law requires us to process without your instruction, we will tell you before we do, unless that law forbids it.
4. Confidentiality
Everyone we authorise to handle your data is under a binding duty of confidentiality, and access is limited to those who need it to run the service or to help you when you ask. We do not sell personal data, we do not share it between agencies, and we do not use it to train artificial intelligence models, ours or anybody else's.
5. Security
We implement appropriate technical and organisational measures under Article 32. They are listed in Annex 2 below, and they are specific rather than reassuring, a list of adjectives is not a security measure.
We may change them, but not in a way that materially reduces protection. What we have not done is on the security page and kept current.
6. Sub-processors
You give us general written authorisation to engage the sub-processors in Annex 3. We impose the same data protection obligations on each of them by contract, and we remain fully liable to you for what they do.
Before we add or replace one, we will give you at least 30 days' notice by email to your account owner. If you object on reasonable data protection grounds within that period, we will work with you to find a solution, and if we cannot, you may terminate without penalty and we will refund the unused portion of any prepaid fees. Notice before the fact is the point, being told afterwards is not authorisation.
7. Helping you answer your candidates and referees
Taking into account the nature of the processing, we help you meet your obligation to respond to requests under Articles 15 to 22, access, rectification, erasure, restriction, portability and objection. The product does most of this itself: you can export, correct and delete without asking us.
If a candidate or referee comes to us directly, we will not answer for you. We will tell them to approach you, and tell you promptly that they did.
8. Breaches, and the clause that matters most
We notify you of a personal data breach affecting your data without undue delay after becoming aware of it, and in any event within 48 hours. Your own 72-hour deadline to the supervisory authority starts when we tell you, which is why we commit to a number rather than to a phrase.
We will tell you what happened, when, what data and roughly how many people are affected, what we have done and what we recommend, including the parts that are unflattering, and including what we do not yet know rather than waiting until we know everything. We do this whether or not the breach meets any threshold for notifying a regulator.
We also assist you with Articles 32 to 36, security, breach notification to individuals, data protection impact assessments and prior consultation, taking into account the information available to us.
9. Where the data goes
The application and its database, including its backups, run in Australia. Files, meaning finished reports, agency logos and data exports, are held in Laravel Cloud's object storage, which runs on Cloudflare R2 and is not tied to a single country. Australia has no adequacy decision from the European Commission or the UK.
That does not make the transfer unlawful; it makes it one that needs safeguards. Where UK or EU personal data is transferred to a country without adequacy, it is transferred under the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Three where we are transferring as your processor to a sub-processor, together with the UK International Data Transfer Addendum where UK data is involved. Those clauses are incorporated into this agreement by reference, and the annexes below populate their annexes.
We maintain a transfer risk assessment covering Australian government access, and we will provide it on request. If a clash between the clauses and this agreement ever arises, the clauses win.
10. Deletion and return
You can export your data at any time, on any plan, without asking us. When this agreement ends you have 30 days to export, and after that we delete it, references, answers, files and audit records, subject only to backups, which age out on their own cycle, and to anything we are required by law to keep.
Deleting your organisation in the product does the same thing immediately, and we will confirm in writing if you ask.
11. Showing you we are doing this
We make available the information you reasonably need to demonstrate compliance with Article 28, and we allow and contribute to audits, including inspections, conducted by you or an auditor you appoint.
In practice: ask, and we will answer questionnaires and provide our documentation. An on-site inspection is available once a year with 30 days' notice, or at any time after a breach affecting your data. We would rather you asked than assumed.
12. Which law
This agreement is governed by the same law as the terms of service, except where the Standard Contractual Clauses require the law of an EU member state, in which case that law governs the clauses.
Annex 1, What we process, and for whom
Collecting employment references on your behalf, for as long as you hold an account, plus the retention period you set, 7 years by default, and you can set it shorter.
Collection, storage, organisation, retrieval, disclosure to you and to the client you nominate, and erasure, for the purpose of obtaining, recording and reporting employment references.
- Candidates, the people being referenced.
- Referees, the people asked to give the reference.
- Candidate: name, email, phone, the role being checked, relevant employment history, referees nominated, and everything referees say about them.
- Referee: name, email, phone, employer, job title, relationship to the candidate, answers including free text, whether they declined and any reason.
- Technical: date, time and IP address of a referee's submission, recorded so a reference can be shown to be genuine if it is disputed.
None is requested. Our question sets ask nothing within Article 9 or Article 10, and your own question sets should not either. If a referee volunteers something of that kind it is stored as part of their answer, encrypted like every other answer, visible only to you, and not indexed or acted on.
Annex 2, Security measures
The Article 32 measures, stated specifically enough to be checked.
- Encryption at the column, not just the disk. Candidate and referee names, email addresses, phone numbers and free-text answers are individually encrypted, so a stolen backup is not a readable list of people.
- Two independent isolation mechanisms. The application scopes every query to the signed-in agency; underneath, PostgreSQL row-level security refuses to return another agency's row at all.
- Referee links stored only as a one-way hash, expiring after fourteen days, revoked when a referee is removed or a request cancelled. A copy of our database yields no working links.
- Passwords hashed with Argon2id. Two-factor authentication mandatory for owners and directors.
- An append-only audit log recording who requested, sent, read and exported what, which cannot be quietly tidied, including by us.
- TLS in transit, encryption at rest, and database backups held in the same jurisdiction as the database.
- Access on a need-to-know basis under binding confidentiality, with administrative access recorded in the same audit log.
What we have not done, kept current on the security page: we are not ISO 27001 or SOC 2 certified and we have no penetration test report to send you. We are a new product, and saying otherwise would be a lie you could check.
Annex 3, Sub-processors
The complete list. Thirty days' notice before we add or replace one, per section 6.
| Who | What they process | Where |
|---|---|---|
| Laravel Cloud, application, database, backups | Everything | Australia |
| Laravel Cloud object storage, on Cloudflare R2, files | Finished reports, agency logos and data exports | Not tied to one country |
| Google Cloud Run, PDF rendering | The content of a report, while it is turned into a PDF | Australia |
| Postmark (ActiveCampaign), email delivery | The content of emails: names, the invitation, the link | United States |
| Cloudflare Turnstile, bot protection on public forms | A challenge token and IP address. No reference content. | Global |
| Anthropic, the help chat for signed-in users | What a user types into the help chat | United States |
| Anthropic, call-note drafting, only if you enable it | Only the call notes a consultant chooses to submit | United States |
| Anthropic, CV reading in PresentWell, only if you use it | The CV a consultant uploads, read once to format it | United States |
Call-note drafting is off unless you switch it on, and CV reading happens only when a consultant uses PresentWell. The help chat is available to every signed-in user and needs no candidate details to answer a question. Anthropic does not use any of this to train its models.
Questions
support@checkedwell.com. A real person reads it, and a question about this document reaches somebody who can answer it rather than a form.