SelectionWise

2.1 Roles

For Customer Personal Data, Customer is the Controller and SelectionWise is the Processor. Each party will comply with its respective obligations under Applicable Data Protection Law.

2.2 Customer Responsibilities

Customer:

• shall ensure that it has all necessary rights, lawful bases, notices, and consents to enable SelectionWise to process Customer Personal Data as contemplated by the Agreement;
• is solely responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired it;
• shall not submit any Personal Data to the Platform that it is not authorised to share; and
• acknowledges that the Platform is not designed for the bulk processing of employee, candidate, or vendor records and shall avoid entering such records into free-text fields.

2.3 Subject Matter and Duration

The subject matter of the processing is the provision of the Platform under the Agreement. The duration of the processing is the term of the Agreement, plus any retention period set out in Section 10 (Return or Deletion).

2.4 Nature and Purpose of Processing

SelectionWise processes Customer Personal Data for the following purposes:

• providing the Platform and its features (account access, authentication, downloads, methodology content);
• managing the customer relationship, including billing, support, and account communications;
• maintaining the security, integrity, and availability of the Platform; and
• complying with legal obligations.

2.5 Categories of Personal Data

The Personal Data processed under this DPA typically includes:

• identification and contact data (name, email address, organisation name, job title);
• account and authentication data (hashed credentials, session tokens);
• usage data (login times, IP address, device information, pages accessed);
• billing data (limited to that necessary for invoicing; payment card data is processed directly by Stripe and not stored by SelectionWise); and
• any Personal Data that Customer or its Authorised Users voluntarily enter into free-text fields (notes, comments) within the Platform.

2.6 Categories of Data Subjects

The Data Subjects whose Personal Data may be processed under this DPA typically include:

• Customer's Authorised Users (employees, contractors, or other individuals authorised by Customer to access the Platform); and
• any other individuals whose Personal Data Customer or its Authorised Users choose to enter into the Platform.

4.1 Confidentiality

SelectionWise shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.2 Security Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of natural persons, SelectionWise implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include:

• Encryption in transit: TLS for all communications between client and Platform.
• Encryption at rest: Customer Personal Data is encrypted at rest at the storage layer (AES-256) by SelectionWise's hosting infrastructure.
• Access controls: Role-based access controls, multi-factor authentication for administrative access, and the principle of least privilege.
• Row-Level Security: Database-level isolation of Customer Personal Data between organisations.
• Logging and monitoring: System and access logs are retained and monitored for security events.
• Backups: Regular backups, encrypted at rest, with defined retention.
• Vendor management: Subprocessors are selected and assessed for their security posture.

SelectionWise shall review and, where appropriate, update these measures from time to time. SelectionWise may modify security measures provided that doing so does not materially reduce the level of protection.

4.3 Subprocessors

Customer provides general authorisation for SelectionWise to engage Subprocessors to process Customer Personal Data, subject to the following conditions:

• SelectionWise shall maintain a list of current Subprocessors (set out in Section 9 of this DPA) and shall provide at least 30 days' prior notice of any intended changes by updating this DPA on the website and notifying account administrators by email.
• Customer may object to a new Subprocessor on reasonable data protection grounds within 30 days of notice. If the parties are unable to resolve the objection, Customer may terminate the Agreement by providing written notice, and SelectionWise will refund pro-rata for the unused portion of the Subscription Period.
• SelectionWise shall enter into a written contract with each Subprocessor imposing data protection obligations no less protective than those in this DPA.
• SelectionWise remains fully liable to Customer for the performance of each Subprocessor's obligations.

4.4 Data Subject Rights Assistance

Taking into account the nature of the processing, SelectionWise shall assist Customer, by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests for exercising Data Subject rights (access, rectification, erasure, restriction, portability, objection).

If SelectionWise receives a Data Subject request relating to Customer Personal Data, SelectionWise will, where lawful to do so, forward the request to Customer without undue delay and will not respond to the request itself except on Customer's instructions.

4.5 Personal Data Breaches

SelectionWise shall notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent known at the time:

• the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned;
• the likely consequences of the Personal Data Breach;
• the measures taken or proposed to address the Personal Data Breach and mitigate its possible adverse effects; and
• contact details for further information.

SelectionWise will provide reasonable further information as it becomes available. SelectionWise's notification is not, and shall not be construed as, an acknowledgement of fault or liability.

4.6 Data Protection Impact Assessments and Consultations

SelectionWise shall provide Customer with reasonable assistance, taking into account the nature of the processing and the information available to SelectionWise, with any data protection impact assessments and prior consultations with supervisory authorities that Customer is required to carry out under Applicable Data Protection Law.

4.7 Records of Processing

SelectionWise shall maintain records of processing activities carried out on behalf of Customer in accordance with Article 30(2) of the UK GDPR. SelectionWise will make such records available to Customer on reasonable request to demonstrate compliance with this DPA.

4.8 Audit Rights

SelectionWise shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including by providing copies of independent third-party audit reports or certifications where available.

Where Customer reasonably considers that the information made available is insufficient, Customer may, on giving at least 30 days' prior written notice and not more than once in any 12-month period (except where required by a supervisory authority or following a Personal Data Breach), conduct an audit of SelectionWise's compliance with this DPA. Audits shall be carried out during normal business hours, shall not unreasonably interfere with SelectionWise's operations, and shall be subject to reasonable confidentiality obligations. The cost of any such audit shall be borne by Customer.

10.1 Order of Precedence

In the event of any conflict between this DPA and the Agreement in respect of the processing of Personal Data, this DPA prevails.

10.2 Amendments

SelectionWise may update this DPA from time to time, including to reflect changes in Applicable Data Protection Law, in the Subprocessor List, or in the Platform. SelectionWise will give at least 30 days' notice of material changes by email to account administrators. Continued use of the Platform after the effective date of changes constitutes acceptance.

10.3 Governing Law

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from this DPA, subject to the dispute resolution procedures in the Agreement.

10.4 Severability

If any provision of this DPA is held to be unenforceable, the remainder shall continue in effect.

10.5 No Third Party Rights

No third party has any rights under this DPA.