Data processing agreement for schools and employers

1. The parties

The controller is the school, academy trust, nursery, college, local authority or agency using SchoolJobs to recruit ("you").

The processor is SchoolJobs, operated by [Company name, number and registered address] ("we").

2. What we process and why

Subject matter: hosting, storing and displaying job applications you receive, and the recruitment tools you use (notes, ratings, interview arrangements, references and safer-recruitment checks).

Duration: for as long as you use SchoolJobs, then as set out in section 9.

Data subjects: people who apply for your vacancies, their referees, and your own staff who use the account.

Personal data: contact details, right-to-work answers, qualifications, employment history and gap explanations, references, supporting statements, CVs, criminal-records declarations, interview arrangements and your team's notes and check records.

Special category and criminal offence data: criminal-records self-declarations and any health information a candidate chooses to give. Equal-opportunities monitoring answers are never shown to you.

3. Our obligations

• We only process the data on your documented instructions, which are given by how you use SchoolJobs, unless the law requires otherwise (we will tell you first unless the law forbids it).
• Everyone who can access the data is bound by confidentiality.
• We keep appropriate technical and organisational security measures in place (section 6).
• We help you respond to requests from candidates exercising their rights.
• We help you meet your security, breach-notification and data protection impact assessment duties.
• We give you the information you reasonably need to show compliance and allow reasonable audits, on reasonable notice.

4. Sub-processors

You give general authorisation for us to use sub-processors for hosting and database services, email delivery and (once switched on) card payments. We will keep a current list available on request and tell you before adding or replacing one, so you can object. Each sub-processor is bound by data protection terms no less protective than these.

5. International transfers

If any personal data is transferred outside the UK, we will make sure a lawful transfer mechanism is in place, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

6. Security

• Encryption in transit and at rest.
• Access controls so only members of your verified team can see your applications.
• Employer notification emails contain a link only, never candidate personal data.
• Audit logging of team actions on applications.
• Separation of test data from real data.

7. Personal data breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own reporting duties.

8. Your obligations

• You make sure you have a lawful basis for recruitment processing and give candidates your own privacy information.
• You only add accurate data and only invite team members who need access.
• You handle any data you download or export securely.

9. Deletion and return

Applications are kept for the period set out in our privacy notice and then deleted. When you stop using SchoolJobs, you can export your data first; we then delete or return it unless the law requires us to keep it. Copies kept as evidence of a submitted application are retained only as set out in our privacy notice.

10. Contact

Questions about this agreement: support@schooljobs.uk. We reply within one working day.