Between: Spectrum Glo Solutions ("Processor"), Barnsley, South Yorkshire, operating candiq at candiq.co.uk
And: The recruiter or hiring organisation creating an account on candiq ("Controller")
Effective: Upon account creation
1. Subject matter and duration
The Processor will process personal data on behalf of the Controller for the purpose of providing the candiq CV scoring and candidate ranking service. This agreement applies for the duration of the Controller's account.
2. Nature and purpose of processing
Processing candidate CV text and job description data to generate tech-assisted match scores and rankings. No other use of candidate data is made.
3. Categories of personal data
CV text (which may include name, contact details, employment history, education, skills, qualifications). Job description text. Generated scoring data.
4. Categories of data subjects
Job candidates whose CVs are submitted by the Controller.
5. Controller obligations
The Controller confirms that: (a) they have a lawful basis under UK GDPR to process candidate data before uploading it to candiq; (b) they will inform candidates that tech-assisted scoring is used in their recruitment process; (c) they will not use automated scores as the sole basis for hiring decisions; (d) they will respond to candidates exercising data subject rights in respect of candidate data.
6. Processor obligations
Spectrum Glo Solutions agrees to: (a) process candidate data only on documented instructions from the Controller (i.e., the scoring service); (b) ensure persons authorised to process data are bound by confidentiality; (c) implement appropriate technical and organisational security measures; (d) assist the Controller in fulfilling data subject rights requests within 30 calendar days; (e) delete or return candidate data on termination of the account; (f) provide the Controller with all information necessary to demonstrate compliance with this agreement.
7. Sub-processors
The Processor uses the following sub-processors:
- Supabase Inc (database hosting, USA, SCCs)
- Anthropic PBC (AI inference, USA, SCCs — CV text used for inference only, not retained for training)
- Sentry / Functional Software Inc (error monitoring, USA, SCCs — CV text redacted before transmission)
- Lovable AB (application hosting, Sweden, EU adequacy / SCCs)
8. International transfers
Where data is transferred outside the UK, appropriate safeguards are in place as detailed in Section 7.
9. Security
HTTPS/TLS for data in transit. Passwords hashed. Row-level security on database. Access restricted to authorised personnel.
10. Data breaches
The Processor will notify the Controller without undue delay upon becoming aware of a personal data breach affecting candidate data.
11. Governing law
This agreement is governed by the law of England and Wales.
Contact: mark.driver@spectrumglo.co.uk | ICO: CSN2702885
By creating a candiq account you confirm you have read and agree to this Data Processing Agreement.