Compliance

An overview of data processing and sub-processors.

This platform is part of a shared digital infrastructure used by education regions to manage candidate journeys, collaboration data, and reporting. Because integrations often involve handling personal data, it is important for developers and technical stakeholders to understand what data is processed and which infrastructure providers are involved.

Two formal annexes have been created as part of the data processing agreement (DPA) that accompanies the platform.

Annex 1: Categories of processed data

This annex provides a structured overview of:

• Categories of data subjects, such as candidates, users, and contacts.
• Types of personal data processed.
• Purposes of processing.
• The role of region-specific custom fields.

It reflects the actual data model exposed through the API (including candidate payloads, interactions, and configuration data) and should be consulted when designing integrations that store or transmit personal data.

Annex 2: Sub-processors

This annex lists the infrastructure providers that process data on behalf of the platform, including:

• The primary data platform used for storage and collaboration.
• The infrastructure that runs the API and its supporting services.
• Each provider’s purpose and scope of involvement.
• Data-hosting locations and transfer considerations.

Developers should be aware of these dependencies when performing security reviews, DPIAs, or internal compliance checks.