This platform is part of a shared digital infrastructure used by education regions to manage candidate journeys, collaboration data, and reporting. Because integrations often involve handling personal data, it is important for developers and technical stakeholders to understand what data is processed and which infrastructure providers are involved.

Two formal annexes have been created as part of the data processing agreement (DPA) that accompanies the platform.

Annex 1 — Categories of processed data

This annex provides a structured overview of:

• the categories of data subjects (e.g. candidates, users, contacts)

• the types of personal data processed

• the purposes of processing

• the role of region-specific custom fields

It reflects the actual data model exposed through the API (including candidate payloads, interactions, and configuration data) and should be consulted when designing integrations that store or transmit personal data.

Read Annex 1

Annex 2 — Sub-processors

This annex lists the infrastructure providers that process data on behalf of the platform, including:

• the primary data platform used for storage and collaboration

• the infrastructure used to run the API and supporting services

• the purpose and scope of each provider’s involvement

• data hosting locations and transfer considerations

Developers should be aware of these dependencies when performing security reviews, DPIAs, or internal compliance checks.

Read Annex 2