Data Processing Agreement
Version draft-2026-05-19
This is a placeholder. The final text will be drafted by qualified counsel before public launch. When it lands, the DPA_VERSION string changes and every employer will be asked to re-accept on next visit.
1. Parties and scope
This Data Processing Agreement ("DPA") is entered into between Career Bloom ("Processor") and the Employer accepting these terms ("Controller"). It governs the processing of personal data relating to candidates who apply to the Controller's job postings through the Career Bloom platform.
2. Roles
Career Bloom is the data controller for its own purposes (operating the platform, generating match scores, security, fraud prevention). When the Employer accesses candidate data through Career Bloom to evaluate an application, the Employer is the data controller for that decision-making activity and uses Career Bloom as a sub-processor where applicable.
3. Purpose limitation
The Employer may use candidate data only for evaluating the specific application to which it relates. The Employer shall not retain unsuccessful candidate data beyond the period strictly necessary for legitimate legal-claims purposes (typically up to six years for UK/EU employment law), and shall not use candidate data for any other purpose without separate explicit consent from the candidate.
4. Confidentiality and security
The Employer shall keep candidate data confidential, shall not disclose it to third parties (other than as strictly necessary for the recruitment process), and shall apply appropriate technical and organisational measures to protect it.
5. Sub-processors
The Employer may not engage further sub-processors to handle candidate data accessed through Career Bloom without Career Bloom's prior written consent.
6. Data subject rights
The Employer shall promptly inform Career Bloom of any data subject access request, deletion request, or other rights request received in respect of candidate data so that Career Bloom can coordinate the response.
7. Breach notification
The Employer shall notify Career Bloom without undue delay (and in any event within 24 hours) of any actual or suspected personal data breach involving candidate data accessed through the platform.
8. Term and termination
This DPA takes effect on acceptance and remains in force for as long as the Employer holds an account on Career Bloom. On termination, the Employer shall delete or return all candidate personal data within 30 days.
9. Governing law
This DPA is governed by the laws of England and Wales unless an alternative jurisdiction is agreed in the Employer Terms of Service.