Data processing addendum
Last updated 1 June 2026
Terms that apply when an employer uses XpressApply to process candidate data. This is prototype copy and not real legal text.
Roles
The employer is the controller of candidate data and XpressApply acts as a processor, handling data only on documented instructions.
Security
We apply technical and organisational measures suited to the risk, including encryption in transit and access controls for staff.
Subprocessors
We use a short list of vetted subprocessors and keep it current. See the subprocessors page for the live list.
Transfers
Where data moves outside its region, we rely on approved transfer mechanisms and keep records of where data is held.