Data Processing Agreement

When a customer uses quizego to assess candidates, the customer is the controller of the personal data involved and quizego is its processor. This agreement sets out the terms required by Article 28 of the UK GDPR and the EU GDPR, and forms part of the Terms of Service. If they conflict on personal data, this agreement wins.

It does not cover personal data quizego handles for its own purposes, such as account holders' contact details for billing and service emails, the sample test, or the talent pool, where quizego is the controller — those are described in our privacy notice.

• Subject matter and purpose: providing the quizego service — creating assessments, inviting candidates, delivering tests, scoring, grading and reporting results.
• Duration: for as long as the customer has an account, plus the deletion period in section 11.
• Data subjects: candidates the customer invites; the customer's own users.
• Personal data: names and email addresses; answers, including written answers; time taken and timestamps; scores, grades, notes and hiring stages the customer records; talent-pool results a candidate chooses to share with the customer.
• Special category data: none is required. Customers should not ask candidates for it in tests they write.
• Nature of processing: collection, storage, scoring, display, export, email delivery and deletion.

We process customer personal data only on the customer's documented instructions. The Terms, this agreement and the customer's use and configuration of the service are those instructions. If the law requires us to process it otherwise, we will tell the customer first unless the law forbids it. We will tell the customer if we think an instruction breaks data-protection law.

Everyone at quizego who can access customer personal data is bound by confidentiality, and has access only where needed to run or support the service.

We keep appropriate technical and organisational measures in place to protect customer personal data, including:

• encryption in transit (HTTPS) for all traffic, and encryption at rest by our hosting providers;
• application and database hosted in the UK (London);
• each customer's data separated by organisation, with every request checked against the signed-in user's organisation and role;
• passwords stored only as salted hashes (bcrypt), and sessions held in secure, HTTP-only cookies;
• rate limits on sign-in and public forms;
• candidate links that are long, random and specific to one invitation;
• access to production systems limited to the people who run the service.

We review these measures as the service changes and may improve them without notice.

The customer authorises quizego to use the sub-processors below. We have written terms with each that protect personal data at least as well as this agreement, and we remain responsible for them.

We will give at least 30 days' notice, on this page and by email to account owners, before adding or replacing a sub-processor. The customer may object on reasonable data-protection grounds; if we cannot address the objection, the customer may end the affected service and receive a refund of prepaid fees for the unused period.

Customer personal data is stored in the UK. Where a sub-processor may access it from outside the UK or EEA — for example, email delivery through Resend in the USA — the transfer is covered by an adequacy decision (such as the UK–US data bridge, for certified companies) or by the standard contractual clauses with the UK International Data Transfer Addendum.

Taking into account the nature of the processing, we will help the customer to:

• respond to requests from people exercising their rights — the product lets customers find, export and correct candidate data, and we will help with anything it cannot do. If a request reaches us directly, we will pass it on and not answer it ourselves;
• meet its security obligations;
• carry out data protection impact assessments and consult regulators where needed.

We will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data. We will share what we know — what happened, the data and people likely affected, likely consequences, and what we are doing about it — and update the customer as we learn more.

We will make available the information reasonably needed to show we comply with this agreement, and answer reasonable security questionnaires. Where that isn't enough, the customer may carry out an audit, or have an independent auditor do so, once a year, with 30 days' notice, during business hours, at its own cost and under confidentiality.

The customer can export its results at any time while it has an account. When the account ends, or when the customer asks us in writing to delete its data, we will delete customer personal data within 30 days, unless the law requires us to keep it. Encrypted backups held by our providers expire on their normal cycle and are not restored except to recover the service.

Customers decide how long to keep candidate data while they use the service, and should delete what they no longer need.

The customer is responsible for having a lawful basis for inviting and assessing candidates, for giving them the information data-protection law requires — including that it uses quizego — and for the accuracy of the data it enters and the lawfulness of its instructions.

Liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow a limit. This agreement applies for as long as we process personal data for the customer, and survives the end of the Terms until that data is deleted. Customers who need a countersigned copy can ask at contact@quizego.com.