Data processing terms

These processing terms apply whenever you upload a CV containing personal data. You are the controller; ConnectIQ is the processor. They form part of our terms of service, so a separate signed agreement is not required to have them in place — though we will sign a copy on request at [email protected].

Article 28(3) requires the subject matter, duration, nature, purpose, data types and categories of data subject to be set out. They are:

• We process candidate personal data only on your documented instructions. Using the product is the instruction; we will tell you if we think an instruction breaches data protection law.
• Everyone with access is bound by confidentiality.
• We maintain the technical and organisational measures described in the privacy notice, appropriate to the risk.
• We engage sub-processors only under this general authorisation, impose equivalent obligations on them, and remain liable for their performance. The current list is in the privacy notice; we will give notice of additions so you can object.
• We assist you in responding to candidate rights requests, taking into account what the product itself lets you do — you can already export, correct and delete any record without asking us.
• We assist you with breach notification, data protection impact assessments and prior consultation, and will notify you without undue delay if we become aware of a personal data breach affecting your data.
• On termination we delete your data, or return it, at your choice. Exports are downloadable at any time before then.
• We make available the information needed to demonstrate compliance with these obligations and will contribute to audits. We do not hold a third-party audit report to offer in place of that.

Application data is stored in London. AI processing sends CV text to Google's Gemini API, which may run outside the UK, and payment data reaches Stripe. Each provider's own data processing terms apply automatically to our use of their API, which is how the Article 28 obligations in this document flow down to them; those terms also carry the transfer mechanism relied on.

Because ConnectIQ operates from the United Kingdom, Google's paid-services data terms apply to all of our Gemini API use whatever the tier: candidate CV text is not used to train or improve Google's products, and is logged only for a limited period for abuse detection and legal compliance.

If your engagement requires that no candidate data leave the UK at all, run at Format-only intensity. That mode makes no AI call, so the document is processed entirely on our London infrastructure.