Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Quibench Terms of Service. Where you upload candidate CV data, you are the data controller and Quibench is your data processor. This DPA is intended to satisfy Article 28(3)–(4) of the UK GDPR and the EU GDPR. Where the controller is established in the EEA, the parties additionally adopt the European Commission's standard contractual clauses for controllers and processors (Implementing Decision (EU) 2021/915), which are incorporated by reference and prevail in case of conflict; the Annexes below provide the information those clauses require.

Processor: Quibench, operated by Katsiaryna Anikeich (sole trader), Poland (NIP: 5252963522). Controller: the customer accepting these terms.

Quibench processes candidate CV data to provide CV parsing, formatting, redaction and editing, for the term of your subscription. Details of the processing — categories of data subjects (job candidates), categories of personal data (identification/contact and CV content, which may include special-category data), and security measures — are set out in the Annexes below.

We process candidate personal data only on your documented instructions (this DPA, the Terms, and your use of the product), including as to international transfers, unless required by law. We do not process candidate data for our own purposes, and neither we nor our AI provider use it to train AI models.

Persons authorised to process the data are bound by confidentiality. We implement appropriate technical and organisational measures (Article 32) — see Annex II.

You give general authorisation for the sub-processors in Annex III. We will give reasonable advance notice of any addition or replacement, allowing you to object on reasonable data-protection grounds; we impose the same data-protection obligations on each sub-processor and remain liable for their performance.

Taking into account the nature of the processing, we assist you to: respond to candidate requests under Articles 12–22; ensure security (Article 32); notify personal-data breaches — we notify you without undue delay after becoming aware of a breach affecting your data (Articles 33–34); and carry out DPIAs / prior consultation (Articles 35–36).

On termination, at your choice we delete or return the personal data and delete existing copies, unless law requires storage. Deleting a CV, closing a workspace, or deleting the account erases the associated candidate data, including the underlying files. We make available the information necessary to demonstrate compliance and allow for and contribute to audits.

CV content is processed by Anthropic Claude models hosted on AWS Bedrock in AWS EU regions (EEA) — candidate CV data is not transferred outside the UK/EEA for AI processing. Some processing still involves transfers outside the UK/EEA — in particular global edge delivery via Cloudflare. These transfers rely on appropriate safeguards: the Standard Contractual Clauses and the UK Addendum, and, where applicable, the EU–US Data Privacy Framework.

• Data subjects: job candidates
• Personal data: identification & contact data (name, email, phone, links); CV content (employment, education, skills, free-text profile)
• Special-category data (Art 9): CVs may contain data revealing health/disability, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, political opinions, or sex life/sexual orientation, as included by the candidate. You are responsible for the Article 9(2) condition.

Encryption in transit (TLS 1.2+) and at rest (AES-256, managed by our cloud providers); workspace-scoped access isolation between customers; short-lived access tokens; EU-region storage (AWS Frankfurt / Supabase); managed backups; logging and monitoring; hard-deletion on request cascading to file storage.

Sub-processor change notice (6 July 2026): Anthropic is no longer a sub-processor. AI inference of CV content now runs on Anthropic Claude models hosted by Amazon Web Services (Amazon Bedrock) in AWS EU regions (EEA); candidate CV data is no longer transferred outside the UK/EEA for AI processing.

For DPA questions or to request a signed copy, contact [email protected].