Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Basely Technologies Ltd ("Basely", "Processor") and the employer customer that has entered into a subscription agreement with Basely ("Customer", "Controller"). It applies whenever Basely processes personal data of the Customer's candidates on the Customer's behalf as part of the Basely service.

Subject matter: the provision of an AI-native technical assessment platform enabling the Customer to invite, assess, and evaluate job candidates.

Duration: this DPA remains in effect for as long as Basely processes candidate personal data on the Customer's behalf, and terminates automatically on termination of the underlying subscription agreement, subject to Section 8 (Deletion and Return of Data) below.

Basely processes candidate personal data to: deliver technical assessments (including AI-graded and AI-assisted assessment modes); record and score candidate performance and AI tool usage; detect policy violations (e.g. use of AI in a "no AI" assessment); generate feedback and match information for the Customer; and store submission and results data for the Customer's recruitment records.

Data subjects: job candidates invited by the Customer to complete an assessment on the Basely platform.

Categories of personal data: candidate name and email address; GitHub/LinkedIn profile data supplied by the candidate; code submitted during assessments; execution logs and quiz responses; AI conversation transcripts and AI usage/policy telemetry; proctor logs (tab-switch events, idle periods); video and audio recordings of proctored behavioural/interview sessions (no facial recognition or biometric identification is performed on these recordings); AI-effectiveness scores and feedback; and technical/usage data (IP address, session identifiers, timestamps).

Basely shall: (a) process candidate personal data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by UK or EU law; (b) ensure persons authorised to process the data are subject to confidentiality obligations; (c) implement appropriate technical and organisational security measures as described in Section 6 below; (d) assist the Customer, insofar as reasonably possible, in responding to data subject requests and in meeting its obligations under UK GDPR Articles 32–36 (security, breach notification, and impact assessments); (e) notify the Customer without undue delay after becoming aware of a personal data breach affecting candidate data, and no later than 72 hours after becoming aware where feasible; (f) at the Customer's choice, delete or return all candidate personal data at the end of the provision of services, subject to any legal retention requirement; and (g) make available to the Customer information reasonably necessary to demonstrate compliance with this Section and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice and confidentiality.

The Customer authorises Basely to engage the following sub-processors, each bound by written terms offering an equivalent level of data protection:

• Neon — managed PostgreSQL database hosting. Holds account, assessment, and application records.
• Stripe — payment processing for Customer billing (does not process candidate personal data).
• AI inference provider — AI-based assessment grading, feedback generation, and matching. Engaged only under a written data processing agreement; contractually prohibited from using submitted data to train its models; any change of provider is notified in advance with the right to object under Art. 28(2) UK GDPR. An itemised list of the current provider is available on request at privacy@basely.co.uk.
• Clerk — authentication and identity management.
• Resend — transactional email delivery.
• Upstash — rate-limiting infrastructure (production environments).
• Sentry — error tracking and session replay (with input masking). Receives error events, session identifiers, and session replay data (candidate inputs masked by default; blockAllMedia enabled to exclude media content).

Basely will give the Customer reasonable notice of any intended addition or replacement of a sub-processor, allowing the Customer to object on reasonable data-protection grounds.

Basely implements and maintains the following technical and organisational measures under Article 32 UK GDPR: TLS encryption in transit; encryption at rest for the database (via Neon); role-based access controls applied on the principle of least privilege; JWT-based session authentication; internal API secret headers on privileged endpoints; separation of vector embeddings from raw personal data; and audit logging of privileged actions.

Basely reviews these measures whenever it changes infrastructure or sub-processors. A current written summary of these measures is available to the Customer on request at privacy@basely.co.uk, and forms Annex II to this DPA.

Where Basely or a sub-processor transfers candidate personal data outside the United Kingdom, that transfer is made subject to a safeguard permitted by Chapter V UK GDPR: UK adequacy regulations where they apply (including the UK Extension to the EU–US Data Privacy Framework), or otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where one is required. The safeguard relied on for each sub-processor, and the location in which it processes data, is identified in the sub-processor list in section 5.

On termination of the subscription agreement, and subject to any legal obligation to retain data, Basely will delete or, at the Customer's written request made within 30 days of termination, return all candidate personal data processed on the Customer's behalf, and delete existing copies within a further 90 days.

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

Data protection queries relating to this DPA: privacy@basely.co.uk. Company: Basely Technologies Ltd, Durham Venture Lab, Durham University, Durham, DH1 3LE, UK.

Customers with bespoke data processing requirements should contact legal@basely.co.uk to negotiate a customer-specific DPA or Order Form addendum.