Data processing agreement

1. Scope

This data processing agreement (DPA) applies whenever Simple Things Limited (Simple Things, we) processes personal data on behalf of a client (you) to provide Roleline under our terms of service or another signed agreement. It is written to meet Article 28 of the UK GDPR and, where your processing is subject to it, Article 28 of the EU GDPR.

You may rely on this DPA as published, or ask us for a signature copy. On data protection matters this DPA prevails over the terms of service. A DPA signed by both of us prevails over this published version.

Terms such as controller, processor, personal data, personal data breach and data subject have the meanings given in the UK GDPR.

2. Roles

You are the controller of personal data processed through your Roleline assistant, including anything a candidate or visitor types into it. We are your processor. We process that data only to provide the service to you and on your documented instructions.

If you are an agency, consultancy or other intermediary buying Roleline for an employer, you confirm that you have the employer's authority to appoint us, that your agreement with the employer allows this processing and that you will pass the employer's instructions to us. In that case we act as your sub-processor and the obligations in this DPA still apply between you and us.

We are an independent controller for the business contact details of your staff and for our own records. Our privacy notice covers that processing.

3. Details of the processing

Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects. Your order form and the configuration you approve for your assistant are part of your documented instructions.

4. Our obligations as your processor

Instructions. We process personal data only on your documented instructions, including for transfers outside the UK, unless the law requires otherwise. If the law requires us to process differently we tell you first where we are allowed to. If we think an instruction infringes data protection law we tell you before acting on it.
People. Everyone we authorise to process your personal data is bound by a duty of confidentiality and receives appropriate training.
Security. We implement the technical and organisational measures summarised in Annex 2 and described in more detail in our security and data handling overview, and we keep them under review. Where we change a measure in a way that materially reduces protection, we tell you first.
Sub-processors. We engage other processors only as set out in section 5.
Data subject requests. Taking into account the nature of the processing, we help you respond to requests from data subjects. If a request reaches us directly we pass it to you within five working days and do not answer it ourselves unless you ask us to.
Assistance. We help you meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority, taking into account the information available to us.
End of processing. We delete or return personal data as set out in section 8.
Information and audit. We make available the information needed to demonstrate compliance and allow audits as set out in section 9.
Records. We keep a record of the processing we carry out for you.

5. Sub-processors

You give us general authorisation to use the sub-processors listed on our sub-processor page. Each sub-processor is bound by a written contract that imposes data protection obligations no less protective than this DPA, and we remain responsible to you for their performance.

Before a new sub-processor processes your personal data we update that page and give care plan clients at least 30 days' written notice. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate the affected service on written notice without penalty for the remaining term.

6. International transfers

Where your assistant runs on our AWS regional delivery, its runtime, conversation storage, encryption keys and model inference through Amazon Bedrock are configured to run in the AWS London region in the United Kingdom, with no cross-region inference, replication or fallback, so that this processing takes place in the United Kingdom. This regional configuration does not extend to AWS account, billing and service-management metadata, or to the network route that encrypted traffic takes between a visitor's browser and the service.

Our sub-processors operate global infrastructure and some are headquartered in the United States. Where personal data is transferred outside the United Kingdom or the European Economic Area we ensure a lawful transfer mechanism applies, such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU standard contractual clauses, including through the transfer terms in each sub-processor's own data processing agreement. We give you the details of the mechanism relied on for a particular transfer on request.

7. Personal data breaches

If we become aware of a personal data breach affecting your personal data we notify you without undue delay and in any event within 24 hours of becoming aware of it. The notification describes what we know about the nature of the breach, the data and data subjects likely to be affected, the likely consequences and the measures taken or proposed. We update you as we learn more and cooperate with your investigation.

We do not notify the Information Commissioner, another supervisory authority or data subjects on your behalf unless you ask us to in writing.

8. Deletion and return

In standard configuration, conversation state held for a live assistant is deleted seven days after a conversation starts. On the AWS regional delivery that period is 72 hours. Analytics hold only fixed categories and counts, never conversation content.

When the service ends, or earlier on your written instruction, we delete the personal data we hold for you or return it to you, and delete remaining copies, within 30 days, unless the law requires us to keep it. Deleted data may remain in a provider's recovery systems for a limited period afterwards. On the Cloudflare-hosted delivery, Cloudflare's point-in-time recovery for the storage we use covers up to 30 days, and Anthropic deletes API inputs and outputs within 30 days as standard. Those windows are described on our security page and we do not restore data from them except to recover from a failure. On the AWS regional delivery, conversation storage is configured without point-in-time recovery or replicas.

9. Information and audits

We answer reasonable written requests for information about our processing within 30 days. Once in any 12-month period, or following a personal data breach, you or an independent auditor bound by confidentiality may audit our compliance with this DPA on at least 30 days' written notice, during business hours, with a scope agreed in advance and at your cost. We first provide documentation and answers to questions, and an on-site or remote inspection takes place only where those are insufficient. Where a sub-processor provides an independent audit report or certification, we rely on that report for the sub-processor's part of the processing.

10. Liability and term

Each party's liability under this DPA is subject to the liability provisions of the terms of service or the signed agreement between us. This DPA applies for as long as we process personal data on your behalf, and the obligations in section 8 survive its end.

Annex 1. Details of the processing

Subject matter: Operating a conversational careers assistant on your behalf that answers candidate questions from content you have approved.
Duration: The term of the agreement, plus the deletion period in section 8.
Nature and purpose: Receiving questions typed into your assistant, generating answers from approved content with a language model, holding short-term conversation state so a conversation can continue, producing aggregate content-free usage reporting, and administering your deployment.
Types of personal data: Anything a candidate or visitor chooses to type into the assistant, which may incidentally include personal data even though the assistant does not ask for it; technical data such as IP addresses processed in transit by our hosting provider; pseudonymous session identifiers; and the names, work email addresses and access identities of your staff who administer or approve the assistant.
Special category data: Not intended. The assistant is configured not to invite health, disability, ethnicity, religion, sexual orientation, trade union or similar information, and no such characteristic is inferred or recorded in analytics. If a visitor volunteers it, it is held only within the conversation state described above.
Categories of data subjects: Candidates and other visitors who use your assistant; your staff who administer, review or approve it; and, where you are an agency, staff of the employer you act for.

Annex 2. Technical and organisational measures

The measures below summarise the security and data handling overview, which is the fuller description and is updated as the service develops.

Each client's assistant runs as its own isolated deployment with its own address, secrets and storage. No client can address another client's data.
Personal data is encrypted in transit using TLS and encrypted at rest by our hosting provider. Client-supplied credentials are additionally encrypted at the application level.
Administrative access is limited to named people, protected by Cloudflare Access with an identity provider, and checked again by the application on every request.
Conversation state is held for a fixed short period and then deleted. Analytics are limited to fixed categories and counts with no conversation content and with small-number suppression in reports.
On the Cloudflare-hosted delivery, model requests are made through a gateway configured not to log request or response content, to a provider that does not train on customer content. On the AWS regional delivery, model requests go directly to Amazon Bedrock in the London region with invocation logging turned off.
Each version of an assistant is an immutable, digest-verified release. Going live is a separate recorded decision, and a previous version is retained for rollback.
Personal data breach handling, sub-processor due diligence and the notification commitments in this DPA are part of how we operate the service.

Contact

Roleline is a trading name of Simple Things Limited, a company registered in England and Wales with company number 09915018. Registered office: 86-90 Paul Street, London, England, EC2A 4NE.

Write to hello@simplethin.gs or post to Simple Things Limited, 86-90 Paul Street, London, England, EC2A 4NE.

How we process personal data on your behalf.