Data processing agreement

This data processing agreement ("DPA") forms part of the Arku terms of service between GHIJK
Ltd ("processor", "we") and the organisation using Arku ("controller", "you"). It applies whenever we process personal information on your behalf, and is intended to meet Article 28 of the UK GDPR and EU GDPR, the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988.

1. Scope

• Subject matter: providing Arku, an applicant tracking service.
• Duration: for as long as you use Arku, plus the deletion period in section 8.
• People concerned: candidates, referees, interviewers and the members of your team.

• Information: names, contact details, CVs and other files, answers to application questions, messages, notes, scores, interview times and the history of each application. Arku does not allow you to collect bank details or government identity numbers, and records only the status and date of a background check.

• Purpose: to store, display, search and send that information as you direct through Arku.

2. Your instructions

We process the information only on your documented instructions, which are these terms and the way you configure and use Arku. If we believe an instruction breaks data protection law, we will tell you.

3. Confidentiality

Everyone at GHIJK Ltd who can access your information is bound by confidentiality, and only accesses it when needed to support you or run the service.

4. Security

We keep appropriate technical and organisational measures in place, including encryption in transit and at rest, role based access, two factor authentication and passkeys for users, activity logging, backups and regular updates. The measures may improve over time but will not fall below this level.

5. Sub-processors

You authorise the sub-processors listed on our sub-processors page. We will give account owners at least 30 days' notice by email before adding or replacing one, so you can object on reasonable data protection grounds. If we cannot resolve your objection, you may end your subscription and receive a refund of any prepaid fees for the remaining period. We bind each sub-processor to obligations at least as protective as this DPA and remain responsible for them.

6. Location and transfers

Arku stores all customer data in the United Kingdom (London), including data about people in New Zealand, Australia and the United States. Where a sub-processor processes information outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.

7. Helping you

Arku lets you export a candidate's data, correct it, anonymise it and erase it. We will also help you, as far as is reasonable, to respond to requests from individuals, to carry out impact assessments and to consult regulators.

If we receive a request directly from one of your candidates, we will pass it to you and will not respond ourselves unless you ask us to.

8. Retention and deletion

Arku anonymises candidates automatically when your retention period ends, removing personal details and files and keeping only anonymous reporting history. When your account closes, we delete or anonymise your data within 90 days, apart from backups, which expire on their normal cycle, and any records we must keep by law.

9. Breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your information. We will give you the information you need to meet your own obligations to notify regulators and individuals.

10. Audits

We will make available the information reasonably needed to show that we meet this DPA, and will answer reasonable security questionnaires once a year. Where that is not enough, you may carry out an audit at your cost with 30 days' notice, during business hours and under confidentiality.

11. Liability and precedence

The limits of liability in the terms of service apply to this DPA. If this DPA and the terms of service conflict on the handling of personal information, this DPA applies.

Contact

Email privacy@arkuhq.com with any question about this agreement or to request a signed copy.