Data Processing Agreement

When Protu processes personal data on your behalf — your employees’ and candidates’ assessment data and the insights generated from it — we do so as a processor under a Data Processing Agreement that meets the requirements of UK GDPR and EU GDPR Article 28. You remain the controller of that data.

What the DPA covers

• The scope, nature and purpose of processing, and the categories of data and data subjects involved
• Our obligations as processor: to act only on your documented instructions, to keep the data confidential, and to secure it
• Our current sub-processors, and how we notify you before they change
• International transfer safeguards, including Standard Contractual Clauses where they apply
• Assistance with data-subject requests, breach notification, audit rights, and the return or deletion of data when our agreement ends

Request the DPA

We provide our DPA to customers and prospective customers on request. Email support@protu.io and we’ll send you the current version to review and sign. For the detail behind it, see how we handle and secure data on Security and Privacy.