Data Processing Agreement
Between the customer named in the Jig account ("the Agency", the Controller) and Refract Technologies Ltd, trading as Jig, registered in England, company number 16914050, registered office 8 Alexandra Road, 1 Queens Road, Farnborough, Hampshire, GU14 6GS ("Jig", the Processor).
Version 1.0, 31 October 2026. This agreement forms part of the Jig Terms of Service and applies from the moment the Agency first sends a CV to the service. It is not negotiated individually; it is the same for every customer.
1. What this agreement covers
1.1 The Agency sends candidate CVs, and sometimes consultant notes about candidates, to Jig by email. Jig formats them into the Agency's own template and returns them by email, as a full CV or an anonymised profile. That is the only processing Jig does with candidate data.
1.2 The Agency is the Controller of the personal data in those documents. Jig is the Processor and acts only on the Agency's instructions. The instruction is the email itself: the address it is sent to and the notes it carries.
1.3 This agreement meets Article 28 of the UK GDPR. Where it conflicts with the Terms of Service on a data protection matter, this agreement wins.
2. The processing
| Subject matter | Formatting candidate CVs into the Agency's template; producing anonymised profiles; drafting a short profile paragraph from consultant notes when notes are supplied |
| Duration | For each CV, from receipt until deletion, no more than 7 days after delivery. For the agreement, the life of the Agency's subscription plus the deletion period |
| Nature | Automated extraction of text from the document, structuring it, rendering it into the template, checking the output, emailing it back. No human reads candidate documents in the ordinary course; see 6.3 for the exception |
| Purpose | Presenting the candidate to the Agency's clients in the Agency's house style |
| Data subjects | Candidates. Incidentally, the Agency's consultants (sender address, name) and third parties named in a CV (referees, previous employers) |
| Categories of data | Whatever the CV contains: name, contact details, work history, education, qualifications, skills, and anything else the candidate wrote. Jig does not ask for special category data or criminal records data but a CV may contain it (health, nationality, right to work, licences). Such data is processed only to render or, in anonymised mode, remove it |
3. Jig's obligations
3.1 Instructions. Jig processes candidate data only to deliver the service described in clause 2, and only as instructed by the email the Agency sends. Jig will tell the Agency if it believes an instruction breaks data protection law.
3.2 Confidentiality. Everyone with access to the systems that process candidate data (today: the director of Refract Technologies Ltd) is bound by a duty of confidence.
3.3 Security. Jig applies the measures in Schedule 1. In summary: processing and storage in the UK and EU only, encryption in transit and at rest, multi-factor authentication on every administrative account, no candidate content in logs, automatic deletion within 7 days.
3.4 Sub-processors. The Agency gives general authorisation for the sub-processors listed at usejig.co.uk/sub-processors (Schedule 2 at signing). Jig will post any change there and email the Agency's onboarding contact at least 30 days before a new sub-processor handles candidate data. If the Agency objects on reasonable data protection grounds and the parties cannot resolve it, the Agency may end the subscription with no further charge. Jig flows down the obligations in this agreement to every sub-processor and stays responsible for them.
3.5 Data subject rights. Jig holds nothing a candidate could ask for beyond the 7-day window. If a request reaches Jig, Jig will pass it to the Agency within 2 working days and help as reasonably needed.
3.6 Assistance. Jig will help the Agency meet its own obligations on security, breach notification, impact assessments and consultation with the ICO, so far as the help relates to Jig's processing.
3.7 Breach. If Jig becomes aware of a personal data breach affecting the Agency's candidate data, it will tell the Agency's onboarding contact within 48 hours of becoming aware, with what it knows, and update as it learns more. Jig will not notify the ICO or candidates on the Agency's behalf unless asked to.
3.8 Deletion. Source documents, intermediate files and outputs are deleted automatically no later than 7 days after delivery. On termination, anything still inside that window is deleted on the normal schedule; nothing else is retained. Jig keeps a job log for 12 months containing only: timestamp, Agency, sender address, file hash, outcome. It contains no candidate name or content. Jig does not provide a copy-back service at termination because it holds no data to return.
3.9 Audit. Once in any 12 months, the Agency may ask Jig to complete a written security questionnaire, which Jig will return within 10 working days. If the answers leave a reasonable concern unresolved, the Agency may audit on 30 days' notice, during business hours, at its own cost, under confidentiality, without access to other customers' data.
3.10 No other use. Jig does not use candidate data to train or improve any model, does not sell it, does not combine it across customers, and does not contact candidates.
4. The Agency's obligations
4.1 The Agency has a lawful basis to send Jig each candidate's data and has told candidates, in its own privacy notice, that it uses a formatting service.
4.2 Only the Agency's own staff, from the Agency's own email domain, send CVs. The Agency keeps its onboarding contacts current and tells Jig when someone leaves.
4.3 Consultant notes are the Agency's words. The Agency does not put more in them than the role needs.
4.4 The Agency reviews the returned document before sending it on. A drafted profile paragraph is labelled DRAFT for that reason.
5. International transfers
Processing takes place in the United Kingdom and the European Union. Model inference runs in AWS's EU regions. No candidate data is transferred to a third country. If that ever changes, Jig will treat it as a new sub-processor under 3.4 and put an IDTA or UK Addendum in place first.
6. Other terms
6.1 Liability follows the Terms of Service, except that nothing limits either party's liability for a breach of this agreement to less than the law allows.
6.2 Law. England and Wales. Courts of England and Wales.
6.3 Human access. No person at Jig reads candidate documents in normal operation. If a job fails in a way the system cannot resolve, a person may open that job to fix it; the access is logged and the document is deleted on the same 7-day schedule. The Agency is told when a job has gone to a person because the reply says so.
6.4 Changes. Jig may update this agreement to reflect changes in law or in the service, with 30 days' notice by email to the onboarding contact. Changes that reduce the Agency's protection need the Agency's agreement.
Schedule 1: Technical and organisational measures
- Location. Application, storage and mailbox in the UK (AWS London, Google Workspace Europe data region). Model inference in AWS EU regions via Amazon Bedrock, which stores no prompts or outputs and does not share them with the model provider.
- Encryption. TLS 1.2+ in transit. Provider-managed encryption at rest (AWS KMS, Google default encryption).
- Access. Multi-factor authentication on every administrative account. Least-privilege roles: the application identity can call the model and read its own storage and nothing else. No standing human access to job data; exceptional access is logged.
- Isolation. Each customer's template and each job's files are stored separately; the system never mixes customers' data in one job.
- Logging. Operational logs hold metadata only (timestamps, identifiers, outcomes). No candidate content, no document text, no prompts or model output.
- Retention. Automatic deletion of all job files and processed emails after 7 days, run daily. Job log 12 months, metadata only.
- Resilience. Encrypted daily backups of configuration and templates (not candidate data) in the same region. The inbound mailbox is the queue: if the service is down, no CV is lost; it is processed when service resumes.
- Change control. All code changes go through version control and automated tests before deployment. Deployments are automated; no hand edits in production.
- Personnel. One person operates the service. Confidentiality is a condition of that role. Devices used to administer the service are full-disk encrypted with screen lock and MFA.
- Incident response. Written procedure: contain, assess, notify the Agency within 48 hours, remediate, review.
- Model. Processing uses a commercially licensed language model under terms that prohibit training on customer data. Models that carry extended data retention are blocked in configuration.
Schedule 2: Sub-processors at signing
| Sub-processor | Role | Location | Data |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, storage, model inference (Amazon Bedrock, Anthropic Claude models) | UK (London) for hosting and storage; EU regions for inference | CVs, notes, outputs, during processing only |
| Google Cloud EMEA Ltd (Google Workspace) | The mailbox CVs are sent to and returned from | EU data region | CVs, notes, outputs, as email attachments, until the 7-day purge |
| Stripe Payments Europe Ltd | Subscription billing | EU/UK | The Agency's billing details only. No candidate data |
Current list, with changes dated: usejig.co.uk/sub-processors.