1. When this agreement applies

This Data Processing Agreement applies where a customer submits personal data to SwishrJobs as part of a job and that customer is a controller under the UK GDPR. In that case Swishr Digital Ltd acts as a processor for that personal data, and this agreement sets the terms of that processing.

The service is not designed for personal data. A customer who does not need to submit personal data should not submit it. This agreement exists for the case where a customer does.

2. Roles and scope

The customer is the controller and determines the purpose and lawful basis of the processing. The operator processes the personal data only to perform the job the customer ordered and to verify the result, and only on the customer's documented instructions, which are the job request and these terms.

3. What the operator does and does not do

• Processes the data only for the job and the verification of it.
• Does not sell the data or share it for advertising.
• Does not use the data to train models.
• Ensures the people and systems that can access it are subject to confidentiality.
• Takes the technical measures described in the Security and Incident Disclosure.

4. Sub-processors

The customer authorises the operator to use the sub-processors needed to run the service: the infrastructure host that runs the sandbox and the payment facilitator that verifies the authorisation. The operator will give notice of a change to these sub-processors and the customer may object. The operator remains responsible for its sub-processors' performance.

5. International transfers

Where processing involves a transfer outside the UK, the operator relies on an appropriate safeguard. The customer is responsible for confirming that its own instructions permit the transfer.

6. Assistance and rights

The operator will help the customer respond to data-subject requests and to any data-protection impact assessment, to the extent the customer cannot do so from the records the service keeps. Requests should go to hello@swishrjobs.com.

7. Security and breaches

The operator will notify the customer without undue delay after becoming aware of a personal-data breach affecting the customer's data, and will give the information the customer needs to meet its own notification duties. The customer is the controller and is responsible for notifying the ICO where the law requires it.

8. Deletion and return

On the customer's request, and once the job and its records are no longer needed for the operator's accounting and audit obligations, the operator will delete or return the customer's personal data. Where the operator must keep a record for a legal obligation, it will say so and keep only what the obligation requires.

9. Audit

The operator will make available the information reasonably needed to show compliance with this agreement. Because the operator runs the platform, a customer audit is limited to what can be shared without exposing other customers' data or the platform's security controls.