Data Processing Terms

You, the BrightJobs account holder, are the controller of the personal data you enter about your own customers and staff. James Thomas trading as Bright Future Business Solutions is the processor of that data. For personal data about you as our customer (your contact and billing details) we are the controller, and our Privacy Policy applies instead.

We will:

• process the personal data only on your documented instructions, which include your use of the service, unless we are required to do otherwise by law;
• ensure that anyone authorised to access the data is bound by a duty of confidentiality;
• keep appropriate technical and organisational security measures in place (see section 6);
• help you respond to data subject requests and, so far as reasonable, with data protection impact assessments and consultations with the ICO;
• notify you without undue delay after becoming aware of a personal data breach affecting your data;
• on termination, delete or return your personal data in line with the retention terms in the Privacy Policy; and
• make available the information reasonably needed to demonstrate compliance with these terms.

You confirm that you:

• have a lawful basis for collecting and entering the personal data you put into BrightJobs;
• provide your own customers with the privacy information they are entitled to;
• only enter data that is necessary, and avoid entering special category data in free-text notes; and
• manage your own users’ access and remove staff accounts promptly when they leave.

You give general authorisation for the following sub-processors. We will tell you before adding or replacing a sub-processor so you have an opportunity to object.

We keep this list accurate and up to date. Where practicable, we will give you at least 30 days’ notice by email before a material new sub-processor, or a material change to an existing one, takes effect.

If you have a reasonable data-protection objection, email info@brightfbs.co.uk within the notice period, setting out your grounds. We will work with you in good faith to find a reasonable alternative or additional safeguard. If we cannot resolve the objection and the sub-processor is essential to providing the service, you may cancel your subscription before the change takes effect, and the cancellation terms in the Terms & Conditions apply.

Your data is hosted in the European Union, which is covered by the UK adequacy regulations. Some sub-processors are established outside the UK, and limited data may be transferred to them.

Where a transfer is made to a country without UK adequacy regulations, we rely on the standard contractual clauses together with the UK International Data Transfer Addendum as incorporated in that provider’s published data processing agreement. Full details of the safeguards for any provider are available on request.

Audit. On reasonable written request, and no more than once a year unless required by a supervisory authority or following a personal data breach, we will provide the information reasonably necessary to demonstrate compliance with these terms. Any on-site or more detailed audit must be agreed in advance, carried out at reasonable times without disrupting the service, and subject to confidentiality.

Liability. Liability under these terms is subject to the limitation of liability in the Terms & Conditions, which does not limit any liability that cannot lawfully be limited or excluded, and does not affect either party’s direct statutory responsibilities under UK GDPR.

Term. These terms apply for as long as we process personal data on your behalf, and end when your BrightJobs account ends. On termination we will delete or return your personal data in line with the retention terms in the Privacy Policy, except where we are legally required to keep it.

Data protection contact: info@brightfbs.co.uk. ICO registration ZA445319.