Data Processing Agreement

Last updated: 8th Aug 2025

This Data Processing Agreement (“DPA”) forms part of the Terms of Use between Slate (“we”, “us”, “our”) and You (“Controller”, “You”, “Your”).

By registering a Slate account, or by accessing or using the Platform, You enter into this DPA. This DPA applies automatically to all processing of Candidate Data carried out through the Platform.

1. DEFINITIONS

  • Applicable Data Protection Law – The UK GDPR, the Data Protection Act 2018, and any other applicable data protection and privacy laws.

  • Candidate Data – Resumes and any related personal data of candidates uploaded by You to the Platform.

  • Customer Data – All data uploaded or submitted by You to the Platform, including Candidate Data.

  • DPA – This Data Processing Agreement.

  • Platform – Slate’s web application at https://app.slate.cv, including all tools, features, AI processing, and related functionality as defined in the Terms of Use.

  • Subprocessor – Any third-party processor engaged by Slate to support delivery of the Platform.

  • Terms of Use – Slate’s Platform Terms of Use, which incorporate this DPA.

  • You / Your – (1) the organisation for which a Slate account is created, and (2) the respective Users authorised to access the Platform on Your organisation’s behalf, as appropriate.

2. ROLES OF THE PARTIES

2.1 You as Controller – You determine the purposes and means of processing Candidate Data and remain fully responsible for:
a. ensuring all Candidate Data is accurate, lawful, and processed in compliance with applicable data protection laws;
b. obtaining and maintaining all legally required consents and notices for processing Candidate Data;
c. ensuring that Candidate Data does not include special categories of data or regulated data unless expressly permitted by law and by Slate in writing.

2.2 Slate as Processor – Slate acts solely as a processor in respect of Candidate Data and will process Candidate Data only on Your documented instructions and as required to provide the Platform.

3. SUBJECT MATTER, NATURE, AND PURPOSE OF PROCESSING

3.1 Subject Matter – Candidate Data uploaded to the Platform by You.

3.2 Nature of Processing – Collection, formatting, storage, AI-assisted transformation, and secure delivery of Candidate Data.

3.3 Purpose of Processing – To provide the Platform’s resume formatting and related features as described in the Terms of Use.

3.4 Duration of Processing – For the duration of Your Slate subscription, account validity, and according to Your retention settings.

4. CATEGORIES OF DATA SUBJECTS AND DATA TYPES

4.1 Data Subjects – Candidates whose data is uploaded to the Platform.

4.2 Data Types – Resumes and related employment information, which may include identifiers, employment history, education, and professional qualifications. The Platform is not intended for special category or regulated data unless explicitly authorised.

5. PROCESSOR OBLIGATIONS

Slate will:

5.1 process Candidate Data only on Your documented instructions;

5.2 ensure all personnel authorised to process Candidate Data are bound by confidentiality obligations;

5.3 implement appropriate technical and organisational measures to protect Candidate Data;

5.4 notify You without undue delay of any personal data breach affecting Candidate Data;

5.5 assist You, where technically feasible, with data subject requests under Applicable Data Protection Law;

5.6 assist You in ensuring compliance with data security, breach notification, and data protection impact assessment obligations;

5.7 delete or return Candidate Data upon termination of the Platform in accordance with Your retention settings;

5.8 provide information necessary to demonstrate compliance and allow audits, subject to reasonable notice, confidentiality, and frequency limitations.

6. CONTROLLER OBLIGATIONS

6.1 You remain solely responsible for determining the lawful basis for processing Candidate Data and for ensuring all required consents and notices have been obtained.

6.2 You warrant that Candidate Data will not include special category or regulated data unless explicitly permitted by law and processed in compliance with all requirements.

6.3 Slate is not responsible for verifying the legality of Candidate Data or consents, and accepts no liability arising from Your failure to comply with Applicable Data Protection Law.

7. SUBPROCESSORS

7.1 You authorise Slate to engage the following subprocessors:

  • Vercel Inc. – managed services; data encrypted in transit and at rest.

  • Supabase Inc. – managed services; data encrypted in transit and at rest.

  • Anthropic PBC – AI processing; data encrypted in transit and at rest.

  • Cloudflare, Inc. - managed services; where data transits through Cloudflare, appropriate encryption and security measures are applied.

7.2 Slate will inform You of any intended changes regarding subprocessors.

8. INTERNATIONAL DATA TRANSFERS

8.1 Where Candidate Data is transferred outside the UK or EEA, Slate will ensure appropriate safeguards are in place in accordance with Applicable Data Protection Law.

9. SECURITY

9.1 Slate will implement and maintain reasonable technical and organisational measures to protect Candidate Data, including encryption, access controls, logical separation, monitoring, and patch management.

10. DATA RETENTION AND DELETION

10.1 Original Candidate Data is not stored by Slate except as required for processing.

10.2 Reformatted Candidate Data is encrypted and retained according to Your retention settings.

10.3 Upon termination of the Platform, all Customer Data will be deleted unless retention is required by law.

11. DATA SUBJECT RIGHTS

11.1 Slate will assist You, where technically feasible and legally permitted, in responding to requests from data subjects exercising rights under Applicable Data Protection Law.

12. LIABILITY

12.1 The limitations and exclusions of liability in the Terms of Use apply equally to this DPA.

12.2 Slate has no liability for Your failure to comply with Applicable Data Protection Law, including failure to obtain lawful basis, consents, or notices, or for Candidate Data uploaded in breach of law or outside the intended scope of the Platform.

13. GOVERNING LAW AND JURISDICTION

13.1 This DPA is governed by the laws of England and Wales.

13.2 The courts of England and Wales shall have exclusive jurisdiction to resolve disputes arising under this DPA.