Data Processing Terms

Last updated: October 30, 2026

These terms describe how Connecting Odds handles personal data when recruiters and companies ("customers") use the platform to post jobs, source candidates, message people and review applications. They are written to meet Article 28 of the EU and UK GDPR and similar laws. They supplement our Terms of Service and Privacy Policy. Paying customers can request a countersigned copy.

1. Who is responsible for what

• Member profiles and the network: Connecting Odds is the controller. Members decide what they share and can export or delete it.
• Customer hiring activity: when a customer reviews applications, keeps notes, moves candidates through stages or messages them, the customer is the controller and Connecting Odds processes that data on the customer's instructions.
• Each party is responsible for having a lawful basis for its own processing and for giving people the notices the law requires.

2. Our commitments as processor

• Process customer personal data only on documented instructions, which are these terms, the Terms of Service and the customer's use of product features, unless the law requires otherwise. We tell the customer if we think an instruction breaks the law.
• Make sure everyone with access is bound by confidentiality.
• Apply the security measures in section 5.
• Use sub-processors only as set out in section 6.
• Help the customer answer data subject requests, carry out impact assessments and consult regulators where relevant.
• Notify the customer without undue delay, and aim for within 72 hours, after becoming aware of a personal data breach affecting their data, with the facts we know at that point.
• At the end of the service, delete or return customer personal data, unless the law requires us to keep it.
• Make available the information needed to show compliance, and allow reasonable audits as described in section 8.

3. What is processed

People whose data is involved

• Candidates and applicants, including members who apply or are contacted.
• Customer staff such as recruiters, hiring managers and company page admins.

Types of data

• Profile data: name, headline, location, work history, education, skills, photo.
• Application data: resume and cover letter files, answers to screening questions, application status and stage history.
• Communications: messages between customers and candidates, and interview scheduling details.
• Account and usage data: work email, sign-in records, and actions taken in hiring tools.

Customers should not ask candidates for special category data (such as health or religion) unless the law requires it for the role.

Purpose and duration

Processing happens to provide the hiring features the customer uses, for as long as the customer's account is active, plus the retention periods described in the Privacy Policy.

4. Data subject requests

Members can export or delete their own data from Settings, and anyone can use our data request form. If we receive a request that concerns a customer's hiring records, we pass it to the customer and help them respond, unless the customer has asked us to answer directly.

5. Security measures

• Access control: row-level security on database tables so each account reads only data it is allowed to; privileged access limited to verified server-side functions.
• Encryption: data encrypted in transit with TLS and at rest by our hosting provider.
• Authentication: managed sign-in with secure session tokens, Google sign-in, and bot checks on sign-in and sign-up.
• File safety: uploads are scanned, and flagged files are held so other people cannot open them.
• Abuse controls: rate limits, account and network blocking for unsafe accounts.
• Minimization: AI and tool usage logs exclude resume text and IP addresses.
• Resilience: managed database backups and monitoring of errors and scheduled jobs.

We review these measures as the service changes. We will list formal certifications here only once we hold them.

6. Sub-processors

We use a small number of providers to run the service, in these categories:

• Cloud hosting, database and file storage.
• Edge delivery and bot protection.
• Email delivery for notifications and verification.
• Payment processing for paid plans.
• AI model providers for features such as resume tailoring, used without training on customer data.
• File reputation checks for upload safety.

The current named list is available from privacy@connectingodds.com. We bind each sub-processor to data protection terms at least as protective as these, remain responsible for them, and give customers who ask to be notified at least 30 days' notice of a new sub-processor so they can object on reasonable grounds.

7. International transfers

Some providers process data outside the European Economic Area, the UK or Switzerland. Where they do, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses (with the UK addendum where needed), together with the security measures above.

8. Audits

On reasonable written request, no more than once a year unless a regulator requires it or there has been a breach, we will answer security questionnaires and provide documentation of our measures. On-site audits need 30 days' notice, must respect other customers' confidentiality, and are at the customer's cost.

9. Customer responsibilities

• Use candidate data only for genuine hiring for the role involved.
• Keep staff accounts secure and remove access for people who leave.
• Do not export candidate data into other systems without a lawful basis.

10. Contact

Privacy questions: privacy@connectingodds.com. Signed copies and contract questions: legal@connectingodds.com.