Data Processing Agreement

CompetencyLabs acts as data processor for sponsor and employer workspaces (shortlists, contact requests, hiring notes) and as data controller for the underlying verified Competency Passports owned by candidates.

Processing covers candidate profile data, assessment evidence, verification artefacts, and employer activity strictly for the purpose of operating the CompetencyLabs service and the agreed sponsor use case.

Hosting, database, email, and security infrastructure providers. A current list is maintained at the Subprocessors page; the list also includes the prior-notice process for changes.

Where personal data is transferred outside the EEA or UK, CompetencyLabs relies on the EU Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum.

Encryption in transit and at rest, role-based access control, audit logging on all production data, and routine security testing.

CompetencyLabs assists controllers in responding to data subject requests and notifies controllers without undue delay (and in any event within 72 hours) of any confirmed personal data breach affecting their workspace.

Email legal@competencylabs.com with your entity details to receive a counter-signed copy.