picked.
Log inPost a role
Legal · Data Processing Agreement
DPA v2.5 · effective 9 June 2026 · v2.5
DPA. Pre-signed.
Article 28 processor terms for your account data, with EU SCCs and the UK IDTA addendum. Pre-signed by Picked. Counter-sign in your name, return one PDF, you're done.
What this DPA covers
This DPA covers the account data we process for you as your processor: your organisation and authorised users. It does not cover candidate data in the hiring pipeline. For that, Neuroworx Ltd is the sole controller and is accountable to candidates directly, through the Candidate Data Notice. You do not instruct us on, and are not the controller of, that pipeline processing.
What's in the box
Annex I
Categories of data subjects and personal data
Your authorised users and account admins. Name, work email, job title, account and billing-contact data.
Annex II
Technical and organisational measures
Encryption, access control, tenant isolation, logging, incident response, business continuity.
Annex III
Sub-processors and locations
Live list of sub-processors of account data, with role, region and DPA in place.
Annex IV
Standard Contractual Clauses
EU SCCs (Module 2 + 3) + UK IDTA addendum.
Key clauses in plain English
Processing only on instruction
We process your account data (your organisation and authorised users) only on your documented instructions. We tell you if an instruction violates GDPR before we carry it out.
Sub-processor control
We impose equivalent obligations on every sub-processor of your account data. We give you 30 days' notice before adding a new one. You can object; we'll find an alternative or release you from the DPA.
Deletion on termination
Within 30 days of your account closing, we delete or return your account data in the agreed format. One exception: anonymised audit rows we're required to keep for legal defence.
Audit rights
You can audit our compliance once per year on 30 days' notice, or immediately if you have a reasonable belief of breach. We contribute to audits via our SOC 2 Type II report.
Need it now
Email legal for the pre-signed PDF, a redline against your paper, or a pre-filled SIG Lite. Same-week turnaround.
Versions
v2.4 · 11 May 2026
Added Anthropic EU residency, removed deprecated sub-processor.
v2.3 · 02 Feb 2026
Clarified retention windows. SOC 2 Type II appendix.
v2.2 · 04 Nov 2025
EU AI Act high-risk language. Bias-audit publication schedule.
picked.
The AI-native replacement for inbound hiring. For the hiring manager, not HR.
© 2026 Picked · Made in London · Three finalists in forty-eight hours.
Data processing addendum · Picked.ai