Schedule B — Data Processing Addendum

For candidate-sourcing activities, Sercxi acts as an independent controller of candidate personal data collected from public sources or provided by the candidate. For personal data provided by the Client about its own personnel or intended interview panels, Sercxi acts as processor on the Client's documented instructions.

Identity data, professional history, remuneration data (where volunteered), assessment notes, and references. Sercxi does not process special-category data unless expressly instructed and lawfully justified.

Transfers out of the EEA rely on the EU Standard Contractual Clauses (2021/914) supplemented by transfer risk assessments. Transfers out of Singapore rely on PDPA-compliant contractual protections. Transfers out of the UAE, KSA, Japan and China follow the specific mechanisms set out in the respective jurisdiction annexes.

A live subprocessor register is maintained on the /legal/subprocessors page. Sercxi provides 30 days' notice of any new subprocessor for controller-to-controller mandates, and prior written consent is required for processor mandates.

Sercxi maintains technical and organisational measures appropriate to the risk, including encryption in transit, role-based access, least-privilege engineering, subprocessor due diligence, and incident-response procedures. A summary of measures is available on request under NDA.

Sercxi will notify affected controllers of any personal data breach without undue delay and in any event within 72 hours of becoming aware, with all information reasonably available at that time.

Candidate data: retained for the duration of an active mandate plus a legitimate-interest period not exceeding 24 months, after which it is anonymised or deleted. Client data: retained for the term of engagement plus 7 years for statutory and tax purposes, then deleted.