Data processing arrangements
Review draft — updated 20 October 2026. Organisations using Waaimo for candidate assessments should agree a data processing agreement before transferring live candidate information. This page explains the subjects that agreement must cover; it is not an executed DPA or a substitute for one.
Roles and documented instructions
The agreement should identify the contracting parties, controller and processor roles, processing subject matter, duration, purposes, categories of individuals and types of data. Waaimo’s processing must remain within lawful, documented customer instructions, with a defined route for instructions that appear unlawful.
People, access and security
The agreement should set confidentiality obligations, staff authorisation, access controls and proportionate technical and organisational safeguards. Its security schedule must reflect the deployed system and should address account access, transmission, storage, backups, incident handling and testing without asserting unverified certifications.
Providers and international transfers
A deployment-specific subprocessor list must identify the enabled hosting, database, email and image-storage providers, their functions and processing locations. The agreement should cover authorisation of subprocessors, notice of changes and applicable transfer safeguards. A list of integrations supported by the code is not a complete production subprocessor register.
Assistance and incidents
The parties should agree how information-rights requests, security incidents, impact assessments and regulator enquiries are handled. Incident notification duties and timescales must be agreed in line with applicable law; no unverified response guarantee is created by this page.
Retention, return and deletion
The agreement must specify retention instructions, export or return on termination, deletion of active records, treatment of backups and any legal preservation exceptions. Deletion must be supported by an operational process; a policy statement alone does not create automatic expiry.
Review and next steps
Audit information, responsibility allocation and the order of precedence with the service agreement must be settled between the identified parties. Contact support@waaimo.com to request the proposed DPA and deployment-specific provider and security details before using live candidate data.