Data Transfers
Last updated: 2026-06-18
This page explains the legal bases Career Complete uses for international data transfers, the subprocessors that handle personal data, and where data for each region is stored.
Transfer bases
When personal data leaves the region where it was collected, the export is covered by an approved transfer mechanism rather than an ad-hoc copy:
- EU / EEA: the European Commission Standard Contractual Clauses (SCCs), using Module Two (controller-to-processor) or Module Three (processor-to-processor) as appropriate.
- United Kingdom: the UK International Data Transfer Agreement (IDTA), or the EU SCCs together with the UK Addendum.
- Switzerland: the EU SCCs with the Swiss addendum and the FADP references in place of GDPR ones.
Each transfer is paired with a transfer impact assessment and the technical and organisational safeguards described in our security documentation.
Subprocessors
We share personal data with a short list of vetted subprocessors. Each is bound by a data-processing agreement and the transfer mechanism shown below.
| Subprocessor | Purpose | Processing region | Transfer mechanism |
|---|---|---|---|
| Cloud hosting & database infrastructure | Stores account, exam, and result records. | United States & European Union | EU SCCs + UK IDTA |
| Transactional email delivery | Sends sign-in, results, and notification email. | European Union | EU SCCs |
| Error monitoring & application logging | Captures diagnostics that keep the service reliable. | United States | EU SCCs + UK Addendum |
| Customer support helpdesk | Handles candidate and employer support requests. | United Kingdom | UK IDTA |
Per-region data residency
Where your records are stored depends on the region you signed up from:
| Region | Residency rule |
|---|---|
| European Union / EEA | Stored in EU data centres; no onward transfer without SCCs in place. |
| United Kingdom | Stored in UK or EU data centres under the UK IDTA and the UK Addendum. |
| United States | Stored in US data centres; EU and UK exports rely on SCCs / IDTA. |
| Rest of world | Defaults to EU data centres unless local law requires a specific region. |