Agency data terms

Who these terms are between

These terms are between Into the Zone ("we", "us"), which runs intothe.zone, and the recruitment agency accepting them ("you"). They cover two different kinds of personal data, and our role is different for each. Part A covers the details candidates choose to share with you. Part B covers what you put into intothe.zone yourself.

The person accepting confirms they are authorised to bind the agency.

Part A: details candidates share with you

A candidate decides what to share with you, and when to stop. We pass on only the fields the candidate selects on their share card, and only while they allow it. Once you receive those details you decide what to do with them, so you are an independent controller of them under the GDPR and responsible for your own compliance. In particular:

1. Purpose. Use a candidate's details only to represent that candidate: to discuss roles with them and, with their agreement, to present them to employers.
2. Onward sharing. Show a candidate to a hiring company only through a shortlist the candidate has agreed to for that company, or with the candidate's own documented agreement. Do not sell, publish or pool candidates' details with anyone else.
3. When a candidate stops sharing. You stop receiving anything new. Delete what you already received once you no longer need it to represent them, and in any case when the candidate asks you to, unless the law requires you to keep it.
4. No special category data. intothe.zone never shares a candidate's Work DNA, personality or work-style results, or anything derived from them. Do not ask candidates to send them to you through other channels in connection with intothe.zone.
5. No automated decisions. Do not use candidates' details to make decisions about them by automated means, or to score or rank candidates with an AI system, using data obtained through intothe.zone.
6. Security and breaches. Keep the details secure, and tell us within 72 hours of becoming aware of a personal data breach that affects them.
7. Where the data goes. Keep candidates' details in the EEA, the UK or a country the EU recognises as adequate, unless the GDPR's transfer rules are met.

Part B: what you put into intothe.zone

For the mandates, client names, notes, invitation email addresses and other content you enter, you are the controller and we are your processor (Article 28 GDPR). We will:

1. process it only to provide intothe.zone to you, and otherwise only on your documented instructions or where the law requires;
2. keep it confidential, and make sure our staff are bound by confidentiality;
3. keep it secure, and tell you without undue delay about a personal data breach affecting it;
4. use only the subprocessors listed in our privacy policy, and tell you before adding one so you can object;
5. help you answer requests from the people concerned and meet your other GDPR obligations, where we can;
6. delete it, or return it if you ask, when you close your account, unless the law requires us to keep it;
7. give you the information you reasonably need to show these obligations are met.

Invitations. When you ask us to invite someone who does not yet use intothe.zone, you confirm you have a lawful reason to contact them about a role. We send one email naming your agency as the source of their address, with a permanent opt-out that applies to every agency.

Verification, changes and ending

We verify that your agency is a registered company and that you use its email domain. At launch we work with agencies, and show candidates to hiring companies, located in the EEA, the UK and countries the EU recognises as adequate.

We may update these terms. A new version takes effect when you accept it, and we may pause candidate sharing until you do. Either side can end these terms by closing the agency account. Part A's duties about candidates' details you already hold survive that.

Questions: contact us — a person answers.