Legal

Vacruit Data Processing Agreement

Last updated: 22 September 2026

1. Parties and Roles

This Data Processing Agreement ("DPA") forms part of the agreement between the Client and Outsource Central Ltd, trading as "Vacruit" (company number 15105569, registered office C/O Findlay Todd Accountants, Clervaux Terrace, Jarrow, Tyne and Wear, United Kingdom, NE32 5UP), and applies whenever Vacruit processes personal data on the Client's behalf.
For sourcing, screening and shortlisting candidates, Vacruit acts as an independent data controller, as set out in our Privacy Policy at vacruit.com/privacy.
Once a candidate (VA) has been placed with a Client, and only for the ongoing wellbeing check-ins and payment administration described in our Terms and Conditions, Vacruit processes the VA's personal data on the Client's documented instructions. For that specific processing, the Client is the data controller and Vacruit is the data processor.
This DPA applies only to that processor role; it does not change Vacruit's status as controller for its own recruitment activities.

Subject matter: the ongoing administration of a placed candidate's wellbeing check-ins and pay, on the Client's behalf.
Duration: for as long as the candidate remains placed with the Client under an active engagement, and for any period afterwards needed to complete final payments or wind down the engagement.
Categories of data subjects: placed candidates (VAs).
Types of personal data: the candidate's name, contact details, bank or payment details, and wellbeing check-in notes relevant to their engagement with the Client.

Vacruit will only process the candidate's personal data on the Client's documented instructions (including as set out in the Terms and Conditions), unless required to do otherwise by law.
Vacruit keeps this data confidential and ensures anyone handling it is under a duty of confidentiality.
Vacruit uses reasonable technical and organisational security measures to protect this data against unauthorised access, loss or misuse.
Vacruit uses the following sub-processors to support this processing: our website hosting/backend provider (secure storage) and our bank, for making payments by bank transfer to the candidate. Vacruit will notify the Client of any change to these sub-processors.
Vacruit will assist the Client, where reasonably requested, in responding to data subject rights requests (access, correction, deletion, etc.) relating to this processing.
Vacruit will notify the Client without undue delay after becoming aware of a personal data breach affecting this data, and will reasonably assist the Client in meeting any resulting notification obligations.

Because placed candidates are typically based in the Philippines, South Africa, Nigeria, India or Pakistan, this processing may involve transferring or accessing personal data in those countries. As explained in our Privacy Policy, we keep this data within a closed circle (Vacruit, the candidate, and the Client), and have not put a formal cross-border transfer mechanism (such as an IDTA or the UK Addendum to the EU Standard Contractual Clauses) in place yet. A UK solicitor should confirm whether this is sufficient given the countries involved.
On termination of the Client's engagement with Vacruit, we will delete or return the candidate's personal data covered by this DPA within a reasonable period, except where we are required to keep it for legal or accounting purposes.
Our total liability arising from this processing is limited in the same way as under our Terms and Conditions: capped at the fees paid by the Client to us in the 3 months preceding the claim, excluding indirect or consequential losses.
This DPA is governed by the laws of England and Wales, and any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.