Legal

Data processing addendum

Version 0.1, draft for pilot. Last updated 13 May 2026.

What the DPA will cover

Roles: Exige as processor, Alpiq as controller
Subject matter and duration of processing
Nature and purpose: skills-based recruitment assessment
Categories of data subjects and personal data
Technical and organisational measures (RLS, sealed-before-reveal, audit log)
Data residency: Zurich, eu-central-2 (Swiss FADP)
Subprocessor approval: Supabase, Vercel, Anthropic
Cross-border transfers and SCC reference
Audit rights and breach notification windows
Return and deletion on termination

Contact

Questions about this draft should go to William Laitinen at Exige International or to Charlie at info@nocoded.co.uk.