Data processing agreement
Last updated 30 October 2026. Draft wording, to be reviewed by a solicitor before the private beta.
You are the controller; Hordu is your processor. This agreement forms part of the terms of service for every workspace, and a signed copy is available on request.
Scope
Hordu processes personal data about your workspace users, your clients' contacts and viewers, and candidates, only to provide the service and only on your documented instructions, which are the terms, this agreement and your use of the product.
Security
The controls on the security page, including encryption in transit and at rest, workspace isolation enforced in the database, access control, logging and the certification roadmap stated there.
Sub-processors
Listed with their purpose and location on the sub-processors page. Hordu gives 30 days' notice of a new sub-processor by email to workspace owners, and you may object on reasonable grounds.
Assistance
Hordu provides the tools to answer data subject requests: export, deletion, the candidate removal-request flow and the audit log, and assists with impact assessments on request.
Breach
Hordu notifies workspace owners without undue delay and within 72 hours of becoming aware of a personal data breach affecting their data, with the information available at that time.
Deletion and return
On termination, your data is available for export for 30 days and then deleted, with backups rolling off within 35 days after that.
Transfers
Data is stored in the UK where providers offer it, otherwise in the EU. Transfers to US providers rely on the UK extension to the EU-US Data Privacy Framework or on standard contractual clauses.