Instructions for Reference Checks

Schedule 2.1a to the DPA: INSTRUCTIONS - REFAPP REFERENCE CHECKS SERVICE

This schedule constitutes the Customer’s instructions to Talentwise regarding the processing of Customer data and applies solely to processing carried out within the scope of the Reference Checks service.

Heading Content
Purpose The Data Processor provides a cloud-based service that the Customer uses to collect references in connection with recruitment of personnel.
Processing activities Talentwise may only carry out the following processing activities in its role as data processor:
  • Receive and structure data provided by the Customer, the Candidate, or the Reference;
  • Send reference requests;
  • Store and make reference responses available to the Customer;
  • Collect and structure certain limited demographic data provided in connection with the reference-check process, 
  • Analyze such data, potentially together with reference-check results, in order to generate grouped benchmark insights,
  • Aggregate and anonymize relevant data for inclusion in the shared benchmark dataset,
  • Administer user accounts and access rights;
  • Maintain logs for security and operational purposes;
  • Provide troubleshooting and support related to the Service, including actions taken on behalf of the 
    Customer;
  • Delete data in accordance with the Service Agreement.
Categories of personal information Candidates
  • Name
  • Contact details (telephone number, email address)
  • IP address
  • Information provided by Customer when initiating the reference check
  • Demographic data (Age, Gender, Education level)
References
  • Name
  • Contact details (telephone number, email address)
  • IP address
  • Reference responses (including free-text responses)
  • Metadata (time, date, status)
Customer’s users (e.g. recruiters)
  • Name
  • Company and title
  • Contact details (telephone number, email address)
  • Profile image
  • LinkedIn URL
  • User and authorization data
  • Login and activity logs
Categories of data subjects
  • Limited processing of personal information may take place in the EU/EEA for the purpose of providing communication services (e.g. email, SMS) and technical support not offered by local providers.
  • Refapp ensures that any such cross-border processing is subject to appropriate contractual, technical, and organisational safeguards designed to protect personal information in accordance with applicable data protection laws.
  • Individuals are informed about such cross-border processing at the time their personal information is collected.
Cross border transfer
  • Candidates in the Customer’s recruitment processes
  • References designated by the candidate
  • Users at the Customer (administrators, recruiters, etc.)
Retention period
  • Personal data is retained for twenty-four (24) months, unless otherwise specified in the Service Agreement for Reference Checks.
  • Logs, technical data, and backups are retained in accordance with Talentwise’s ordinary retention routines.
Limitations Benchmark outputs made available through the feature shall be based on grouped, aggregated, and anonymized data designed to prevent the identification of individual candidates.

Version history

Version Date Change / Comment
2026.01 2026-04-16 Adaptation to Australia and Australian privacy laws and principles.