Instructions for Background Checks

This instruction constitutes the Customer’s instruction to Talentwise pursuant to Article 28 of the GDPR. It applies exclusively to the processing of personal data that Talentwise performs as a processor (data processor) within the Refapp Background Check service.

Schedule 2.1c to DPA: INSTRUCTIONS - BACKGROUND CHECKS SERVICE

This schedule constitutes the Customer’s instructions to Talentwise pursuant to Article 28 of the GDPR and applies only to the processing of personal data carried out by Talentwise in its role as data processor within the scope of the Background Checks service.

Talentwise also processes certain personal data as an independent data controller in connection with the Service. Such processing is not governed by this DPA and is explicitly delineated in these instructions.

Heading Content
Purpose Enable the execution of background checks in connection with the Customer’s recruitment processes, including the administration of orders, process management, and the performance of checks according to the Customer’s instructions through the Refapp Background Check service.
Processing activities where Talentwise acts as Data Processor Talentwise may only carry out the following processing activities in its role as data processor:

Administrative and recruitment-related purposes

  • Receive and store order data from the Customer (including identity and
    contact details of the Candidate),
  • Administer user accounts, access rights, and system settings,
  • Provide and operate the Candidate Portal,
  • Manage information and documents uploaded by the Candidate or made available by the Customer, which do not constitute Verification Data in accordance with Section 3 of the Service Agreement.

Process management

  • Initiate verifications in accordance with the Customer’s selections and settings in the Service,
  • Make available status information (e.g. “in progress”, “awaiting candidate”, “completed”),
  • Communicate with the Candidate regarding the upload of documentation and other steps in the verification process.

Support, operations, and security

  • Maintain logs for security, operations, and troubleshooting,
  • Provide support in matters relating to ordering and process flow,
  • Delete personal data in accordance with the Service Agreement and this DPA.

Checks carried out based on the Customer’s instructions
The Customer’s instructions may be given through configuration and activation of checks in the Service. For checks where Talentwise acts as data processor based on the Customer’s instructions, including checks that the Customer has activated in the Service from time to time in accordance with Section 3.4 of the Service Agreement, and as further described in  Schedule A – Available, Talentwise shall:

  • Only collect, receive and process personal data in accordance with the Customer’s documented instructions, including the selection and activation of checks in the Service,
  • Only process personal data to the extent necessary to perform the relevant check,
  • Not use the personal data for its own purposes,
  • Retain personal data only for as long as necessary to perform the check and make the results available to the Customer, and
  • Delete or anonymise personal data without undue delay after the check has been completed, unless otherwise follows from the Service Agreement or the Customer’s instructions.

Which checks are carried out based on the Customer’s instructions is determined by the Customer’s selection and activation of checks in the Service.

Where the processing includes personal data relating to criminal offences (for example, police certificates), such processing shall only take place for checks that the Customer has activated in the Service and in accordance with the conditions set out in Schedule A. In such cases, Talentwise shall process the data with a high level of confidentiality and limit retention to what is strictly necessary to perform the check and communicate the results to the Customer.
Processing activities where Talentwise acts as Independent Data Controller (not covered by the DPA)

Talentwise acts as an independent data controller for the following processing activities within the Refapp Background Check service:

  • Collection, verification, and validation of information from the Candidate or third parties
  • Analysis and assessment of verification data
  • Compilation of results in report form
  • Selection of methods, sources, or verification processes where Talentwise provides verification services

Processing under this section constitutes independent controller processing and is not subject to this DPA nor carried out based on the Customer’s instructions.
Categories of personal data Candidates
  • Name
  • Contact details (address, email address, phone number)
  • Date of birth / national identification number (where relevant and permitted)
  • Information contained in documents uploaded by the Candidate or the Customer
  • Verification data (e.g. education, licences, employment confirmations, identity documents, information on financial matters, etc., as well as – where relevant - a police certificate or equivalent information regarding criminal records)
  • Administrative information and status-related metadata

Customer’s users (e.g. recruiters)
  • Name
  • Company and job title
  • Contact details (phone number, email address)
  • Profile image
  • LinkedIn URL
  • User and access data
  • Login and activity logs
Categories of data subjects
  • Candidates in the Customer’s recruitment processes
  • Users at the Customer (administrators, recruiters, etc.)
Retention period
  • Personal data is retained for twenty-four (24) months, unless otherwise specified in the Background Checks Service Agreement.
  • Logs, technical data, and backups are retained in accordance with Talentwise’s ordinary retention routines.
Limitations Processing carried out by Talentwise as an independent data controller within the scope of the Service is not covered by these instructions and is not governed by the DPA.

 

Version history & Archive

Version Date Change / Comment
 2026.02  2026-06-25 Added processing activities that the Customer can activate, such as a police clearance certificate.
 2026.01 2026-03-23

Added the processing activity that Talentwise may conduct checks as Processor based on the Customer’s instructions.
See previous version here: DPA_2.1c_NO-en_2026.01
2025.02 2025-12-01

Revised to align with Refapp’s new services and to relocate customer-specific terms to the Main Agreement.
See previous version here: Schedule 2.1c-DPA_Background_Checks_v2025.02