Customer processing arrangements
Updated 14 October 2026.
Contact hello@talentonics.com to agree a processing agreement and retention arrangements before collecting real employee information. This page describes the current scope and the matters to agree; it is not a signed data-processing agreement, transfer assessment or compliance certificate. A Free or paid account does not automatically complete this review.
Roles and instructions
The workspace customer controls the purposes of its team-development processing. Richard Moore trading as Talentonics processes that information to provide and support the configured service. The customer must establish its lawful basis, employee communications, authorised users, retention period and any necessary impact assessment. Platform account and billing administration are covered separately by the privacy notice.
Processing scope
Data subjects are customer participants, assessed people, managers and assigned reviewers. Records may include names, work email, role and directory identifiers, engagement context, feedback, ratings, calibration, coaching priorities, checkpoints, permissions, activity counts and request/audit metadata. Processing includes collection, storage, authorised display, revision, export and instructed deletion for the duration of the service and agreed closure process. Special-category and criminal-offence information are outside the intended scope. AI inference and private career transcripts are not implemented.
Provider inventory
- Supabase: PostgreSQL storage, configured in London.
- Vercel: application hosting and delivery; functions configured for London.
- Resend: requested sign-in and invitation messages; EU sending region.
- Google or the customer’s identity provider: authentication when selected.
- Stripe: hosted payments and subscription administration; payment-card details do not enter the Talentonics database.
The role of each provider depends on the processing. The final agreement must identify the relevant legal contracting entities, approved subprocessors, their locations and any applicable UK/EU transfer safeguards. A configured region does not establish that all delivery, support, logs or backup processing stays in that region.
What the agreement must settle
Documented customer instructions; confidentiality of authorised personnel; proportionate technical and organisational security; subprocessor authorisation and change notices; assistance with rights requests, incidents and impact assessments; access to necessary compliance information and proportionate audit arrangements; notification of unlawful instructions; and return or deletion at the customer’s choice on termination, including any lawful retention exceptions. International transfers need an applicable mechanism and assessment where required. These are contractual and operating obligations, not controls established merely by creating a workspace.
Current controls and operational limits
The security centre describes implemented access, identity, provisioning and cycle-stage controls. Managers currently have workspace-wide access. Purging eligible released cycles requires administrator review; account, audit, commercial, provider-log and backup disposal need separate handling. Request status changes do not themselves erase records. Provider agreements, transfer review, backup/restore evidence, incident exercises and the complete retention schedule remain operating readiness work. Obtain and review the relevant evidence with us before an employee-data rollout; the fictional demo is available for evaluation meanwhile.
Terms and conditions · Privacy notice · Return to Talentonics