Back to Home

Third-Party Sub-Processors Register

UK GDPR & Data Protection Act 2018 Statutory Disclosures

Under Article 28 and Chapter V of the UK GDPR, HireMatch AI maintains this transparent register of third-party sub-processors engaged to support our platform infrastructure, AI parsing models, and transactional messaging. All sub-processors undergo technical privacy assessments and operate under formal Data Processing Agreements (DPAs) with standard contractual transfer mechanisms.

Amazon Web Services (AWS)

Cloud Infrastructure & Document Storage

UK (eu-west-2, London) / EU
Personal Data Processed:Encrypted resume files (PDF, DOCX), extracted resume text, asynchronous queue identifiers.
Transfer Safeguard:UK International Data Transfer Agreement (IDTA) / AWS Data Processing Addendum

OpenAI LLC

AI Model Inference & Vector Embeddings

United States
Personal Data Processed:Resume text snippets, job descriptions, structured skill attributes for semantic matching.
Transfer Safeguard:Standard Contractual Clauses (SCCs) with UK Addendum, Zero Data Retention (ZDR)

Google LLC (Google AI / Gemini)

AI Resume Parsing & Categorization

United States / Global API Infrastructure
Personal Data Processed:Parsed resume text and employment history for automated entity extraction.
Transfer Safeguard:Google Cloud Data Processing Addendum, Model Training Opt-Out

Google LLC (Google OAuth2)

Single Sign-On (SSO) Authentication

United States / Global Identity Infrastructure
Personal Data Processed:Recruiter full name, email address, profile picture, Google user ID (sub).
Transfer Safeguard:Google Cloud DPA & UK Adequacy Safeguards

Google LLC (Gmail SMTP)

Transactional Email Delivery

United States / Global Mail Infrastructure
Personal Data Processed:Recruiter email address, password reset verification links, candidate match ranking summaries.
Transfer Safeguard:Google Workspace Data Protection Agreement

International Data Transfers Notice:

Where personal data is transferred outside the United Kingdom to jurisdictions without an adequacy regulation, transfers are secured via the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), accompanied by Transfer Risk Assessments (TRAs).