Data Processing Addendum
This addendum forms part of the agreement between Skosh & a business customer. It applies when Skosh processes personal data for the customer.
Last updated: 30 September 2026
Parties & roles
The customer is the organisation that accepts Skosh's Terms of service. For candidate data, the customer is the controller & Skosh is its processor. Skosh's own use of account data to run accounts is covered by the Privacy policy.
- Processor
- Skosh
- Registered address
- Bengaluru, India
- Country
- India
- Privacy contact
- support@getskosh.com
- Governing law
- India
A signed copy of this addendum is available on request: support@getskosh.com.
Subject matter & duration
Skosh processes personal data to provide the service described in the Terms of service, for as long as the customer uses Skosh & until the data is deleted or returned as set out under Deletion or return.
Nature & purpose
Skosh stores, organises, analyses & sends personal data in order to screen candidates against the customer's roles, draft messages & replies, send what the customer approves or what a stage it has set to run hands-free is allowed to send, mark a call booked when the recruiter's own calendar shows it & report on the work.
Data categories & data subjects
Data subjects
- The customer's recruiters & other users of Skosh.
- Candidates the customer reviews or contacts.
Data categories
- Users: name, work email, sign-in account, & role in the organisation, & the data from the accounts they connect: the emails Skosh sends from their mailbox & the replies to them, calendar events for bookings & tracking sheets.
- Candidates: name, profile details, work history, location, profile links, contact details, messages exchanged, booking details, screening notes & verdicts.
Processing on instructions
Skosh processes personal data only on the customer's documented instructions: the Terms of service, this addendum & the customer's own use & settings of Skosh. If the law requires other processing, Skosh tells the customer first, unless the law forbids it. Skosh tells the customer if it believes an instruction breaks data protection law.
Confidentiality of personnel
Everyone Skosh allows to process customer personal data is bound to keep it confidential.
Security measures
Skosh protects customer personal data with these measures:
- every message & reply needs a person's approval, or the template & rules a person approved for the role: for a role they put on hands-free, or for the reminders before a booked call; pay, visa & other-language replies always go to a person; every decision is recorded in an audit log,
- every user & admin in the customer's organisation can read every candidate conversation Skosh stores online for the customer, so a colleague can cover; in the web console, a reply's draft & send are open only to the recruiter it came to; referrers read no conversations & open no role pages; & roles decide what each person can do,
- connected accounts use the provider's own sign-in (OAuth) with only the scopes Skosh needs, each for a named purpose,
- secrets never reach the browser,
- traffic to every outside service is encrypted in transit (HTTPS),
- Skosh paces its work so each recruiter's accounts stay safe, & each recruiter has a stop switch that halts Skosh's work for them,
- Skosh is the tool the customer uses to reach people. Skosh does not sell data, show ads or build its own database of people. Skosh's AI providers only process the customer's data to answer Sparky, delete it, & can't train on it. Sparky learns the customer's way of working; Skosh does not train AI models on the customer's data.
The Security page describes them.
Subprocessors
Skosh sends the customer its current list of subprocessors, also kept on the Subprocessors page, & the customer authorises Skosh to use them. Skosh tells the customer by email before a change to that list takes effect, so before a new subprocessor processes customer personal data.
The customer may object to a new subprocessor on reasonable data protection grounds by emailing support@getskosh.com. Skosh & the customer then work in good faith to resolve the objection.
Assistance
Taking into account the nature of the processing, Skosh helps the customer respond to requests from data subjects, such as requests to access, correct or erase their data. Skosh can erase a candidate's data when the customer asks.
Skosh also helps the customer with data protection impact assessments & with consulting a supervisory authority, where they concern Skosh's processing.
Personal data breaches
Skosh notifies the customer without undue delay after becoming aware of a personal data breach affecting customer personal data, & shares the information the customer reasonably needs to meet its own obligations.
Deletion or return
When the customer stops using Skosh, Skosh deletes or returns the customer's personal data, as the customer chooses, unless the law requires Skosh to keep it.
Audits
Skosh makes available the information reasonably needed to show that it meets this addendum, & allows audits on reasonable request, with reasonable notice.
International transfers
Where customer personal data is transferred to another country, the transfer relies on appropriate safeguards, such as standard contractual clauses where the law requires them.