Data Processing Agreement

1. Parties and status

Processor: the NextRoles partnership (Max Fowler and Joshua Wallace-Jones), trading as NextRoles ("NextRoles", "we"), United Kingdom.

Controller: the school, college, or organisation that creates and manages student/member accounts on NextRoles under a teacher, School Administrator, or equivalent role ("the School", "you").

For any personal data belonging to a student or other individual whose account the School creates or manages, the School is the data controller and NextRoles is the data processor, acting only on the School's documented instructions. This agreement applies automatically from the point a School Administrator account is provisioned, and is accepted by using the service to create or manage student accounts.

2. Subject matter, duration, nature and purpose

Subject matter: NextRoles' provision of CV review, job and work-experience application matching, cover-letter drafting, interview practice, skills reflection and related careers-support tools to students whose accounts the School manages during the school pilot and any continued use agreed by the parties.

Duration: for as long as the School's account remains active, plus any period NextRoles is required to retain data afterwards (see clause 8).

Nature and purpose: processing student personal data solely to operate the features above, maintain the account, enforce usage limits, provide support, investigate misuse and apply the limited review flags described in Data & AI use - never for NextRoles' own advertising or unrelated profiling. NextRoles does not select employers, approve opportunities, administer physical placements or submit applications; those activities remain with the School and student.

3. Categories of data and data subjects

Data subjects: students (who may be minors) whose accounts a School Administrator creates, and the School Administrator(s) themselves.

Categories of personal data: account identifiers (name, email); CVs and CV content (which may include education history, work experience, and other career-related personal detail the student chooses to enter); optional CV contact details (preferred name, contact email, town/address, phone) where that feature is enabled; job adverts and application text the student submits; AI-generated review scores, feedback and cover letters; skills-review answers; safeguarding flags and any related notes, messages or reports; login and session activity needed for security.

Special category or sensitive data should not knowingly be requested by the service, but a student's own CV or free-text input could incidentally include it (e.g. a health condition mentioned in a personal statement). Both parties should minimise this where possible.

4. Processing only on instructions

NextRoles will process student personal data only on the School's documented instructions, including instructions relating to international transfers, unless required to do otherwise by UK law - in which case NextRoles will inform the School beforehand unless that law prohibits this. Using the service's standard, published features (account creation, CV review, the safeguarding check, admin dashboard functions) is treated as a standing instruction to process data for those purposes.

5. Confidentiality

NextRoles ensures that each person authorised to process student personal data is subject to an appropriate duty of confidentiality and receives access only where required for their role.

6. Security

NextRoles applies technical and organisational measures appropriate to the risk, including salted, iterated password hashing; TLS in transit; Secure, HttpOnly and SameSite session cookies; managed database access rather than direct public database access; per-account and per-IP rate limiting; role-based school, group and account permissions; access and export audit records; and seven-day point-in-time database backups. NextRoles will notify the School without undue delay after becoming aware of a personal data breach affecting student data and provide information reasonably needed for the School's own notification duties.

7. Sub-processors

NextRoles uses the following sub-processors to deliver the service. The School authorises their use generally, and NextRoles will give reasonable notice of any intended change so the School can object on reasonable grounds:

• DigitalOcean - website hosting.
• Cloudflare, Inc. - API compute (Workers), Workflows, and request routing. Cloudflare also converts uploaded PDF, DOCX and ODT files (CVs and job adverts) into text (Workers AI document conversion) and, where a job page needs it, loads that page to read its text (Browser Rendering).
• Amazon Web Services (AWS) - Aurora PostgreSQL database (RDS Data API) and guide-image storage.
• OpenAI - AI-generated review scoring, cover letters, CV generation and improvement, interview practice questions and feedback, answers to students' help questions, skills enrichment and limited listing-signal classification. It also reads CV and job-advert images uploaded as PNG, JPG or WEBP, so those images are sent to OpenAI; other uploaded files are converted to text first. Processed material may be handled outside the UK under the provider's applicable contractual transfer safeguards.
• ElevenLabs - computer-generated voice for the optional AI voice interviewer. Only the interviewer's own reply text is sent; never a student's audio, name or account details. Voice interviews are off for a school unless NextRoles switches them on for it.
• Resend - transactional email delivery (account setup, password reset, deletion confirmation).
• VirusTotal (a Google company) - URL safety scanning where a student submits a link to a CV or job page. Only the link (URL) is sent: never uploaded files, CV text, or any student name or account details. Uploaded files are not malware-scanned; they are checked for type, size and file signature and then converted to text. If the scanner is unavailable, a linked CV is not opened (the student is asked to paste or upload it instead), while a job-page check continues without the scan.
• Umami Cloud - privacy-focused website analytics that excludes form contents and account identifiers from event data.
• Google - optional page translation and hosted web fonts.
• Slack - limited operational service alerts.

Optional AI voice interviews are off for a School unless NextRoles switches them on for it, and the School decides whether its students use them. Students' speech is turned into text by their own browser's speech service and is never received by NextRoles. The words, as text, are processed by OpenAI to write the interviewer's replies, to grade the interview and to run an automatic safeguarding review after every call. Where the review finds a possible concern, or a student says something suggesting they may be at risk during a call (in which case the call is stopped, the student is shown free support services and their account is paused for 10 minutes), NextRoles raises a flag in the School's safeguarding dashboard containing the concern and a short excerpt of the student's words, for the School's safeguarding staff to review as the controller. Flags follow the retention rules for other safeguarding flags in this agreement. Interview transcripts and feedback are kept for a student's latest three calls only, can be deleted by the student at any time, are not otherwise shown to teachers, and are erased when the student's account or data is deleted. A conversation that raised a flag is held for up to seven days so the School's staff can read it. NextRoles staff can read it only if the School's staff ask for more context or the flag has been open for 48 hours without action, every opening is logged, and NextRoles may keep a flagged conversation longer only where safeguarding or the law requires it. If a student swears at or threatens the interviewer, the interview is ended and a low-priority flag is raised for the School's staff. If a student tells a voice interview they feel low, anxious or depressed, the interviewer pauses to check on them and a low-priority flag is raised for the School's staff; feeling physically unwell (for example a headache) only pauses the interview and is not flagged. The written (text) interview has the same safety stop and after-the-event safeguarding review; NextRoles does not store its answers, so a flag from a written interview carries only a short excerpt.

Some writing boxes offer an optional, student-initiated “Speak instead” button that uses the student's own browser speech recognition. The audio goes from the student's device to the browser provider (for example Google, Microsoft or Apple), not to NextRoles, so those providers are not NextRoles sub-processors for this feature. NextRoles never receives or stores the audio, only the resulting text the student keeps. Schools that do not want pupils using it should manage this through their device or browser policy (for example by blocking microphone access).

NextRoles remains fully liable to the School for each sub-processor's performance of its data protection obligations.

8. Assisting with data subject rights and DPIAs

NextRoles will assist the School, insofar as reasonably possible, in responding to requests from students (or their parents/guardians, as applicable under the School's own policies) to exercise their UK GDPR rights - access, rectification, erasure, restriction, objection and portability - and in the School's own data protection impact assessments and any prior consultation with the ICO, taking into account the nature of processing and information available to NextRoles. Requests should be sent to support@nextroles.org, referencing the student's account email and the School.

9. Deletion or return of data

At the School's written instruction, or on termination of the School's use of the service, NextRoles will delete or return student personal data and delete existing copies unless UK law requires continued storage. Verified self-service data deletion has a 24-hour cancellation window; verified account closure has a 30-day cancellation window. Once due, the live application, CV and profile data is removed by the scheduled deletion process. Recovery copies age out within the configured seven-day backup window. Report, access-audit or legal records may be retained only where an applicable obligation, active investigation or documented School instruction requires it.

10. Audit and demonstrating compliance

NextRoles will make available to the School information reasonably necessary to demonstrate compliance with this agreement, and will allow for and contribute to audits, including inspections, conducted by the School or an auditor it mandates, on reasonable notice and during business hours. Given NextRoles' size, a documentary/questionnaire-based review is expected to be the normal method rather than an on-site audit, unless a specific concern requires otherwise.

11. Contact and sign-off

Data protection queries, breach notifications, and requests under this agreement: support@nextroles.org.

A School Administrator account holder confirms, by creating or continuing to manage student accounts on NextRoles, that they are authorised by their school to agree to this Data Processing Agreement on the school's behalf. A school that needs a countersigned copy or its own standard data-processing terms should contact us before onboarding students.