Last updated: 8 September 2026 | Register owner: Recmark Ltd
RecMark uses providers to deliver agreed service functions. A subprocessor handles client personal data on RecMark's behalf. A client-appointed integration or a provider acting as an independent controller has a different role. We identify that distinction below according to the actual service terms and processing, rather than treating every connected organisation as a subprocessor.
The executed Data Processing Agreement identifies the initially authorised subprocessors by a dated copy of this register. We give the change notice and opportunity to object described in that agreement. Questions and objections should be sent to privacy@rec-mark.com. A provider is not approved for client data merely because its name appears as a proposed option in a planning document.
Providers processing on RecMark instructions
This is the planned launch register. Before processing live applicant data, RecMark must verify the applicable supplier terms and DPA, confirm the account's contracting entity and current subprocessor list, and record the chosen production region.
| Provider legal entity | Function and data | Locations | Contract and transfer safeguard |
|---|---|---|---|
| Lovable Labs Incorporated / applicable EEA contracting entity to confirm | Initial production app hosting and deployment; account, application and operational data | EEA and other supplier or subprocessor locations stated in the contracted plan | Lovable DPA and applicable EU SCCs; verify signed coverage before launch |
| Supabase, Inc. | EU-region database and authentication; employer accounts, applications, messages, screening and audit records | Selected EU primary region; support and subprocessors stated in the current DPA | Supabase DPA, EU SCCs and transfer assessment; verify the project region before launch |
| Plus Five Five, Inc. (Resend) | Employer alert email containing applicant name, role and a secure app link | United States and authorised subprocessors | Resend DPA and applicable EU SCCs; execute or verify before launch |
No separate queue, monitoring or AI provider is approved for applicant data at launch. Adding one requires due diligence, a register update and the DPA's subprocessor-change process. RecMark must not place secrets or confidential contract attachments in the public register.
Meta and client appointed integrations
| Service and legal entity | Connection purpose | Role and responsibility | Notice and transfer details |
|---|---|---|---|
| WhatsApp Cloud API / WhatsApp Ireland Limited | Send and receive authorised recruitment messages using each employer's own account, number and billing | Provider roles are governed by the WhatsApp Business Terms and Data Processing Terms; employer authorises the connection | Ireland with transfers described in WhatsApp's Business Data Transfer Addendum, including the EU-US Data Privacy Framework and alternative safeguards |
| Facebook Lead Forms / Meta Platforms Ireland Limited | Retrieve submissions only from employer-authorised Pages and selected forms | Client-appointed source integration; exact controller and processor roles depend on the configured Meta product and terms | Meta privacy and business-tool terms; verify applicable transfer terms at launch |
| GoHighLevel / HighLevel, Inc. | Import applications and permitted status updates from the employer's account | Client-appointed ATS provider; RecMark accesses only the authorised records and endpoints | United States and subprocessors under HighLevel's DPA and applicable transfer safeguards |
| Stripe Payments Europe, Limited | Process RecMark employer subscription payments | Stripe has processor and independent-controller roles under its services terms; no applicant data is required | Ireland and Stripe service-provider locations under the Stripe DPA and Data Transfers Addendum |
Where an integration provider also acts as RecMark's subprocessor for a particular activity, identify that activity in the first register and apply the contractual authorisation process. Do not assume Meta's role is identical for message content, account security, lead forms and billing.
For a restricted transfer, specify the relevant adequacy decision or executed contractual instrument and the applicable parties. If relying on a certification arrangement, verify the entity's current participation and that the processing is covered. A generic statement that a provider is GDPR compliant is not a transfer mechanism.