Empower your people, strengthen your culture, and build
reputation equity with Signals.
Most employee records serve a single purpose. They help businesses manage employment, but do little to encourage employees to take an active interest in their own development.
Through the Career Infrastructure, you create portable records rather than static ones, giving employees secure access to their career history that they can retain, build upon, and use throughout their working lives.
When employees have something of lasting value at stake, they have a reason to take greater ownership of their performance, development and career progression.
The result is stronger engagement with the systems and processes already in place, helping turn the investment you make in your people into a more productive workforce.
In addition to employee records, you can also create endorsements for your employees.
These endorsements automatically populate your employees TeamFit CV and profile, giving them lasting evidence of what they bring to the table.
...that makes employees feel seen and appreciated, improving engagement.
Switching to portable records shows employees that you genuinely support their careers, giving them a reason to invest more in the business and the work they do.
When they eventually move on, the relationship does not simply end with a goodbye. With the Career Infrastructure in place, they leave with a verified career asset they can continue using throughout their working lives, creating a lasting connection with your business and turning former employees into genuine brand advocates.
The more you support your employees' long-term careers, the stronger your Employer Score becomes.
Your Score reflects your investment in employee engagement, development and career progression.
It builds confidence in your business, strengthens your reputation and helps create the trust that supports customer relationships and drives sales.
This Cookie Policy describes how Signals AC Ltd (“Signals”, “we”, “us”) and our partners use cookies and similar technologies (such as pixel tags and web beacons) on the Signals website and platform (the “Signals Sites”). It should be read together with our Privacy Policy.
A cookie is a small text file placed on your computer or mobile device when you visit a website. It may contain a unique identifier distinguishing your device from others. Cookies allow efficient navigation, remember your preferences, and improve your user experience. “Session cookies” exist only while your browser is open; “persistent cookies” remain until a defined expiry date and can recognise your device on return visits.
In accordance with the Privacy and Electronic Communications Regulations (PECR), we set strictly necessary cookies without consent, as they are essential for the Sites to function. All other cookies (analytics, advertising) are set only with your consent, which you may give, refuse, or withdraw at any time through the cookie banner or the cookie settings link on the Sites.
Strictly necessary cookies. These enable you to navigate the Sites and use their features, including secure areas, login recognition, and form completion. They cannot be switched off.
Analytics cookies. With your consent, we and our analytics providers use cookies to understand how the Sites are used, including pages visited, errors encountered, and visit frequency and duration, in order to improve the Sites and your experience.
Advertising cookies. With your consent, we and third-party partners use cookies to deliver advertisements relevant to you on third-party websites and to measure their effectiveness. These third parties may collect information including your IP address, browser, and pages visited.
We may use tracking technologies to measure the performance of our email campaigns (for example, open rates). You can disable this by turning off HTML or image loading in your email client, and you may unsubscribe from marketing emails at any time using the link provided in each email.
Most browsers allow you to refuse or delete cookies through their settings. Note that blocking or deleting cookies may impair the functioning of parts of the Sites, and that cookie preferences are themselves stored in a cookie, so they must be renewed if you clear cookies, change browser, or change device.
As no uniform standard for “Do Not Track” signals has been adopted, the Signals Sites do not currently respond to such signals.
This Policy was last updated on 7 June 2026. We may amend it by publishing the amended version on the Sites and, where required by law, by providing notice or obtaining consent. Questions regarding this Policy may be submitted via the contact form on the Sites.
Introduction
This Privacy Policy explains what personal data we collect, how and why we process it, who we share it with, and the rights you have under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
The controller of your personal data is Signals AC Ltd, a private limited company registered in England and Wales with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF (“Signals”, “we”, “us”).
We have appointed a Data Protection Officer (“DPO”), who may be contacted at dpo@signals.ac.
How this Policy applies depends on how you use Signals: an individual using Signals to find records about themselves is treated differently from a business using Signals to create records. The relevant detailed terms are presented during account creation.
What personal data we process and how it is collected
Account data. Information you provide when registering for and using an account is controlled and processed by Signals.
Employment records created by business customers. The employment records that you (a business user) create and store with Signals are portable. In respect of those records, you are the controller (responsible for the content of the records and for the information identifying your employee), and Signals processes them on your behalf as your processor. A controller-to-processor agreement governing this processing is incorporated into this Privacy Policy and the Terms and Conditions and is accepted by every Signals business user on creating an account.
Access granted by the employee. While you, as record creator and controller, have access to the records you create, the employee who is the subject of a record may grant other businesses access to view that record. Because that permission is granted by the employee and not by you as the original controller, Signals assumes the responsibilities and liabilities of a controller in order to facilitate that disclosure. In this respect, Signals acts as a second, independent controller of the data.
Service data. We also process a limited amount of technical data generated by your use of the services, as necessary for the operation and security of your account.
Purposes and lawful bases
We process personal data: (a) for our legitimate interests and those of employers, recruiters, and employees in creating, maintaining, sharing, and verifying employment records, and in operating, securing, and improving the services, where those interests are not overridden by the rights of the individuals concerned (we have carried out a Legitimate Interests Assessment to confirm this balance); (b) to perform our contract with you (provision of the services); (c) with your consent, where consent is the applicable basis, such as for certain cookies and marketing; and (d) to comply with legal obligations. Where we rely on legitimate interests, you have the right to object as described below.
Visitor insights
When you view another member’s profile, your interaction with that profile, including scrolling, cursor movement, clicks, time spent on sections, and the order in which you view content, is recorded and made available to that profile’s owner as a visual replay, so they can understand how their profile is engaged with. Where you are signed in, the profile owner may be shown the name of your organisation as the source of the visit. We do not show your personal details. We process this on the basis of our legitimate interests, and those of our members, in providing meaningful engagement insights. We do not record passwords or data entered into form fields. Recordings are retained for 30 days and then permanently deleted. You can object to this processing at any time via account settings.
Artificial intelligence and automated decision-making
We use artificial intelligence and automated processing to help operate the service, including to score, rank, and flag employment records, and to generate summaries, benchmarks, and engagement insights.
In some cases, a decision producing legal effects concerning you, or similarly significantly affecting you, may be made solely by automated means. Where that is the case, we carry out such automated decision-making only where it is permitted by law, namely where it is necessary for entering into or performing a contract with you, or where you have given your explicit consent. We do not rely on legitimate interests for these decisions.
Where a decision about you is made solely by automated means and produces such effects, you have the right to obtain human intervention, to express your point of view, and to contest the decision. To exercise these rights, contact us using the details in this Policy.
We provide meaningful information about the logic involved in this processing and about its significance and likely consequences for you on request, and we apply measures to keep the processing accurate, to secure your data, and to prevent discriminatory outcomes.
We do not use your personal data to train artificial intelligence models other than on anonymised data that no longer identifies you.
Our AI-generated outputs — including summaries, scores, flags, recommendations, benchmarks and analyses — are decision-support tools only. They are produced automatically from the information available to the service, may contain inaccuracies or omissions, are not statements of fact, and should not be treated as professional, legal, employment or recruitment advice. Users remain responsible for reviewing and validating these outputs before relying on them or making employment, recruitment or business decisions.
Nothing in this Privacy Policy or our Terms and Conditions requires us to disclose confidential algorithms, proprietary models, trade secrets or other intellectual property in order to provide information about the logic involved in automated processing.
We may improve, replace or withdraw the AI models, algorithms, scoring methods and providers we use, without notice, where reasonably necessary to improve accuracy, performance, security or legal compliance.
Controller roles over the life of a record
Employment records pass through a predictable lifecycle: the employer creates a record; the employer controls that record while it is used for its own purposes; the worker who is the subject of the record is given access to it; and, when the worker leaves that employment, the historical record created by the employer remains attributable to that employer. Separately, the worker’s own profile continues under the worker’s control, and the worker may authorise future disclosures of records about themselves to other businesses.
Signals becomes an independent controller only for the processing necessary to facilitate disclosures authorised directly by the worker. For the records it created and for its own ongoing processing, the original employer remains the controller. Our controller responsibilities are therefore limited to the specific act of enabling worker-authorised disclosures.
HR-related processing
Our role in HR processing
Where the platform is used by a business for human resources (HR) functions, the employer uses the service to create, store and manage employment-linked records about its workers, and the platform may generate summaries, scores, flags and analyses that are inserted into a worker’s profile and that may affect employment. In this context the employer is the controller of the HR records it creates and is responsible for their content, accuracy and lawful use; Signals is the processor, acting on the employer’s documented instructions under the controller-to-processor agreement. Where a worker grants another business access to a record about themselves, Signals acts as a second, independent controller to facilitate that disclosure, as described above.
Categories of HR data
HR-related processing may involve: employment records (role, employment history and status); attendance and absence records; conduct and performance-related information; documents uploaded by the employer; summaries, scores, flags and analyses generated by the system; and, only where an employer chooses to include it, special category data such as limited health information provided to explain an absence.
Purposes and lawful basis
HR-related data is processed for HR administration and record-keeping, compliance with the employer’s employment-related legal obligations, performance and conduct management, verification of employment records, and to support workplace investigations, grievances or disputes and the establishment, exercise or defence of legal claims. The lawful basis is legitimate interests (Article 6(1)(f) UK GDPR), supported by a Legitimate Interests Assessment, and legal obligation (Article 6(1)(c)) where applicable. Consent is not used, and nothing here constitutes a worker’s consent to this processing.
Special category data
Where special category data is processed, we and the employer rely, as applicable, on Article 9(2)(b) (employment, social security and social protection), together with the condition in paragraph 1 of Part 1 of Schedule 1 to the Data Protection Act 2018; Article 9(2)(f) (legal claims); and Article 9(2)(g) (substantial public interest), together with the relevant condition in Part 2 of Schedule 1. Explicit consent is not relied upon. Where we rely on a condition that requires it, we maintain an Appropriate Policy Document under Part 4 of Schedule 1, and we require employers who upload such data to maintain their own.
Worker monitoring transparency
Where the service is used to monitor aspects of a worker’s employment, we are transparent about that monitoring, consistent with the ICO’s guidance “Employment practices and data protection: monitoring workers” (2023). The service records employment-relevant information such as attendance and absence, conduct and performance signals, and activity relating to records held about the worker; monitoring is for HR administration, compliance and record integrity; it may inform employment decisions taken by the employer, but such decisions are not made solely by automated means; monitoring is limited to what is necessary and proportionate; and it is not carried out covertly. Workers are informed through this Policy and the employer’s own monitoring and HR policies.
Safeguards, retention and assessments
HR data is protected by role-based access controls, audit logging, data minimisation, encryption, and separation of HR data from data processed for security-monitoring purposes. For records controlled by an employer, the employer determines proportionate retention periods; on deletion of profile data or cancellation of an account, associated reporting data is deleted within 14 days. We have completed a Data Protection Impact Assessment (DPIA) and a Legitimate Interests Assessment (LIA) for all HR-related processing, and, where required, maintain an Appropriate Policy Document.
Next Hire pre-application matching
What Next Hire does
Next Hire scores individuals against an employer’s role before they apply. It reaches potential candidates through professional connections — the people known to an employer’s own staff, and, in turn, the people known to them — so an individual may be reached through someone they have never met. Scoring reads profile information, including physical-capability answers (health data) and security-clearance information including DBS status (criminal offence data), and the resulting score is stored against that employer’s position.
What Next Hire does not do
Reading, scoring and storing are all forms of processing, and we treat them as such; but processing is not the same as disclosure. Next Hire is designed so that identity is not exposed until the candidate chooses to apply. While a role is only being pooled, the employer sees a count and nothing else — no names, profiles, lists or contact details. When a role becomes a live vacancy, the employer sees anonymous score bands and an indication that a candidate was reached ‘via one of your team’, never a name. Identity crosses to the employer only when the candidate applies. No one is contacted, rejected or marked as a result of being scored or counted.
Lawful basis for matching
We match individuals who have not applied, and with whom the employer has no prior relationship, on the basis of the legitimate interests of employers and candidates in efficient, relevant recruitment and our legitimate interest in providing the service (Article 6(1)(f) UK GDPR). We have carried out a Legitimate Interests Assessment for this processing, the balancing of which rests on the no-disclosure design described above. Individuals may object to this processing, and stop being matched, at any time, as described under ‘Your rights’.
Health and criminal offence data in scoring
Where scoring uses physical-capability answers (special category health data under Article 9 UK GDPR) or security-clearance and DBS information (criminal offence data under Article 10 UK GDPR), we rely on the employment condition in Schedule 1 to the Data Protection Act 2018, and we maintain an Appropriate Policy Document covering both categories, retained and available to the Information Commissioner’s Office. We do not rely on consent for this processing.
Controller roles in matching
Signals determines the purposes and means of building the candidate pool and scoring individuals who have not applied, and is the controller for that processing. The employer becomes a controller only once it receives an application for a vacancy; at that point the applicant’s identity and data pass to the employer, which is the controller of the applicant data it then holds. Rights requests are directed accordingly: to Signals for the pooling and scoring stage, and to the employer for an application it has received.
How matching decisions are made
Matching operates as an automated gateway that determines whether an individual is surfaced to an employer as a potential candidate. It does not decide who is hired: individuals who pass the gateway are subject to a human hiring decision made by the employer. Because identity is not exposed until the candidate applies, and because the candidate controls whether they apply, being scored or pooled does not itself produce a legal or similarly significant effect by solely automated means. A candidate can see every requirement they are scored against and the per-requirement breakdown of their match.
Priority Hire
Where the employer uses Next Hire as its recruitment tool and two or more candidates have the same match score for a vacancy, an optional candidate feature called Priority Hire affects the order in which those candidates are shown: candidates who hold the paid ‘Advanced Features’ subscription are shown ahead of those who do not, and among them the longest-standing subscriber is shown first. Priority Hire changes only the order in which equally-scored candidates are shown; it does not change any candidate’s match score, does not indicate greater suitability, and does not affect the employer’s responsibility for the hiring decision.
Retention of matching data
We retain matching data only for as long as needed and then delete it: a live match is kept while the role remains open; a retired match and its stored per-requirement breakdown are kept for 12 months from the date the match is retired; and periodic (monthly) snapshots are kept on a rolling 12-month basis. These periods are enforced automatically.
Workforce scores, signals and management features
Where an employer uses our workforce features and services — including AskSince, Career Memory, EvidenceLedger, AbsenceGuard, ExitSignal, SilentLoss, BlindSpot, SafeRef, PastTrack, TrustSig, TrustTag, the employer score and the TeamFit score — we process employment records and information about how individuals use their accounts to generate scores, signals, reports, references and documents. For these features the employer is the controller and Signals acts as its processor; where a score or output is placed on an individual’s own portable TeamFit profile or CV that the individual can control and share, Signals acts as a second, independent controller for that disclosure. These outputs are decision-support tools only and are subject to the automated-processing safeguards described above: they do not by themselves make decisions producing legal or similarly significant effects, and a human remains responsible for any employment decision. Some absence-related processing (AbsenceGuard) may involve health data, which is handled under the conditions and safeguards in our Appropriate Policy Document. Employers are responsible for using these features fairly and lawfully, including under equality and employment law, and for their own data protection assessments where they act as controller. Where a business uses Career Memory to search records about an individual, it operates only on information the individual has agreed to share by ticking the box provided; where special category data is involved, the sharing is based on the individual’s explicit consent, and the business undertakes not to share that information beyond its intended use.
How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected. On cancellation of an account, associated reporting data is deleted within 14 days. We may retain limited data for longer where required by law (for example, accounting records) or for the establishment, exercise, or defence of legal claims.
Where reasonably necessary for legal proceedings, regulatory investigations, or the establishment, exercise or defence of legal claims, we may place a litigation hold and retain relevant information beyond our normal deletion periods until the matter is resolved.
Where personal data is stored and international transfers
Our servers are located in the United Kingdom, the European Union, and the United States of America. Where personal data is transferred outside the United Kingdom, we ensure an adequate level of protection through UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.
Recipients of personal data
Other businesses and recruiters. A business or recruiter may access a record only where the employee who is the subject of the record has granted access. Authorisation is verified by the requesting party providing personal information necessary to conduct the search which could only have been supplied by the employee concerned. For such disclosures, Signals acts as an independent controller as described above.
Competent authorities. We may be required to disclose personal data to competent public authorities where the law requires it. Where lawfully permitted, we will notify you of any such requirement.
Processors and service providers. We use processors to deliver the services. They act only on our documented instructions, are contractually bound to obligations of security and confidentiality, and may not use your personal data for their own purposes. A list of the categories of processors involved is available on request.
Your rights
Right of access. You may request a copy of the personal data we hold about you, together with information about how it is processed. The first copy is provided free of charge; a reasonable fee based on administrative costs may apply to further copies or manifestly excessive requests.
Right to rectification. You may require us to correct inaccurate personal data and to complete incomplete personal data.
Right to erasure. You may request erasure of your personal data where it is no longer necessary for the purposes for which it was collected, where it has been unlawfully processed, or where erasure is required by law, subject to the exemptions in the UK GDPR (including freedom of expression and information, compliance with legal obligations, and the establishment, exercise, or defence of legal claims).
Right to restriction. You may request restriction of processing where you contest the accuracy of your data, where processing is unlawful and you prefer restriction to erasure, or where we no longer need the data but you require it for legal claims.
Right to object. You may object to processing carried out on the basis of our legitimate interests. We will cease that processing unless we demonstrate compelling legitimate grounds which override your rights.
Right to data portability. You may receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and may require its transmission to another controller where technically feasible.
Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
How to exercise your rights
You may exercise your rights by contacting us at legal@signals.ac, or through the provider with which you have a relationship. We may ask for proof of identity to verify that you are the data subject. We will respond within one month of receipt of your request; this may be extended by up to two further months for complex or numerous requests, in which case we will inform you of the extension and its reasons within one month. If we cannot act on your request, we will tell you why within one month. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, and to seek a judicial remedy.
Security
We implement appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure, and unauthorised access, including encryption of specific data and measures ensuring confidentiality, integrity, availability, and resilience of processing systems. Any personal data breach likely to result in a high risk to your rights and freedoms will be notified to you without undue delay, and to the ICO where required.
Where applicable, employment records and significant amendments to them are recorded with timestamps and audit information, so as to maintain the integrity and evidential value of the records.
Relationship with third-party providers
Where services are delivered jointly with a provider, responsibility for your personal data is allocated contractually between Signals and that provider. You may address requests or complaints either to the provider with which you have a relationship or directly to Signals; we cooperate with each provider to ensure your data is protected and your requests are answered efficiently.
Changes to this Policy
Changes to this Privacy Policy will be published on the Website with the date of last update. Material changes will be notified to account holders.
The website accessible at https://signals.ac/gb (the “Website”) is owned and operated by Signals AC Ltd, a private limited company registered in England and Wales under company number 13704164, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
Signals AC Ltd is registered with the Information Commissioner’s Office under registration number ZB253038. VAT registration number: 393 5125 86.
The Website is developed and maintained by Signals AC Ltd. Hosting infrastructure is located in the United Kingdom, the European Union, and the United States of America. Details of the safeguards applied to international data transfers are set out in our Privacy Policy.
Unless otherwise stated, all content on the Website, including text, graphics, logos, and software, is the property of Signals AC Ltd or its licensors and is protected by applicable intellectual property laws. No content may be reproduced without prior written consent, except as permitted by law.
Use of the Website and of any account is governed by our Terms and Conditions, which are presented in full during account creation and are available on request at any time.
For support or complaints, please use the contact form on the Website. We will acknowledge complaints promptly and respond within a reasonable period.
Our approach
Signals AC Ltd is designed around the requirements of the UK GDPR and the Data Protection Act 2018 as a default position, not as a layered-on policy.
Controller and processor roles
Employment records created and stored with Signals are portable. The business user that creates a record is the controller of that record and is responsible for its content and for the information identifying the employee; Signals acts as processor on the business user’s behalf, under the controller-to-processor agreement incorporated into the Privacy Policy and Terms and Conditions and accepted on account creation. Where the employee who is the subject of a record grants other businesses access to view it (a permission given by the employee, not by the original controller), Signals assumes the responsibilities and liabilities of a controller in order to facilitate that disclosure and acts as a second, independent controller of the data.
Signals becomes an independent controller only for the processing necessary to facilitate disclosures authorised directly by the worker; the original employer remains controller for the records it created and for its own ongoing processing activities. Where applicable, records and significant amendments are recorded with timestamps and audit information to preserve their integrity and evidential value.
Lawful basis
Employee profile data is processed on the basis of legitimate interests, namely the legitimate interests of employers, recruiters, and employees in creating, maintaining, sharing, and verifying employment records, and the legitimate interest of Signals in providing that service. We have carried out a Legitimate Interests Assessment balancing those interests against the rights and freedoms of the individuals concerned. Employees may opt in to, manage, and delete their own profile at any time from within the platform, and have the right to object to this processing at any time, as set out in the Privacy Policy.
Special category and HR data
Where the platform is used for HR functions and an employer includes special category data (for example limited health information to explain an absence), that data is processed under the conditions in Article 9 UK GDPR and Schedule 1 to the Data Protection Act 2018 identified in the Privacy Policy. Where a condition requires it, Signals maintains an Appropriate Policy Document, and employers are required to maintain their own. Signals has completed a Data Protection Impact Assessment and a Legitimate Interests Assessment for HR-related processing.
Next Hire matching
Where the Next Hire feature is used, Signals is the controller for building the candidate pool and scoring individuals who have not applied, and the employer becomes a controller once it receives an application for a vacancy. Matching relies on legitimate interests, supported by a Legitimate Interests Assessment, and any health or criminal offence data used in scoring is processed under the employment condition in Schedule 1 to the Data Protection Act 2018, for which Signals maintains an Appropriate Policy Document. A Data Protection Impact Assessment has been completed for this processing.
Position-based tracking
Workforce patterns are tracked against named positions within each business, not against identifiable individuals. Personal data does not leave the business in identifiable form.
Anonymisation before benchmark contribution
Before any data is contributed to the benchmark that powers comparisons, all identifying details are removed so that the contributed data no longer relates to an identifiable individual.
Data subject rights
Employees may access, export, and delete their own profile data at any time. On cancellation of an account, all associated reporting data is deleted within 14 days. Full details of data subject rights and how to exercise them are set out in our Privacy Policy.
Confidentiality undertaking
Signals AC Ltd undertakes not to disclose any details about an account holder, including confirming the existence or ownership of an account, without the account holder’s permission, except where disclosure is required by law or by a competent authority.
Precedence and governing law
If this statement conflicts with the Terms and Conditions, the Terms and Conditions prevail; if it conflicts with the Privacy Policy, the Privacy Policy prevails. This statement is governed by, and construed in accordance with, the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it.
1. Agreement and acceptance
These Terms and Conditions (the “Agreement”) are presented by Signals AC Ltd, a private limited company registered in England and Wales with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF (“Signals”), and govern your use of the Signals platform and services (the “Service”), however accessed. By activating a Signals account or using the Service you agree to be bound by this Agreement. If you do not agree, you must not use the Service.
If you enter into this Agreement on behalf of a company or other legal entity, you represent that you have authority to bind that entity and its affiliates, in which case “you” refers to that entity and its affiliates as well as to you personally. If you do not have such authority, or the entity does not agree to these terms, you must not accept this Agreement or use the Service.
The Signals Privacy Policy, including the controller-to-processor agreement set out in it, is incorporated into this Agreement by reference and is accepted by every business user on creating an account.
2. Additional terms
Additional services received from or through Signals may carry specific additional terms (“Additional Terms”), which form part of this Agreement upon your acceptance of those services.
3. Your control of the Service
You decide which Signals services to activate within your dashboard. Every change requires your approval before it takes effect; nothing is applied automatically.
4. Term and termination
This Agreement remains in effect for as long as you hold an active account. Signals may suspend your access and terminate this Agreement if you materially breach it and fail to cure the breach within 30 days of written notice (including by email), without prejudice to clause 17 (Suspension and content removal).
5. Modification of the Service or this Agreement
The Service may be made available in free or paid versions. Signals reserves the right to modify, add, or remove portions or functionality of the Service on a temporary or permanent basis. Signals may modify this Agreement at any time; you will be notified of any material modification. If you are dissatisfied with this Agreement, any modification to it, or the Service, your sole and exclusive remedy is to close your account.
6. Usage rights and restrictions
You shall not, and shall not authorise, encourage, or permit any third party to:
• use the Service to upload, transmit, or distribute any content that is unlawful, untruthful, defamatory, harassing, fraudulent, obscene, threatening, abusive, or hateful, or that contains viruses or malicious code;
• upload or enter content that is knowingly false, malicious, defamatory or discriminatory;
• upload content that has been unlawfully obtained, that infringes any person’s privacy, or that infringes the intellectual property or other rights of any third party;
• use the Service for any fraudulent or improper purpose, or in a manner for which it is not intended;
• use the Service to create records that are not factual;
• access another account holder’s personal Signals account to view records created about that account holder;
• print, copy, or retain records created by another user;
• decipher, decompile, delete, alter, or reverse engineer any of the software, except to the extent permitted by law;
• use any robot, spider, or other automated device or manual process to monitor or copy content from the Service, other than exporting data as contemplated in the documentation; or
• rent, lease, distribute, or resell the software; access or use the software or Service to develop a competing solution (or contract with a third party to do so); or remove or alter any logos, trade marks, or proprietary notices.
If you breach any of the above restrictions, Signals may suspend or terminate your account and will be entitled to recover from you its losses arising from the breach, together with reasonable legal and recovery costs. Signals may also remove offending content immediately in accordance with clause 17. Where you act on behalf of another party, Signals reserves the right to hold that party jointly responsible.
7. Account security and ownership
You are responsible for all activity carried out using your account and for maintaining its security. In particular you shall: keep passwords and other credentials secure and confidential; enable and maintain multi-factor authentication where the Service makes it available; ensure that only authorised personnel use your account; and notify Signals immediately if you suspect any unauthorised access to, or compromise of, your account. You remain responsible for activity carried out using your account unless it results from Signals’ failure to maintain reasonable security.
Account ownership. Business accounts belong to the subscribing organisation, not to any individual. Individuals who administer an account do so on behalf of that organisation. The organisation may add, remove or change administrators at any time, and an employee or other individual who leaves the organisation retains no ownership of, or right to access, the organisation’s account or its records.
Minimum age. Individuals who create, use or administer an account must be at least 16 years old.
8. The Service
Signals shall maintain commercially reasonable administrative, physical, and technical safeguards for the protection and security of the Service and your data. Signals shall not (a) disclose your data except as necessary to provide the core functions of the Service, where compelled by law, or as you expressly authorise in writing; or (b) access your data except to provide the Service, to prevent or address technical problems, or at your request in connection with support. Where Signals is compelled by law to disclose your data, it will notify you where legally permitted.
The Service is provided on a subscription basis. Access to the features included in your plan continues for as long as your subscription remains active. Coverage is not total, and not all searches will return a positive result; no additional charge arises from a search that returns no result.
Availability and maintenance. The Service may be subject to scheduled maintenance, emergency maintenance, upgrades and occasional temporary interruptions. Signals will use reasonable efforts to carry out planned maintenance outside peak hours and to minimise disruption. Reasonable maintenance, and temporary interruptions outside Signals’ reasonable control, do not constitute a breach of this Agreement.
Backups and continuity. Signals maintains commercially reasonable backup, disaster-recovery and business-continuity arrangements, including periodic backups and restoration procedures designed to protect against data loss and to restore the Service following an incident.
If you integrate with the Service via the API, you must use efficient programming that does not generate an excessive volume of requests in a short period, as reasonably determined by Signals. Signals may throttle API connections or suspend or terminate accounts in breach of this requirement. All connections to Signals servers must be secure and encrypted in transit. When using the API you shall: keep API credentials confidential and not share API keys; not attempt to bypass or exceed applicable rate limits; not probe, scan or access undocumented endpoints; not use the API for penetration testing without Signals’ prior written consent; and not scrape or extract data outside the intended functionality of the Service. Signals may revoke API credentials at any time where security reasonably requires.
Fair use. The Service, including its AI features, is provided for your legitimate business use. You must not use the Service or its AI features in a way that is excessive, disproportionate or abusive, that places an unreasonable load on the Service or on Signals’ systems or third-party providers, or that is designed to extract data or outputs beyond your normal use of the Service. Where your use appears to breach this fair-use expectation, or otherwise to abuse the Service or its AI features, Signals may investigate and may throttle, limit, suspend or restrict your access to the Service or to particular features, in accordance with clause 17. Signals will act proportionately and, where practicable, give you notice and an opportunity to remedy the position.
9. Customer content, accuracy and warranties
Signals does not verify, investigate or guarantee the accuracy, completeness or truthfulness of any information uploaded or entered through the Service. Responsibility for the content, accuracy and lawful creation of records rests entirely with the customer that created or uploaded them.
Your warranties. You warrant that, in respect of all information you upload or enter: (a) you have authority to upload it; (b) you have a lawful basis for processing it; (c) where special category data is processed, an appropriate condition under Article 9 UK GDPR applies; (d) the information is not knowingly false or misleading; and (e) uploading it does not infringe the rights of any third party.
Recruiter and third-party reliance. Recruiters and other third parties who access records through the Service remain responsible for carrying out their own due diligence and verification. Signals does not warrant the suitability of any individual and does not guarantee the completeness or accuracy of any employment record.
10. HR-related features
This clause applies where you use the HR-related features of the Service. It is in addition to, and does not limit, the other provisions of this Agreement.
Controller and processor roles. You are the controller of the HR records you create or upload and determine the purposes and means of that processing. You are responsible for its lawfulness, including for having a valid lawful basis and, where you process special category data, an appropriate Article 9 condition and any Appropriate Policy Document required by law. Signals is the processor for those records and acts only on your documented instructions under the controller-to-processor agreement. Where a worker grants another business access to a record about themselves, Signals acts as a second, independent controller in respect of that disclosure, as described in clause 11 and the Privacy Policy.
HR functionality. The HR-related features allow you to create and store employment records; record attendance, absence, conduct and performance information; upload supporting documents; and receive system-generated summaries, scores, flags and analyses inserted into a worker’s profile. You decide which features to activate and what data to upload.
Monitoring. Any monitoring carried out through the Service is for HR administration and compliance purposes, is not covert, and is governed by your own workplace monitoring and HR policies. Details of the related processing are set out in the Privacy Policy. Nothing in this Agreement constitutes, or is to be treated as, the consent of any worker to any processing or monitoring.
Your obligations. You shall comply with all applicable employment and data protection law; provide your workers with transparency about the monitoring and processing carried out through the Service, including its purposes and effect on employment; configure any monitoring proportionately and limited to what is necessary; not use the Service for excessive, disproportionate or covert surveillance; and maintain your own records of processing and, where required, your own DPIA, LIA and Appropriate Policy Document, and set proportionate retention periods for the records you control.
Employment decisions. Signals does not make employment decisions. Responsibility for recruitment, promotion, disciplinary action, absence management, dismissal, redundancy, appraisal, performance management and all other employment decisions remains solely with the employer.
Employee disputes. Signals is not responsible for determining factual disputes between employers and workers, and does not adjudicate disagreements about the accuracy, fairness or interpretation of employment records, except where required by law. Workers retain control over the visibility of records within the functionality provided by the Service and may choose to hide records from future disclosures where they disagree with their contents. This does not alter the historical record created by the employer, nor does it require Signals to determine the accuracy of disputed information.
Allocation of responsibility. Signals provides the tools; you determine the purpose and means of your HR processing. Signals is not responsible for your misuse of the Service or for any unlawful processing of HR data by you, and you are responsible for the lawful processing of HR data and for any employment decision or action you take using information available through the Service. This clause is without prejudice to the indemnity you give at clause 21.
Next Hire matching. Where you use Next Hire, individuals are scored against your role before they apply, and are reached through your staff’s professional connections to a depth of two. While a role is pooled you receive only a count; on a live vacancy you receive anonymous score bands and an indication that a candidate was reached via one of your team; you receive a candidate’s identity only when they apply. You shall not attempt to identify, contact or single out pooled individuals, or to circumvent the anonymity of the pooling and score-band stages. Your staff who introduce connections act on your behalf, and you are responsible for ensuring they are told, at the point of accepting an insider invitation, that a resulting match will be shown to you as having come via them.
Controller roles in Next Hire. Signals is the controller for building the candidate pool and scoring individuals who have not applied. You become a controller of an applicant’s data once you receive an application for a vacancy. Matching operates as an automated gateway only; you remain responsible for the human hiring decision in respect of any applicant.
Priority Hire. Where two or more candidates share the same match score, an optional candidate subscription (Advanced Features) causes those candidates to be shown ahead of non-subscribers, and the longest-standing subscriber first. This affects only the order in which equally-scored candidates are displayed to you; it does not change any candidate’s match score or indicate greater suitability, and you remain responsible for the hiring decision. The order in which candidates are shown is therefore influenced in part by candidates’ subscription status.
Applicant information. You agree not to share applicant information obtained through Next Hire, during or after the recruitment process, beyond the purpose for which it was provided, and not to retain any material for longer than is necessary for the recruitment process.
Career Memory searches. Where you use Career Memory to search records about an individual that the individual has agreed to share, you agree not to share information revealed during that search beyond its intended use.
11. Record lifecycle and controller roles
Records pass through a predictable lifecycle: the employer creates a record and controls it while using it for its own purposes; the worker who is the subject of the record is given access to it; and, when the worker leaves that employment, the historical record created by the employer remains attributable to that employer. Separately, the worker’s own profile continues under the worker’s control, and the worker may authorise future disclosures of records about themselves to other businesses.
Signals acts as an independent controller only for the processing necessary to facilitate disclosures authorised directly by the worker. For the records you created and for your own ongoing processing, you remain the controller.
12. Artificial intelligence and decision-support outputs
The Service uses artificial intelligence and automated processing to generate summaries, scores, flags, recommendations, benchmarks and analyses. These outputs are decision-support tools only. They are generated automatically from the information available to the Service and may contain inaccuracies or omissions. They are not statements of fact and must not be treated as professional, legal, employment or recruitment advice. You remain solely responsible for reviewing and validating AI-generated outputs before relying upon them or making any employment, recruitment or business decision.
Signals may improve, replace or withdraw AI models, algorithms, scoring methods and providers without notice where reasonably necessary to improve accuracy, performance, security or legal compliance.
AI features may occasionally be unavailable, or may produce different results, due to maintenance, model updates or interruptions in third-party services.
Nothing in this Agreement or the Privacy Policy requires Signals to disclose confidential algorithms, proprietary models, trade secrets or other intellectual property in order to satisfy its obligations relating to automated decision-making or to provide information about the logic involved.
Next Hire matching. Next Hire’s matching operates as an automated gateway that determines whether an individual is surfaced to you as a potential candidate; it does not make hiring decisions, which remain yours and are taken by a human. Candidates can see every requirement they are scored against and their per-requirement breakdown.
13. Payment terms
Subscription fees are payable in advance in accordance with the plan selected, and subscriptions renew automatically at the end of each billing period unless cancelled before the renewal date. All fees are exclusive of taxes and duties imposed by governing authorities. Other than sales taxes that Signals is required to collect and remit, you are solely responsible for all such taxes and duties. Signals may change its prices on not less than 90 days’ notice, or such longer period as applicable law requires; price changes take effect from your next renewal after the notice period. Referral payments may be requested once the account balance reaches the threshold specified in the user area and will be paid within five working days of the request.
Failed payments. If a payment fails (including a failed card payment or Direct Debit) or an invoice becomes overdue, Signals may suspend your access to the Service until payment is received in full, without prejudice to its other rights.
Refunds. Except where a refund is required by law, subscription fees are non-refundable.
Chargebacks. Where a chargeback is made that is not justified, Signals may suspend the Service, recover its reasonable costs arising from the chargeback, and require payment by an alternative method before reinstating access.
14. Intellectual property
As between the parties, Signals owns and retains all right, title, and interest in and to (a) the software and the Service, including all intellectual property rights therein, and (b) transactional and performance data relating to your use of the Service. Signals may collect, use, and disclose such transactional and performance data for its business purposes (including service optimisation and product marketing), provided such use does not reveal your identity, your confidential information, or any personal data belonging to you or your employees.
Anonymised and aggregated data. Anonymised datasets, aggregated statistical information, benchmarking data and industry metrics derived from use of the Service remain the property of Signals. Such datasets are created so that no individual or organisation can be identified from them.
Input data and AI outputs. As between the parties, you own the input data you provide. You may use AI-generated outputs relating to your own information for your internal business purposes. Signals retains ownership of the software, models and algorithms used to generate those outputs.
15. Confidentiality
“Confidential Information” means any non-public information disclosed by one party (the “Disclosing Party”) to the other (the “Receiving Party”) that is identified as confidential or that would reasonably be understood to be confidential given its nature and the circumstances of disclosure, including the Disclosing Party’s business, customers, pricing, and technical information. The Receiving Party shall keep the Confidential Information confidential, use it only to perform this Agreement, and disclose it only to those of its personnel and advisers who need to know it and who are bound by equivalent obligations of confidentiality.
These obligations do not apply to information that is or becomes public without breach of this Agreement, was lawfully known to the Receiving Party before disclosure, is lawfully obtained from a third party without restriction, or is independently developed without use of the Confidential Information. The Receiving Party may disclose Confidential Information to the extent required by law or a competent authority, giving the Disclosing Party reasonable notice where lawful. This clause does not affect either party’s obligations in respect of personal data, which are governed by the Privacy Policy and clause 16. The confidentiality obligations survive termination for a period of five years, and indefinitely in respect of trade secrets.
16. Data protection (Article 28) and sub-processors
This clause, together with the Privacy Policy, forms the data processing agreement between the parties for the purposes of Article 28 UK GDPR, and applies where Signals processes personal data on your behalf. You are the controller and Signals is the processor in respect of that personal data. Each party shall comply with its obligations under applicable data protection law.
Subject matter, duration, nature and purpose. The subject matter of the processing is the personal data contained in the records and other data you upload to, or generate through, the Service. The processing continues for the duration of your account and use of the Service, and thereafter only as required by law or as set out in the return-or-deletion and litigation-hold provisions below. The nature and purpose of the processing is the provision of the Service as described in this Agreement and the Privacy Policy, including storing, organising, analysing, sharing (as authorised) and otherwise handling employment and related records on your behalf.
Categories of personal data. The personal data may include identification and contact details, employment records, role and status, attendance and absence data, conduct and performance information, documents you upload, system-generated summaries and analyses, and, where you include it, special category data such as limited health information, and, in Next Hire, physical-capability (health) data and security-clearance and DBS (criminal offence) data used in scoring.
Categories of data subjects. The data subjects may include your workers (including current, former and prospective employees and contractors) and other individuals identified in the records you upload; and, in Next Hire, individuals scored against your roles who have not applied, reached through your staff’s professional connections.
Documented instructions. Signals shall process the personal data only on your documented instructions, including as set out in this Agreement and the Privacy Policy and as configured by you within the Service, unless required to process it by law, in which case Signals will inform you of that legal requirement before processing unless the law prohibits it. Signals shall inform you if, in its opinion, an instruction infringes applicable data protection law.
Confidentiality. Signals shall ensure that persons authorised to process the personal data are subject to binding obligations of confidentiality.
Security. Signals shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, including as appropriate encryption and measures to ensure the confidentiality, integrity, availability and resilience of processing systems, and processes for regularly testing and evaluating those measures.
Assistance with data subject rights. Taking into account the nature of the processing, Signals shall assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under applicable data protection law.
Assistance with compliance. Signals shall assist you in ensuring compliance with your obligations relating to security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with, and enquiries from, the Information Commissioner’s Office or other competent authority, taking into account the nature of the processing and the information available to Signals.
Personal data breaches. Signals shall notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and shall provide reasonable information and assistance to enable you to meet your own breach-notification obligations, as further described in clause 20.
Return or deletion. At your choice, Signals shall delete or return all the personal data to you after the end of the provision of the Service, and delete existing copies, save to the extent that retention is required by law or under the litigation-hold provision below.
Audit. Signals shall make available to you the information necessary to demonstrate compliance with this clause and shall allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable prior written notice and subject to appropriate confidentiality, security and frequency limitations.
Sub-processors. You give Signals general written authorisation to engage sub-processors to deliver the Service. Signals shall impose data protection obligations on each sub-processor equivalent to those set out in this clause by written contract, and remains responsible for the performance of its sub-processors. A list of the categories of sub-processors is available on request, and Signals shall inform you of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data protection grounds.
International transfers. Where Signals transfers personal data outside the United Kingdom, it shall ensure an adequate level of protection through UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, as described in the Privacy Policy.
Litigation hold. Signals may retain relevant personal data beyond its normal deletion periods where reasonably necessary for legal proceedings, regulatory investigations, or the establishment, exercise or defence of legal claims.
17. Suspension and content removal
In addition to its other rights under this Agreement, and notwithstanding any cure period stated elsewhere, Signals may immediately suspend access to, or remove, content or an account where reasonably necessary to: comply with law or a request from a competent authority; protect the rights, safety or personal data of any individual; protect the security, integrity or availability of the Service; investigate suspected abuse or breach of this Agreement; or prevent or address a security risk. Where Signals does so, it will, where lawful and practicable, notify you and, where appropriate, restore access once the issue is resolved. Signals shall not be liable for any temporary interruption of the Service resulting from a lawful suspension carried out under this clause.
18. Warranties and disclaimers
Signals represents, warrants, and covenants that: (a) the Service will perform substantially in accordance with its published specifications; (b) the provision of the Service will comply with all privacy and data protection laws applicable to its business; (c) it will not sell personal information you provide and will retain, disclose, or use it only to provide the Service; and (d) any professional services will be performed in a professional and workmanlike manner with reasonable skill and care.
Disclaimer. Except as expressly stated in this Agreement, and to the fullest extent permitted by law, the Service is provided “as is”, and Signals excludes all other warranties, conditions and terms, whether express or implied by statute, common law or otherwise, including any implied terms as to satisfactory quality, fitness for a particular purpose, or non-infringement. Signals does not warrant that the Service will be uninterrupted or error-free, that all defects will be corrected, or that coverage will be total or any search will return a result.
AI outputs and customer information. Without limiting the above, Signals does not verify customer-supplied information (clause 9), and AI-generated outputs are decision-support tools only, which may be inaccurate and may be unavailable or vary, as set out in clause 12.
Illustrative materials. Case studies, examples, illustrations, estimated savings, projected outcomes, sample reports and benchmarks provided by Signals are illustrative only, depend on your own implementation and circumstances, do not constitute guarantees, and must not be interpreted as promises of future performance.
Guarantees. Any guarantee we give in respect of the Service or its outcomes applies only where employees and employee records have been correctly added to, and maintained in, the system.
Nothing in this Agreement excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence or for fraud.
19. Limitation of liability
(a) Liabilities not excluded. Nothing in this Agreement excludes or limits either party’s liability for: death or personal injury caused by negligence; fraud or fraudulent misrepresentation; a party’s breach of the confidentiality obligations in clause 15; the indemnities given in clause 21; a party’s deliberate breach; or any other liability that cannot lawfully be excluded or limited.
(b) Excluded losses. Subject to paragraph (a), neither party is liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any loss of profit, revenue, sales, business or anticipated savings; loss of goodwill; loss or corruption of data (except to the extent arising from a party’s breach of its data protection obligations); or any indirect, special or consequential loss.
(c) Aggregate cap. Subject to paragraphs (a) and (b), each party’s total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total subscription fees paid or payable by you under this Agreement in the twelve (12) months immediately preceding the event giving rise to the claim (or, where the claim arises in the first twelve months, the fees paid or payable in that period).
20. Security breach
External breach. In the event of accidental, unauthorised, or unlawful destruction, loss, alteration, disclosure of, or access to personal data (a “Security Breach”) affecting personal data you maintain through the Service, perpetrated by anyone other than your employees, contractors, or agents, Signals will upon discovery (a) initiate remedial action compliant with applicable law and consistent with industry standards; and (b) notify you of the breach, its nature and scope, the remedial actions to be undertaken, and the expected timeline, in accordance with applicable law. You remain responsible for your own obligations under applicable law.
Internal breach. Where a Security Breach is perpetrated by your affiliate, employee, contractor, or agent, or results from your failure to maintain your systems, network, or data securely, you are solely responsible for remedial action and shall notify Signals immediately of the breach and the steps you will take. Signals may take reasonable action, including suspending your access, to prevent harm to you, Signals, the Service, or third parties, and, to the extent permitted by law, shall not be liable for losses you incur as a result of such reasonable action.
Your cooperation. In the event of a Security Breach, you agree to cooperate reasonably with Signals, provide relevant information, assist with investigations, and take reasonable steps to mitigate the effects of the breach.
21. Indemnification
You agree to indemnify, defend, and hold harmless Signals and its subsidiaries, affiliates, officers, directors, agents, and employees from and against any costs, damages, expenses (including reasonable legal fees), judgments, losses, and other liabilities arising from any third-party claim to the extent arising from (a) your use of the software or Service in violation of this Agreement, or (b) any employment decision or action you take based on information available through your use of the Service.
Signals agrees to indemnify, defend, and hold harmless you and your affiliates, officers, agents, and employees from and against any liabilities arising from any third-party claim alleging that your use of the software or Service in accordance with this Agreement infringes the intellectual property rights of a third party; except that Signals shall have no such obligation in respect of (a) use of the software or Service in modified form or in combination with materials not furnished by Signals, or (b) content, information, or data provided by you, your end users, or other third parties.
22. Force majeure
Neither party is liable for any failure or delay in performing its obligations under this Agreement (other than an obligation to pay money) to the extent caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, epidemic or pandemic, fire, flood, failure of utilities or telecommunications, and failure of third-party networks or infrastructure. The affected party shall notify the other, use reasonable efforts to mitigate the effect, and resume performance as soon as reasonably practicable. If the event continues for more than 60 days, either party may terminate this Agreement on written notice.
23. Dispute resolution
(a) Negotiation. If a dispute arises out of or in connection with this Agreement, the parties shall first attempt in good faith to resolve it through negotiation between senior representatives within 30 days of written notice of the dispute.
(b) Mediation. If the dispute is not resolved by negotiation, the parties shall attempt to settle it by mediation in accordance with the CEDR Model Mediation Procedure before commencing court proceedings. Unless otherwise agreed, the mediator will be nominated by CEDR, and the mediation will take place in London.
(c) Court proceedings. If the dispute is not resolved within 60 days of the start of the mediation, or either party fails to participate, either party may bring proceedings in the courts of England and Wales in accordance with clause 24. Nothing in this clause prevents a party from applying to the courts at any time for urgent interim or injunctive relief.
24. Governing law and jurisdiction
This Agreement is governed by, and construed in accordance with, the law of England and Wales. Subject to clause 23, the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement.
25. General provisions
Entire agreement. This Agreement constitutes the entire agreement between you and Signals with respect to its subject matter and supersedes all prior representations, agreements, and understandings, written or oral. No purchase order or other form submitted by you will vary the terms of this Agreement.
Assignment. You may not assign, transfer, sub-contract or otherwise deal with any of your rights or obligations under this Agreement without Signals’ prior written consent. Signals may assign, transfer or novate its rights and obligations to an affiliate or to a successor in connection with a merger, reorganisation or sale of the relevant business or assets, on notice to you.
Notices. Notices under this Agreement must be in writing. Notices to Signals may be sent to legal@signals.ac; notices to you may be sent to the email address associated with your account or displayed in the platform. Notices are deemed received on the next business day after sending by email, unless a delivery failure is received.
Waiver. No failure or delay by a party to exercise any right or remedy is a waiver of that or any other right or remedy, and no single or partial exercise prevents any further exercise. A waiver is effective only if in writing.
Third-party rights. Except where expressly stated (including the indemnities in favour of Signals’ affiliates, officers and personnel), a person who is not a party to this Agreement has no rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.
Survival. Any provision that by its nature is intended to survive termination — including clauses 9 (Customer content, accuracy and warranties), 12 (Artificial intelligence), 14 (Intellectual property), 15 (Confidentiality), 16 (Data protection and sub-processors), 18 (Warranties and disclaimers), 19 (Limitation of liability), 21 (Indemnification), 23 (Dispute resolution) and 24 (Governing law) — survives termination or expiry of this Agreement.
Severability. If any provision of this Agreement is found invalid or unenforceable by a court of competent jurisdiction, the remainder shall be interpreted so as best to effect the intention of the parties, and the validity and enforceability of the remaining provisions shall not be affected.
Relationship of the parties. Nothing in this Agreement creates any partnership, joint venture, agency or employment relationship between the parties.
Examples. Any names, businesses or data shown in the Service for illustration — including any reference to ‘Angus’ or ‘Angus Production’ — are examples only and do not refer to, or represent, any real person or business.
26. Further documentation available on request
The Article 28 UK GDPR data processing terms that apply where Signals processes personal data on your behalf are set out in full in clause 16 of this Agreement. In addition, the following documents are available separately and on request, and where applicable supplement this Agreement:
• an AI Usage Policy explaining the operation and limitations of the AI features in more detail than the Privacy Policy;
• a Security Overview describing our technical and organisational security measures;
• a Sub-processor Register listing our processors and the procedure for notifying changes;
• an Appropriate Policy Document for special category and criminal offence data;
• the Legitimate Interests Assessment and Data Protection Impact Assessment for Next Hire matching, in summary form; and
• a Law Enforcement and Disclosure Policy setting out how we handle legal requests for data.
To request any of these documents, contact us at legal@signals.ac.
27. Employer features and additional services
This clause describes optional employer features and additional services, which may be subscribed to individually or together as the Risk Reduction Infrastructure. They are subject to this Agreement, including the data processing terms in clause 16 and the artificial intelligence provisions in clause 12. Unless stated otherwise, you are the controller of your workforce records and of your use of these features, and Signals acts as your processor; where an output is placed on an individual’s own portable profile or CV that the individual can control and share, Signals acts as a second, independent controller for that disclosure, as described in clause 11 and the Privacy Policy. Scores, signals, references and generated documents are decision-support tools only, may be inaccurate, and do not replace your own judgement; you remain responsible for all employment decisions and for using these features fairly and lawfully, including under equality and employment law.
AskSince. An optional paid feature that uses artificial intelligence to answer questions about, and generate documents from, your workforce records for your internal use. Generated documents are drafts for your review; you must check them before use and are responsible for their content and use.
Career Memory. An optional feature that uses artificial intelligence to answer questions about an individual’s employment records. You may use it to search records about an individual only where that individual has agreed to share them, by ticking the box provided, and it operates only on the information the individual has agreed to share. Answers are decision-support only, may be inaccurate, and do not replace your own judgement. Your confidentiality undertaking for Career Memory searches is in clause 10.
Branches. Where your organisation operates branches, those branch accounts are owned by and form part of your main account, and the account-ownership provisions in clause 7 apply to them.
PastTrack. Uses employment dates you enter to confirm the dates recorded on an employee’s profile. You are responsible for the accuracy of the dates you provide.
TrustSig. A free feature that generates an email signature from an employee’s details for the employee’s use.
TrustTag. A banner that displays your employer score.
Employer score. A score assigned to your organisation, derived from your use of the Service and related information. It is intended as an indicator only.
Employee TeamFit score. A score assigned to an individual based on actions taken through their account. It appears on the individual’s TeamFit profile and CV, is a decision-support indicator only, and does not determine any employment decision.
EvidenceLedger. Creates a shared employment record of reviews, warnings, achievements, training and other evidence, to help you demonstrate fair and consistent management. You are responsible for the accuracy and fairness of the records you enter.
AbsenceGuard. Produces an attendance-related score from absence records, shown on the employee’s TeamFit profile and CV. Because absence data can include health information and some absence is legally protected (for example disability-related absence, or pregnancy and maternity), you must configure and use AbsenceGuard so that such absences are appropriately excluded or adjusted, must not use the score as the sole basis for any decision, and remain responsible for compliance with equality and employment law.
ExitSignal and SilentLoss. Identify early signs, from actions taken through an employee’s account, that an employee may be considering leaving (ExitSignal) or disengaging (SilentLoss), so that you can offer support. These are predictive indicators only; they may be wrong, must not be used to the employee’s detriment or as the sole basis for any decision, and their use should be proportionate and transparent to employees.
BlindSpot. Uses monthly employee feedback to produce an artificial-intelligence-generated report, displaying employee feedback in anonymised form. You must not attempt to re-identify individuals from the feedback, and you should be aware that in small teams anonymised feedback may still be identifiable.
SafeRef. Turns an employee’s performance reviews and achievements into an artificial-intelligence-generated professional reference, written in the third person, citing the records as the source and identifying the employer. The reference is reviewed by the employee, who decides whether to use it; it is not reviewed or approved by you, and it reflects the records held rather than a reference authored or endorsed by you. It is presented as derived from those records and may be inaccurate; you remain responsible for the accuracy and fairness of the underlying records you enter.
Subscriptions. These features may be subscribed to individually or together as the Risk Reduction Infrastructure. Fees, billing and renewal are governed by clause 13. Where you act as controller, these features are conditional on your maintaining your own lawful basis and, where applicable, your own data protection impact assessment and appropriate policy document for the processing you carry out. On subscription, we provide, in your name and pre-populated for the features you enable, a legitimate interests assessment, a data protection impact assessment and an appropriate policy document, for you to review and adopt as your own records.
