Skip to content

Data Sharing Agreement (Controller to Controller)

Controller-to-controller terms governing Verification disclosures.

Version 1.0 · In effect from 15 October 2026 · Current page

1. What this Agreement is, and what it is not

1.1 Scope

This Agreement governs one thing: the disclosure by SkillSwap Ltd, trading as Lemma, HE 475899, registered office Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus (the "Company") to the API Client of personal data about a Candidate through the Verification API. It is Schedule 1 to the Verification Services Agreement.

1.2 Each party is an independent controller

For that disclosure, each party is a separate and independent controller (GDPR Art. 4(7)). Neither processes on the other's behalf, and neither is a joint controller: they do not jointly determine purposes and means (Art. 26), and each answers separately to data subjects and supervisory authorities.

1.3 This is not an Article 28 relationship

This is not a processor arrangement and Art. 28 GDPR does not apply to it. The reasoning matters, so it is stated plainly:

1.3.1 The Company decides, for its own purposes, what an SCI is, how it is computed, what evidence feeds it and what a response contains — not on the Client's instructions. 1.3.2 The Client decides, for its own recruitment purposes, whether to request a Verification and how it feeds a decision — not on the Company's instructions. 1.3.3 The parties pursue different purposes, hold different lawful bases and set their own retention periods.

Where the Company genuinely does process on the Client's documented instructions — principally Assessment Invites, where the Client supplies candidate contact data, and Client-configured assessment content — that processing is governed by the Data Processing Agreement (Schedule 2). The two instruments are separate and must not be read as one.

2. Data disclosed and purposes

2.1 Categories of data subjects

Candidates: Users who, when granting consent, confirmed they are 18 or over and gave explicit consent to disclosure to that API Client's organisation by name. No data about any person under 18 is disclosed, in any circumstances.

2.2 Categories of personal data

2.2.1 identifiers: display name and Lemma profile identifier; 2.2.2 per skill on the Candidate's record: the SCI value, the skill's level and verification tier, the date the SCI was computed, the date of the most recent evidence (from which staleness under section 5 of the SCI Methodology & Rights Notice can be read) and, for a single-skill lookup, the date it was last verified; 2.2.3 supporting evidence summaries: counts of Sessions as learner and as teacher, assessments passed, peer confirmations and connected external work, and (for a single-skill lookup) the total number of Evidence Events.

Nothing is returned for a Candidate without an active consent for the Client's organisation: the API answers as if no such person exists.

2.3 No special categories

The Company does not disclose special category data (Art. 9) or criminal offence data (Art. 10), and does not disclose messages, AI Tutor conversations or raw assessment responses. Sessions are not recorded.

2.4 Specified Purpose

The Client may use the data only to assess a named Candidate's skills for a specific, stated role, engagement or programme for which that Candidate has applied or is being considered (the "Specified Purpose"). Any other purpose needs a new lawful basis and a new agreement.

3. Lawful bases

3.1 The Company

The Company discloses on the Candidate's explicit consent under GDPR Arts. 6(1)(a) and 22(2)(c). That consent is separate, opt-in, given to one named organisation at a time, never bundled into acceptance of the Terms of Service, and freely revocable in the Candidate's account settings. The Company treats the SCI as an automated decision within Art. 22, following C-634/21 SCHUFA (7 December 2023).

3.2 The API Client

The Client determines and records its own lawful basis for obtaining and using the data — commonly Art. 6(1)(b) or Art. 6(1)(f) with a documented balancing test. The Candidate's consent to the Company authorises the disclosure; it does not supply the Client's basis for use.

3.3 Records

Each party keeps its own record of processing activities (Art. 30) and can produce it on request.

4. Purpose limitation and onward transfer

4.1 The API Client must not use the data for anything other than the Specified Purpose.

4.2 It must not reuse the data in an unrelated context — tenancy, lending, credit, insurance, immigration, benefits, membership, policing, or any general assessment of trustworthiness or social standing. This constraint is what keeps the SCI outside the social-scoring prohibition in Art. 5(1)(c) of the EU AI Act, Reg. (EU) 2024/1689.

4.3 It must not combine the data with Art. 9 special category data — racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life, sexual orientation — or with age, sex, disability or nationality, to score, rank or filter Candidates.

4.4 Onward transfer is prohibited. The Client must not sell, licence, publish, syndicate or otherwise disclose the data to a third party, with two narrow exceptions: (a) its own processor, engaged under a written Art. 28(3) contract and bound to this clause 4; and (b) disclosure compelled by binding law, where it tells the Company first unless legally prevented.

4.5 It must not use the data to train, fine-tune, evaluate or benchmark any model, or to build a competing score.

5. Transparency — the Client's own notice

5.1 Because it receives the data from the Company rather than from the Candidate, the API Client owes its own Art. 14 GDPR information duty. It must give that notice within one month of receiving the data, or at first communication with the Candidate if sooner (Art. 14(3)).

5.2 The notice must contain everything Art. 14(1)–(2) requires and must say expressly that the data came from Lemma, operated by the Company, together with the information required by clause 6.

5.3 The Client must also tell Candidates, at or before the point it uses Lemma in a process, that it does so.

6. Article 22 flow-down

6.1 The Client must not make a decision producing legal effects concerning a Candidate, or similarly significantly affecting them, based solely on automated processing including an SCI (GDPR Art. 22(1)).

6.2 Every adverse outcome — rejection, non-progression, non-engagement or any similarly significant result — must receive human review by a person competent, authorised and genuinely able to reach a different outcome. Rubber-stamping is not review. The Client must record that it happened and who did it, and must give the Candidate a route to express a point of view and contest the outcome (Art. 22(3)).

6.3 The Client must also tell the Candidate that the SCI itself can be reviewed and appealed with the Company through its documented SCI Review & Appeal process, at privacy@getlemma.io, and point them to the SCI Methodology & Rights Notice, which explains the inputs, the points each can add, the Freshness rules, and what would have to change for the score to differ — the counterfactual approach required by C-203/22 Dun & Bradstreet (27 February 2025).

7. Data subject requests and mutual assistance

7.1 Each party handles requests addressed to it about its own processing, within the statutory time limits (GDPR Arts. 12, 15–22). Neither responds on the other's behalf.

7.2 A party receiving a request that clearly relates to the other's processing will tell the data subject where to direct it and notify the other party within five working days.

7.3 Each party will give the other free, reasonable assistance where needed to answer a request, meet a supervisory authority's demand or complete a data protection impact assessment, and will not state anything about the other's processing it has not verified with them.

8.1 The Company will tell the API Client without undue delay if it corrects or withdraws an SCI after disclosure, or if the Candidate withdraws consent. A withdrawal of consent, including by closing the account, is notified at once through the consent_revoked webhook event, which the Client must subscribe to; a correction or withdrawn SCI is notified by email to the Client's technical contact.

8.2 On receiving such a notice the Client must, without undue delay, stop relying on the affected data, correct or delete its copy as the notice directs, and re-open any decision that turned on the data where the outcome may have been affected.

8.3 Consent withdrawal immediately stops all future Verifications about that Candidate. It does not retrospectively invalidate a disclosure lawfully made before withdrawal. Each party keeps the data it holds accurate for its own purposes (Art. 5(1)(d)).

9. Retention and deletion by the Client

9.1 The API Client must delete or irreversibly anonymise the data once the Specified Purpose is complete, or on termination of the Verification Services Agreement, whichever is earlier. It may retain beyond that only where a binding law requires it, for the required period and purpose, with access restricted.

9.2 In any event the Client must delete or irreversibly anonymise the data no later than 90 days after disclosure, or at the end of the recruitment process for which it was obtained if earlier, unless a binding law requires longer (clause 9.1).

9.3 Caching is permitted only within that period, and a cache must honour a clause 8.1 notice.

10. Security

10.1 Each party implements measures appropriate to the risk for the data it holds (GDPR Art. 32) — encryption in transit and at rest, need-to-know access control, logging and staff confidentiality. The Client must protect API credentials as Developer API Terms clause 3 requires.

10.2 The Company's measures are set out in Annex II to the Data Processing Agreement and apply equally here.

11. Personal data breach

11.1 A party suffering a personal data breach affecting data shared under this Agreement will notify the other without undue delay and in any event within 48 hours of becoming aware of it, describing so far as known the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, and measures taken or proposed.

11.2 Each party makes its own notifications to its supervisory authority (Art. 33) and to affected data subjects (Art. 34). The parties will cooperate, and neither will delay a statutory notification while waiting for the other.

11.3 The Company's supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia), tel +357 22 818 456, commissioner@dataprotection.gov.cy, www.dataprotection.gov.cy.

12. International transfers by the Client

12.1 If the Client transfers the data outside the EEA it does so as controller and is responsible for the transfer's lawfulness under GDPR Chapter V.

12.2 It must rely on an adequacy decision, the 2021 Standard Contractual Clauses (Implementing Decision (EU) 2021/914), or another Chapter V mechanism, with a transfer impact assessment where required.

12.3 Where the Client relies on the EU–US Data Privacy Framework, it must confirm the recipient's current certification for the relevant data category and keep 2021 SCCs in place as a fallback. The DPF was upheld in T-553/23 Latombe (3 September 2025), but that judgment is under appeal to the Court of Justice (lodged 31 October 2025, pending), so reliance on it alone is imprudent.

12.4 The Client will tell the Company on request which mechanism it relies on, and for which destinations.

13. Audit and evidence of compliance

13.1 Once in any twelve-month period, on 30 days' written notice, the Company may ask the Client to certify compliance in writing and to provide supporting evidence — its Art. 14 notice, retention schedule, human-review records for a sample of decisions, and transfer mechanisms.

13.2 Where the Company reasonably believes this Agreement has been breached it may require a targeted inspection during business hours, without unreasonable disruption, subject to the Client's confidentiality and security requirements, and may use an independent auditor bound by confidentiality. Each party bears its own costs unless a material breach is found, in which case the Client bears the Company's.

14. Term, termination and consequences

14.1 This Agreement starts and ends with the Verification Services Agreement. Either party may terminate it immediately if the other commits a material breach not cured within 30 days, or where continuing to share data would be unlawful.

14.2 The Company may suspend disclosures immediately, without a cure period, where it reasonably believes the Client is breaching clause 4, 6 or 9.

14.3 On termination the Client must comply with clause 9. Clauses 4, 6, 8.2, 9, 11, 13 and 15 survive.

15. Liability between independent controllers

15.1 Each party is responsible for its own compliance and bears its own regulatory fines and its own liability to data subjects for its own processing.

15.2 Art. 82(4) lets a data subject claim full compensation from either controller involved in the same processing. A party paying more than its share may recover the excess from the other in proportion to that other's responsibility (Art. 82(5)).

15.3 Each party indemnifies the other against losses, fines and reasonable costs to the extent caused by its own breach. The cap and carve-outs in Verification Services Agreement clause 11 apply.

16. Governing law

16.1 This Agreement is governed by the laws of the Republic of Cyprus, and clause 16 of the Verification Services Agreement applies to disputes under it. Nothing here limits a data subject's rights under the GDPR or Cyprus Law 125(I)/2018, including the right to complain to a supervisory authority and to a judicial remedy.