Skip to content
W3Bullhorn
Book a demo
W3Bullhorn
Book a demo

Legal

Data processing

Your candidate data never reaches us. This page explains why, and covers the narrow case where we do process something on your behalf.

Last updated: 22 October 2026

If your procurement or legal team has asked for a data processing agreement, start here. The short version is that there is far less to process than a job-board integration usually involves, and we would rather show you why than hand you a document that describes a relationship we do not have.

The architecture, which is the whole answer

W3Bullhorn runs on your own WordPress site and connects directly to your own Bullhorn account using credentials your Bullhorn administrator issues to you. There is no relay, no middleware and no server of ours in the path.

So when a candidate applies for one of your roles, their name, their CV, their answers and their consent record travel from your website to your Bullhorn. They do not pass through us, and we hold no copy. There is no account we could log into to read your candidates, because there is nothing to read.

That is a design decision rather than an accident, and it is the reason this page is short. A vendor who routes your applications through their own infrastructure has to account for a great deal in a DPA. We do not, because we never receive the data.

What this means for your paperwork

  • You are the controller of your candidate and client data, as you were before.
  • We are not your processor for it, because we do not process it on your behalf or on any other basis. The software processes it on your own infrastructure, under your control — which is the same relationship you have with WordPress itself, or with your theme.
  • Bullhorn is your processor for what sits in Bullhorn, under whatever agreement you already hold with them. That agreement is unaffected by using our plugin.
  • Your hosting provider is your processor for what sits on your website, under your agreement with them.

If your process requires a signed DPA regardless — and some procurement processes do, whatever the architecture — say so and we will work to it rather than argue about it. The two cases below are the ones it would genuinely cover.

Where we genuinely do process something

Two narrow cases, and we would rather name them than let you discover them.

1. Support and setup access

When we install the plugin, configure your field mapping, or investigate a support request, you may give us access to your WordPress site or your Bullhorn account. While we have that access we can see what an administrator can see, which may include candidate records.

In that situation we are acting on your instructions, and we commit to the following:

  • We use the access only for the work you have asked for, and we do not browse your data for any other reason.
  • We do not copy candidate records out of your systems. If we need a sample to reproduce a problem, we will ask, and we will prefer anonymised or test data.
  • We ask for the lowest level of access that does the job, and we ask you to remove it when the work is finished.
  • The people who hold that access are bound to keep it confidential.
  • We tell you promptly if we become aware of a breach affecting your data, with what we know, so you can meet your own notification duties.
  • We will help, within reason, if you receive a subject access or deletion request that touches work we did.

You can withdraw access at any time, and nothing about the plugin stops working when you do.

2. Licence checks

Your site contacts us to verify its licence and look for updates. That request carries the licence key, the website address, an installation identifier, which environment the site reports itself as (production, staging and so on), the versions of the plugin installed, and the PHP and WordPress versions in use. The installation identifier is a random value generated once and stored on your site; it exists so that one website presenting forty different installations is visible to us as abuse, and it gates nothing. Like any web server, ours also sees the IP address the request came from.

That is the complete list. There is no channel on which job, candidate or application data could travel, and nothing is counted or metered. The website address is business information rather than personal data, but it is yours, so we have said what we receive.

Sub-processors

For the narrow processing above, and for our own records of your order:

  • StableServer — hosts this website, our order records and our licence records. The server is in India.
  • Razorpay — takes payment, on its own secure screen. An Indian company.

That is the whole list. We run no analytics, no advertising, no chat widget and no email marketing platform, so there is no supplier behind any of those either. We will tell you before adding a sub-processor that would touch anything of yours.

Where the data is

Your candidate data is wherever you and Bullhorn have agreed it should be. We have no say in it and no copy of it.

What we hold — your order, your licence record, your enquiries — is in India, because that is where we are and where our host’s server is. If you are in the UK or the European Economic Area, note that India is not the subject of a UK or EU adequacy decision; we are not relying on one, and we are not going to claim standard contractual clauses we do not have. Our privacy policy sets out what we rely on instead, and what we hold and for how long.

Security

For what we hold: the site is served over an encrypted connection throughout, access to the systems holding orders and enquiries is restricted to the people who need it, and card details never reach our server because Razorpay takes payment on its own screen. No system is completely secure and we will not pretend otherwise.

For what runs on your site: the plugin adds no third-party scripts and sets no tracking cookies. It does register WordPress REST routes, as plugins with an admin interface do — these are administrative, each behind a permission check, and none of them is a public endpoint. A security review is welcome, and our developer documentation is public so your team can read how it behaves before you buy rather than after.

Audits and questionnaires

We are a small company and we will not claim certifications we do not hold. We do not have ISO 27001 or a SOC 2 report. If your process requires one, tell us early, because that is a real answer you need before you spend time on anything else.

What we will do is answer a security questionnaire honestly, walk your team through the architecture above, and put the commitments on this page into whatever form your process needs.

Contact us

Data protection questions, or a request for a signed agreement: hi@bullhornforwordpress.com. Tell us what your process needs and we will work to it.