As an Education Recruitment Agency handling sensitive candidate files, Enhanced DBS disclosures, and Right-to-Work documents, your candidates' data is protected by UK-hosted infrastructure, robust international transfer mechanisms, and strict data processing agreements.
A documented, encrypted pipeline from your agency to our Operations Desk.
You drop candidate details via WhatsApp. We instantly generate an encrypted portal for secure upload.
Supabase (AWS London, eu-west-2) & Vercel (London Serverless, LHR). AES-256 Encryption, Row Level Security (RLS).
Strictly authenticated access. Nigeria operations protected by IDTA safeguards.
A compliance manager seeing “sole trader, Lagos” next to DBS records and Right-to-Work passports will naturally ask how your agency stays compliant. Because Nigeria currently has no UK adequacy decision, viewing files from Nigeria constitutes a restricted transfer under UK GDPR. Here is our exact legal and technical framework upfront.
Under Section 17A of the Data Protection Act 2018, Nigeria has no UK adequacy regulations. Therefore, international file access is governed under Article 46 by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs) issued by the Information Commissioner’s Office under s.119A DPA 2018.
Alongside the IDTA, we supply a pre-completed Transfer Risk Assessment (TRA) documenting that the local legal regime (including the Nigeria Data Protection Act 2023) does not undermine data subject rights, backed by strict supplementary technical measures.
Under the UK Data Protection (Charges and Information) Regulations 2018, the legal duty to register and pay a data protection fee applies to UK Data Controllers (your recruitment agency).
Because Dextro operates as an overseas Data Processor established outside the UK with no UK branch or establishment, Dextro is not eligible or required to pay ICO registration fees directly. Instead, your agency retains regulatory custody, while Dextro is contractually bound to UK GDPR Article 28 and Chapter V processor duties via our bilaterally executed IDTA and DPA.
Official IASME Cyber Essentials badges require a UK-registered corporate entity. However, our workstation and operational controls are engineered to strictly mirror the 5 Core Themes of Cyber Essentials:
The ultimate protection against international data risk is architectural: no candidate documents ever touch local storage in Nigeria.
All teacher CVs, DBS certificates, and ID documents reside strictly in UK cloud infrastructure (Supabase AWS London / Microsoft Graph). Our operators inspect files exclusively through ephemeral, memory-only browser sessions. Local downloads, USB exports, and file caching to workstation hard drives are prohibited by policy and blocked by browser configuration.
Once clearance is finalized, documents sync directly to your agency’s Microsoft OneDrive tenancy and are permanently purged from transient UK buffers after 30 days.
We believe that addressing restricted transfers before you ask builds trust. We provide fully drafted, standardized UK IDTA, DPA, and Transfer Risk Assessment documentation aligned with official ICO templates. However, Miracle Obatare and Dextro are compliance practitioners, not solicitors or data protection attorneys.
Because data protection governance varies across school trusts and local frameworks, we always advise: get the transfer paperwork checked by your agency’s legal counsel or external Data Protection Officer (DPO) prior to onboarding.
We enforce strict engineering and personnel protocols to ensure client data is securely managed.
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. We utilize Supabase (PostgreSQL) running on UK-hosted cloud infrastructure to ensure data sovereignty.
We implement strict Row Level Security (RLS) policies. This means that at the database level, queries are strictly constrained by tenant IDs to ensure complete data isolation between accounts.
We utilize cryptographically secure UUIDs for all resource endpoints. Serverless compute and database operations are pinned to the UK (London / eu-west-2) region, avoiding non-UK hops for candidate data while leveraging edge DDoS mitigation and SSL termination.
Our remote operators undergo identity verification and reference checks. We enforce a strict Clean Desk Policy and utilize operational workspace policies that prohibit the local storage or downloading of any client files.
Our infrastructure undergoes automated dependency scanning and regular security reviews that follow the Cyber Essentials controls and ICO guidance (certification planned).
Timestamped audit logging of every document review, statutory verification, and administrative status update. Access logs are actively monitored to ensure only authorized personnel interact with client endpoints.
We provide complete transparency before you even start your pilot.
Under UK GDPR, you remain the Data Controller. Dextro acts exclusively as a Data Processor. We only process candidate information upon your direct instructions, strictly for the purpose of chasing and verifying compliance. We execute a standard DPA with all clients prior to onboarding.
Our operations adhere strictly to UK GDPR Chapter V on restricted international transfers. Because our administrative desk is based in Lagos, Nigeria (where no UK adequacy decision exists), we execute the official UK International Data Transfer Agreement (IDTA) alongside a completed Transfer Risk Assessment (TRA). Operators view files exclusively in-memory from UK servers with zero local file storage.
We use established infrastructure providers that publish independent security audits. Our core subprocessors include:
In the unlikely event of a data breach, we commit to a prompt GDPR-compliant notification to the Data Controller. Furthermore, if a candidate submits a Data Subject Access Request (DSAR) directly to us, we immediately route that request to you (the Controller) for instruction, rather than acting independently.
Automated Document Purging. Once a candidate's compliance pack is complete, the required documents are synced back to your agency's OneDrive. We permanently purge candidate data from Dextro's systems via automated routines 30 days after verification completion to minimize your risk footprint.
We manage the administration; you manage the risk. We do not make hiring decisions, clinical judgements, or provide regulated safeguarding advice. If a DBS certificate is flagged, or a candidate document is unclear, our team immediately escalates the file to your team for review.
Review our standardized Data Processing Agreement, Technical & Organisational Measures (TOMs), and request our pre-completed UK IDTA & Transfer Risk Assessment pack for your procurement team.
Have specific questions about how we handle International Transfers or UK GDPR compliance? Contact our Data Protection Officer directly.
privacy@dextrohq.com →Experience the security and efficiency of a managed compliance desk.
Start Dextro Risk-Free