When candidates are being sent an assessment/background check they are creating an account on Partner's platform and therefore the consent/right to be rectified/forgotten is dealt by the Partner. In other words, when Partner receives data from the candidate, Partner becomes a data controller with all the responsibilities.
Candidate removes his profile from the company in SmartRecruiters - not on Partner’s website so the candidate would have to contact Partner to do so. Partner can, of course, notify the candidates, that they should request them directly to remove their data from Partner’s system.
Additionally, it is up to the customer to ensure that the vendors they are working with are GDPR compliant.