Candidate Online Assessment Data Protection Notice 

This Notice was last updated on 9 May 2025. 

CHANGES TO THIS NOTICE: This Notice has been updated following an annual review to include new product information, improve the ease of use and address additional data protection laws. 

 

Section 1 - Who we are and Scope of Notice 

In accordance with applicable privacy laws, regulations, and guidelines ("Applicable Data Protection Law"), this privacy notice ("Notice") describes how:

(1) your Employer/ potential new Employer ("Employer"); and

(2) SHL Group Limited, of The Pavilion, 1 Atwell Place, Thames Ditton, Surrey KT7 0NE, England, and our affiliated group of companies (together, “SHL”, “we”, or “us”) each acting either as a Data Processor or as a Data Controller of your Personal Information (defined below); 

use your information collected through this online Assessment or other interactions with you.

SHL will process and collect information about you when you complete an SHL Assessment or perform other interactions during the recruitment or employment process (each an "Assessment") in accordance with this Notice. During the Assessment, we may collect some information that can be considered as personal information about you or from which we can identify you ("Personal Information"). 

This Notice sets out the way the Employer and SHL use your Personal Information including:     

  • what is collected,
  • how it is collected,
  • how it is used,
  • why it is used,
  • who it is shared with; and
  • the rights you have.  

Section 2 (Employer as the Data Controller) provides further information on the Employer’s processing of your Personal Information as the Data Controller.

Section 3 (SHL as the Data Controller) provides further information on SHL’s processing of your Personal Information for our own purposes as Data Controller.

Section 4 (Data Sharing and Your Rights) provides additional information on who SHL and the Employer share your data with and an overview of your rights under Applicable Data Protection Law.


Section 2 - Employer as the Data Controller 

Part A 

The Employer will be the Data Controller with respect to the processing of your Personal Information and will decide (i) which Assessments you take, (ii) what type of Personal Information is collected, (iii) the purposes for which it is collected and (iv) who your Personal Information is shared with.

In this context, SHL collects your Personal Information on behalf of your Employer. Therefore, in these cases, SHL acts as Data Processor.

Note that in certain cases, SHL will process your Personal Information for its own purposes and will determine the means of such processing. In these cases, SHL will act as an autonomous Data Controller, as described in Section 3 below.

If you have a query as to the identity of the Employer, please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

You will be able to exercise your rights directly against the Employer in respect of Personal Information where the Employer is Data Controller. This is further described in Section 4 (Data Sharing and Your Rights).

If you require further information as to the extent of the data that is collected from you, contact the Employer directly.  

Part B 

What Personal Information we collect 

The Personal Information we collect as part of the Assessment and the methodology we deploy to generate the results varies depending on the Assessment as described below:

(1) General Assessments Category: For this type of Assessment, we will always collect:

a) "Candidate Data", including: 

  • Name;
  • email address;
  • account login details; and
  • answers to additional questions that your Employer requires. 

b) "Assessment Data" which are your answers to the Assessment questions.

c) “Results Data” which includes the reported results of your Assessment. Some Assessments include multiple competencies and corresponding computational models and therefore Results Data includes several scores. 

We will only collect the following additional information, only where your Employer provides it to us ("Employer Provided Data"): 

  • CV or resume information (including your employment history, educational background, skills, languages, and hobbies);
  • details of the role you are in, or applying for;
  • your manager's rating of performance;
  • confirmation whether you were hired;
  • performance appraisals; and
  • unique identifier for re-identification purposes. 

For the General Assessment Category, we use all Candidate Data and all Assessment Data to generate numerical values derived by comparing your Assessment Data against benchmarks for the competency or task being measured. The numerical values are then passed through a computational model, which weighs and combines the designated numerical values to generate the "Results Data". 


What we do with your Personal Information 

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to: 

a. invite you to complete an Assessment on behalf of the Employer; 

b. use the Results Data to compile a report given to the Employer’s authorised representatives ("Assessment Report"); 

c. provide our services to the Employer; 

d. when instructed by the Employer; 

1. provide you the Assessment Report;

2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in Section 3 below) to provide talent analytics services to the Employer, so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and 

e. manage and administer our services. 

(2) Survey Assessments Category: For Survey Assessments, in addition to any information we collect in the General Assessment Category described above, we also collect additional "Assessment Data" which consists of answers to the survey Assessment questions, either by: 

  • you for your self-assessment; or
  • a person you have invited to rate you or your performance or activities, a "Rater".

For the Survey Assessment category, we use Candidate Data and Assessment Data to generate numerical values from the Assessment Data, which represents how your responses address the competency or task being measured. The numerical values are then passed through a computational model, which weighs and combines the designated numerical values to generate the "Results Data". 


What we do with your Personal Information 

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to: 

a. invite you to complete an Assessment on behalf of the Employer; 

b. use the Results Data to compile a report given to the Employer’s authorised representatives ("Assessment Report"); 

c. provide our services to the Employer; 

d. when instructed by the Employer; 

1. provide you the Assessment Report;

2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in Section 3 below) to provide talent analytics services to the Employer, so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and 

e. manage and administer our services. 


(3) Audio Assessments Category: For Audio Assessments, in addition to any information we collect in the General Assessment Category, we also collect: 

a) additional "Candidate Data" which includes: 

  • your audio responses; and 

b) additional "Assessment Data" which includes: 

  • the audio recording of yourself as you speak or respond to questions;
  • transcription of your audio responses into text format; and
  • your answers to Assessment questions. 

For the Audio Assessment category, we use all Candidate Data and all Assessment Data to analyse 1) pronunciation against the selected neutral accent benchmark and 2) disfluencies in speech patterns such as unnatural pauses, rate and flow, which make the audio responses less adequate. In each case, we generate numerical feature values derived by comparing your Assessment Data against benchmarks for the competency or task being measured. The numerical feature values are then passed through an Artificial Intelligence (AI) computational model, which weighs and combines the designated numerical values to generate the "Results Data". 


What we do with your Personal Information 

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to: 

a. invite you to complete an Assessment on behalf of the Employer; 

b. use the Results Data to compile a report given to the Employer’s authorised representatives ("Assessment Report"); 

c. provide our services to the Employer; 

d. when instructed by the Employer; 

1. provide you the Assessment Report;

2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (defined in Section 3 below) to provide talent analytics services to the Employer so that the Employer can consider how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and 

e. manage and administer our services. 


(4) Basic Video Assessments Category: For Basic Video Assessments, in addition to any information we collect in the General Assessment Category described above, we also collect: 

a) additional "Candidate Data" which includes: 

  • your video image and corresponding audio responses; and 

b) additional "Assessment Data" which includes: 

  • the video recording of yourself including voice as you respond to questions;
  • any assigned practical online exercises project work you are required to complete as part of the video Assessment Evaluation;
  • transcription of your audio responses into text format; and
  • ratings by human raters of your responses ("Raters"). 

For the Basic Video Assessment category, we use all Candidate Data and all Assessment Data. Transcription technology (which uses AI) performs advanced speech-to-text conversion of the video recording, then to compare them against benchmarks for the competency or task being measured to generate the "Results Data".  


What we do with your Personal Information 

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to: 

a. invite you to complete an Assessment on behalf of the Employer; 

b. use the Results Data to compile a report given to the Employer’s authorised representatives ("Assessment Report"); 

c. provide our services to the Employer; 

d. when instructed by the Employer;

1. provide you the Assessment Report;

2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in Section 3 below) to provide talent analytics services to the Employer so the Employer can consider how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and 

e. manage and administer our services. 


(5) Advanced Video Assessments Category: For Advanced Video Assessments, in addition to any information we collect in the General Assessment Category described above, we also collect: 

a) additional "Candidate Data" which includes:

  • your video image and corresponding audio responses; and

b) additional "Assessment Data" which includes:

  • the video recording of yourself including voice as you respond to questions;
  • any assigned practical online exercises project work you are required to complete as part of the video Assessment evaluation; and
  • transcription of your audio responses into text format applying speech recognition technology. 


For the Advanced Video Assessment category, we use Candidate Data and Assessment Data and transcription technology (which uses AI to perform advanced speech-to-text conversion of the video recording) including data transformations allowing for alternate responses which provide equivalent value response, to generate the numerical values or text. The numerical values are then passed through a computational model, which applies supervised machine learning, which is a form of artificial intelligence, to weigh and combine the designated numerical values to generate the "Results Data". 


What we do with your Personal Information

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to: 

a. invite you to complete an Assessment on behalf of the Employer;

b. use the Results Data to compile a report given to the Employer’s authorised representatives ("Assessment Report");

c. provide our services to the Employer;

d. when instructed by the Employer;

1. provide you the Assessment Report;

2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in Section 3 below) to provide talent analytics services to the Employer, so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and 

e. manage and administer our services. 


(6) Proctoring Category: Your Employer will determine which proctoring features are applied to your Assessments. For proctoring, in addition to any information we collect as part of an Assessment, we also collect:

a) additional "Proctoring Data" (which includes data only to the extent that the Proctoring Feature is enabled by your Employer):

  • Pause time during Assessment completion; 
  • Restricting or logging of copy, print and paste function; 
  • Restricting and counting browser toggle, print screen; and  
  • Toggle to other websites during the Assessment. 

b) additional "Audio Visual Data" (which is collected with your consent in jurisdictions where consent is required for the collection of such information): 

  • live audio-video monitoring of the candidates; 
  • Intermittent or periodic capture of audio, still images, or audio-video recordings from your device and camera;  
  • multi and no face detection; 
  • suspicious objects detected in your image capture (i.e., mobile phone); face verification; and 
  • recording of your identification documentation. 
  • Multi voice detection. 


Note: If you are being proctored, we will obtain your consent via a pop-up or webpage before deploying proctoring features, in compliance with Applicable Data Protection Law. 

For the Proctoring category we use all Candidate Data, all Audio Visual Data, and all Proctoring Data to analyse your conduct during the Assessment to determine the likelihood that you engaged in the Assessment using third-party assistance (including any Artificial Intelligence systems) to generate the "Conduct Data". This includes the results from our AI-based features — such as Face Not Matched, Multiple Voice Detection, Multiple Face Detection, and No-Face Detection — as these results are also reflected in the final report and form part of the candidate's "Conduct Data". 


c) "Conduct Data" is based on the number of factors that the Employer elects to review in your performance of the Assessment: 

  • Measuring high similarity score comparing responses to the content and code available on internet of other participants or using artificial intelligence. 
  • Measuring multi-line insertion of content or code directly into the assessment. 
  • Restricting the switching of machines during the assessment period.  
  • Code replay feature for Automata assessments. 

Where express consent is required at the time of collection, you will be required to respond independent of this Notice. 


What we do with the Personal Information: 

We use the Conduct Data on behalf of the Employer to: 

a. to combine with corresponding Assessment results as part of your result; 

b. provide our services to the Employer; and 

c. manage and administer our services. 

 

Part C

Why do we collect this data and how long do we retain it 

We hold and process your Candidate Data, Audio Visual data, Proctoring Data, Assessment Data and Results Data, in accordance with the Employer's instructions. The purposes of the processing of your Personal Information as pursued by the Employer will vary The Employer will instruct us to process your Personal Information based on one or more of the following lawful bases: 

  • to evaluate your suitability for a role you have applied for; 
  • to perform analytics on the characteristic profile required for the role; and 
  • to evaluate your promotion opportunities or development requirements; 

as part of an overall recruiting/development/promotion process. 

For more information about the processing carried out by the Employer, including the applicable legal basis as well as your rights vis a vis the Employer, you should contact the Employer directly. 


How long your Personal Information is retained by us 

We will store your Personal Information on behalf of the Employer in accordance with the Employer's instructions. The period of time that we are instructed to store your Personal Information, varies from Employer to Employer. We will not delete your Personal Information if relevant to an investigation or a dispute. In this latter case, it will continue to be stored until those issues are fully resolved. 


You should contact the Employer directly if you require more information on this section. 


Employer’s Data Sharing 

We will only share your Personal Information processed on behalf of the Employer with the Employer and based on the Employer’s Instructions. You should contact the Employer for more information to confirm with whom they share your Personal Information. 


Section 3 - SHL as the Data Controller 

When you complete an Assessment, SHL will be the Data Controller solely in respect of the Personal Information about you indicated below. We will be responsible for your Personal Information for the limited purposes for which your information is collected and used.

If you have any questions on the processing of your data by SHL as Data Controller you can contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice. 


What Personal Information we collect 

a) We collect Personal Information that you or the Employer give us when you complete an Assessment: including your Candidate Data, Assessment Data, Results Data, Audio Visual data, Proctoring Data, and any Employer Provided Data. 

b) OPTIONAL RESEARCH QUESTIONS 

We will ask you to answer a set of optional demographic research questions, which generates "Research Data" (Gender; Age; First language; Country of Origin/Residence; Educational attainment; Job experience; Role and industry information; or Ethnicity). This demographic data may include questions of a sensitive nature classified as special category of Personal Information. Accordingly, if you choose to answer, you will be providing us with your consent to process this Personal Information in accordance with this Notice. 

Providing this information is completely voluntary. If you do not want to answer a question, simply select the "Prefer not to answer" option. If you choose not to answer these questions, it will not affect the Assessment results in any way. We will store your Research Data in a de-identified format and only use it in an anonymised format for research purposes as further detailed below. Your Research Data will NOT be provided to the Employer. 

c) Technical Information relating to the systems you used to take the Assessment including: 

  • browser types; 
  • operating systems; and  
  • date / time stamps. 

d) Your country or region of residence (Country of Residence Information). 


How we use Personal Information 

We anonymise a combination of your Candidate Data, Assessment Data, Results Data, any Employer Provided Data and Research Data for our own purposes provided below. Once anonymized, we use this data to: 

a. ensure that our Assessments remain fair, objective and prevent unfair discrimination; 

b. develop and improve the services and Assessments we offer; and 

c. create aggregate benchmark measurements against industry recognised 

differences for separate groups, jobs, and industries ("Benchmark Data") to be used for the above purposes. 


If you have provided us with your express consent at the beginning of this Notice, we use your name and email address, for our own purposes, to: 

a. request that you participate in future test trials and surveys; and 

b. request that you provide us with further information relating to the assessment to further our research and develop our assessment processes. 


We use your Technical Information to primarily provide you or the Employer with service support and for our own purposes including troubleshooting technical issues, optimizing performance, ensuring compatibility with user devices, and analyzing usage trends to improve service delivery. 

We collect your Country of Residence Information for the lawful basis to comply with legislation applicable to the SHL group, in particular US Trade Sanctions law.  


Why we use Personal Information 

We anonymise your Assessment Data, your Results Data, your Employer Provided Data, Research Data, and Candidate Data because we have a legitimate interest 

and/or to perform our legal obligations to maintain our products and create Benchmark Data to develop and improve our services. 

We use your Technical Information because we provide technical support to the Employer as well as individuals who reach out to us using our web help form and we have a legitimate business interest to meet our contractual obligation to provide technical support via the web help form to candidates and to understand how our assessments are accessed, how they are used and any problems users have with them across multiple devices. 


If you require further information regarding our legitimate interests as applied to your Personal Information, you may contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice. 

We will also process your Personal Information if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claim against us. 


How long we keep Personal Information 

We keep your Assessment Data, Results Data, Employer Provided Data, Candidate Data, and Research Data, for our own purposes in a de-identified form for a maximum of seven years. We will not delete your Personal Information if it is relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved. 

We keep your Technical Information and Country of Residence for seven years. 


Where your Personal Information will be stored 

We store your Personal Information in data centers located in Germany and backed up in Ireland. SHL affiliates also transfer your Personal Information within the Europe Economic Area ("EEA"). 

Additionally, your Personal Information is transferred to the United States, India, South Africa and United Kingdom ("SHL Non-EEA Processing Locations") in accordance with Applicable Data Protection Law, where a limited number of personnel in our SHL Non EEA Processing Locations, as well as our trusted third party vendors and service providers, have access to Personal Information in order to provide services. As the majority of the SHL Non-EEA Processing Locations are in countries which do not have equivalent data protection laws to those applicable in the EEA we have an Intragroup Agreement in place, signed by all SHL affiliates, which contains the European Union (EU) Standard Contractual Clauses (SCCs) which have been approved by the EU data protection authorities for the transfer of data outside the EEA. 


In addition, our third party vendors and service providers are also required to sign up to SCCs in accordance with Article 46 of the GDPR. All SHL affiliates have the same technical, physical, and administrative security controls and are required to comply with our data protection policies and procedures, applicable laws, governing the collection and use of personal information. 

We are happy to provide you with copies of the SCCs, which you can request from the SHL Data Protection Officer (DPO) on dpo@shl.com or via the contact details included at the end of this Notice. 


When do we share your Personal Information 

We have set out the circumstances in which we will share your data with third parties below: 

  • We will share a combination of your Assessment Data, Results Data, Employer Provided Data and Research Data within our group companies when required to provide maintenance and support services and so that we can continue to improve the services we provide across the group. 
  • We will also share your information with our trusted third-party service providers, including our survey tool provider, scheduling tool, video back-up support, IT security provider and cloud hosting platform provider. Our service providers will be required to meet our standards on processing information and security. 
  • Lastly, we may also be required to transfer your Personal Information upon the request of the competent authorities. 

 

Section 4 – Data Sharing and Your Rights 

Data Sharing 

The Employer and SHL, each in their role as Data Controller, will share your Personal Information with third parties in the following limited circumstances: 

a. If we are discussing selling or transferring part or all of our business, Personal Information will be transferred to prospective purchasers under suitable terms as to confidentiality; 

b. If we are reorganised or sold, Personal Information will be transferred to a buyer who can continue to provide services to you; 

c. If we are required to by applicable law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority - for example, the Police; and 

d. If we are defending a legal claim your Personal Information will be transferred as required in connection with defending such claim. 


Data Subject Rights 

Pursuant to the GDPR, you may exercise certain rights listed below. In the event, the Employer will be Data Controller you should contact the Employer directly if you want to exercise a right over data for which they are Data Controller. Otherwise, if we act as Data Controller, as indicated in Section 3 above, you should contact SHL DPO at dpo@shl.com via the contact details included at the end of this Notice. 

a. The right to withdraw consent: Where we or the Employer have obtained consent for some of the ways we use your information you can remove that consent at any time by contacting the Employer or the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice. 

b. You have the rights to:

1. confirm if we are processing your Personal Information and, if we are, you can ask for access to that Personal Information as well as further details including why your data is being used and for what purposes;

2. correct your Personal Information held by us and the Employer if it is wrong. 

c. You can ask us and the Employer to:

 1. delete your Personal Information;

2. restrict how we use your Personal Information;

3. help you move certain Personal Information to other companies in compliance with data protection law requirements. To help with that you have a right to ask that we or the Employer provide your Personal Information in a machine-readable format;

4. stop using your Personal Information in certain cases. However, we may be entitled to continue processing your information if we have a lawful basis; and 

d. Any other rights provided under data protection law. 


You also have a right to make a complaint to a supervisory authority, which is the local data protection regulator in your jurisdiction. 

Where the Employer is the Data Controller, you can contact the regulator in the location where the Employer is based. 

 

Questions or Complaints: Questions about the results of your assessment or the Employer’s use of your Personal Information should be sent directly to the Employer at whose request you are taking the Assessment.  

If you have any questions about this Notice, please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice. 


Changes to the Notice 

This Notice will be changed from time to time. If we change anything important about this Notice (the information we collect, how we use it or why) we will provide a prominent notice to bring your attention to such importance changes for a reasonable length of time following the change. 

If you would like to access the previous versions of this Notice, please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice. 


Other policies 

Security: We are committed to keeping your Personal Information safe. We have implemented physical, technical and administrative measures to help prevent unauthorised access or use of your information. For information about SHL security measures, see: Security Policy. 

Sanctions: SHL products and services are subject to US sanctions law. As a result, prohibited individuals, or those located in certain countries (Cuba, Iran, North Korea, Russia and Syria), are not authorised to take assessments on our systems. 

 

SHL Data Protection Officer Contact Details: 

email: dpo@shl.com or via post to the Data Protection Officer 


For EU users: 

SHL Nederland BV
9th floor,
Central Park,
Stadsplateau 29,
3521 AZ,
Utrecht,
The Netherlands 

 

For all other users: 

Data Protection Officer
SHL Group Ltd.
The Pavilion,
1 Atwell Place,
Thames Ditton,
Surrey,
England,
KT7 0NE,
United Kingdom