Candidate Online Assessment Data Protection Notice - Privacy Policy

This Notice was last updated on 23rd March 2023.

CHANGES TO THIS NOTICE: This Notice has been updated following an annual review to add additional product information and improve the ease of use.

Section 1 - Who we are and Scope of Notice

This Notice describes how:

(1) your Employer/ potential new Employer (“Employer”); and

(2) SHL Group Limited, of The Pavilion, 1 Atwell Place, Thames Ditton, Surrey KT7 0NE, England and our affiliated group of companies (together, SHL or we or us) each as joint controller of your Personal Information (defined below);

respectively use your information collected through this online Assessment or other interactions with you.

SHL will process and collect information about you when you complete an SHL assessment or other interaction (each an "Assessment") in accordance with this Notice.
Some information is personal information about you or from which we can identify you ("Personal Information").

This Notice sets out the way the Employer and SHL use your information: what is collected, how it is collected, how it is used, why it is used, who it is shared with and the rights to which you will be entitled.

Section 2 (Employer as the Data Controller) provides further information on processing of your personal information by the Employer as the data controller.

Section 3 (SHL as the Data Controller) describes processing of your Personal Information by SHL for our own purposes as data controller.

Section 4 (Data Sharing and Your Rights) provides additional information on who SHL and the Employer share your data with and an overview of your rights under data protection law.

Section 2 - Employer as the Data Controller

SHL collects your Personal Information on behalf of your Employer. If you have a query as to the identity of the Employer, please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

The Employer will be the data controller in respect of your Personal Information and the Employer will decide which Assessments you take, what data is collected, the purposes for which it is collected and who it is shared with. You will be able to exercise your rights directly against the Employer in respect of this Personal Information. See section 4 (The Employer and SHL as the Data Controller) for more information.

The data collected

We have categorised each Assessment to assist you in understanding what data is collected for each product or service your Employer uses to collect data from you. We collect and process the categories of data on behalf of the Employer as set out in each category. If you require further information as to the extent of the data that is collected from you, you should contact the Employer directly.

What we collect

The Personal Information we collect as part of the Assessment and the methodology we deploy to generate the results varies depending on the Assessment you are performing.
Accordingly, we provide the details about what we collect and how we use the data by category of Assessment.

(1) “General Assessments Category”: We will always collect :

a) "Candidate Data" which includes your:

• name;
• email address;
• account login details; and
• answers to additional questions which your Employer requires.

b) "Assessment Data" which are your answers to the Assessment questions.

c) “Results Data” which includes the reported results of your Assessment. Some Assessments include multiple competencies and corresponding computational models and therefore Results Data includes several scores.

We will only collect the following additional information where it is provided to us
by your Employer ("Employer Provided Data") :

• CV or resume information (including your employment history, educational background, skills, languages and hobbies);
• details of the role you are in, or applying for;
• your manager's rating of performance;
• confirmation whether you were hired;
• performance appraisals; and
• unique identifier for re-identification purposes.

Using the Candidate Data and Assessment Data , we generate numerical values derived by comparing your Assessment Data against benchmarks for the competency or task being measured. The numerical values are then passed through a computational model, which weighs and combines the designated numerical values to generate the "Results Data". Results Data includes the reported results of your Assessment. Some Assessments include multiple competencies and corresponding computational models and therefore Results Data includes several scores.

What we do with the data

We use your Candidate Data, Assessment Data, Results Data, and any Employer
Provided Data on behalf of the Employer to:

a. use the Results Data to compile a report given to the Employer’s authorised
representatives ("Assessment Report");

b. provide our services to the Employer;

c. when instructed by the Employer,

1. 1. provide you the Assessment Report;
   2. compare your Candidate Data, Assessment Data, Results Data and Employer Provided Data (if provided) with anonymised Benchmark Data (as defined in the How we use data paragraph in Section 3) to provide talent analytics services to the Employer so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and

d. manage and administer our services.

You should contact the Employer directly if you require more information on this section.

(3) Audio Assessments Category: For Audio Assessments, in addition to the information we collect in the General Assessment Category, we also collect:

a) "Candidate Data" which includes your:

• audio responses; and

b) "Assessment Data" which is:

• an audio recording of yourself as you speak or respond to questions;
• transcription of your audio responses into text format;
• and your answers to the Assessment questions.

Using the Candidate Data and Assessment Data, for the Audio Assessment category we analyse 1) pronunciation against the selected neutral accent benchmark and 2) disfluencies in speech patterns such as unnatural pauses, rate and flow, which make the audio responses inadequate. In each case, we generate numerical values derived by comparing your Assessment Data against benchmarks for the competency or task being measured. The numerical values are then passed through a computational model, which weigh and combine the designated numerical values to generate the "Results Data".

What we do with the data

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to:

a. invite you to complete an Assessment on behalf of the Employer;

b. use the Results Data to compile a report given to the Employer’s authorised
representatives ("Assessment Report");

c. provide our services to the Employer;

d. when instructed by the Employer;

1. 1. provide you the Assessment Report;
   2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in the How we use data paragraph in Section 3) to provide talent analytics services to the Employer so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and

e) manage and administer our services

(4) Basic Video Assessments Category: For Basic Video Assessments, in addition to the information we collect in the General Assessment Category, we also collect:

a) "Candidate Data" which includes your:

• your video image and corresponding audio responses; and

b) "Assessment Data" which is:

• A video recording of yourself including voice as you respond to questions;
• Any assigned practical on-line exercises project work you are required to
  complete as part of the video Assessment Evaluation;
• transcription of your audio responses into text format; and
• marks by human raters of your responses (“Raters”)

Using the Candidate Data and Assessment Data, for the Basic Video Assessment category, we use the interviewers’ marking of your interview and any exercises, along with reviews of any submitted work, and compare them against benchmarks for the competency or task being measured to generate the "Results Data".

What we do with the data

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to:

a. invite you to complete an Assessment on behalf of the Employer;

b. use the Results Data to compile a report given to the Employer’s authorised representatives ("Assessment Report");

c. provide our services to the Employer;

d. when instructed by the Employer;

1. 1. provide you the Assessment Report;
   2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in the How we use data paragraph in Section 3) to provide talent analytics services to the Employer so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and

e. manage and administer our services.

(5) Advanced Video Assessments Category: For Advanced Video Assessments, in addition to the information we collect in the General Assessment Category, we also collect:

a) "Candidate Data" which includes your:

• your video image and corresponding audio responses; and

b) "Assessment Data" which is:

• A video recording of yourself including voice as you respond to questions;
• Any assigned practical on-line exercises project work you are required to
  complete as part of the video Assessment evaluation; and
• transcription of your audio responses into text format applying speech
  recognition technology.

Using the Candidate Data and Assessment Data, for the Advanced Video Assessment category, we generate numerical values derived by comparing your Assessment Data against benchmarks for the competency or task being measured, including data transformations allowing for alternate responses which provide equivalent value responses. The numerical values are then passed through a computational model, which applies supervised machine learning, which is a form of artificial intelligence, to weigh and combine the designated numerical values to generate the "Results Data".

What we do with the data

We use your Candidate Data, Assessment Data, Results Data, and any Employer Provided Data on behalf of the Employer to:

a. invite you to complete an Assessment on behalf of the Employer;

b. use the Results Data to compile a report given to the Employer’s authorised
representatives ("Assessment Report");

c. provide our services to the Employer;

d. when instructed by the Employer;

1. 1. provide you the Assessment Report;
   2. compare your Candidate Data, Assessment Data, Results Data and any Employer Provided Data with anonymised Benchmark Data (as defined in the How we use data paragraph in Section 3) to provide talent analytics services to the Employer so that the Employer can understand how your Personal Information compares to the market or to your co-workers in the role you are in, or applying for; and

e. manage and administer our services.

(6) Proctoring Category: For Proctoring, your Employer will elect which of the following proctoring features to deploy as part of the proctoring of an Assessment or all Assessments you take. Proctoring, whether used alone or in combination with Assessments, in addition to the information we collect in the General Assessment Category, we also collect:

a) "Proctoring Data" which is:

• Pause time during Assessment completion;
• Use or logging of copy, print and paste function;
• Restricting and counting browser toggle, copy/paste or print screen; and
• Toggle to other websites during the Assessment.

b) “Image Data” which is collected with your consent in jurisdictions where consent is required for the collection of such information:

• Live video monitoring of the candidates
• intermittent still images or video capture from your device and camera;
• same, multi and no face detection;
• suspicious objects detected in your image capture (i.e. mobile phone);
• face verification; and
• recording of your identification documentation.

Using the Candidate Data, Image Data and Proctoring Data, for the Proctoring category we analyse your conduct during the Assessment to determine the likelihood that you engaged in the Assessment using third-party assistance ( "Conduct Data").

c) “Conduct Data” is based on the number of factors that the Employer elects to review in your performance of the Assessment:

• Measuring high similarity score comparing responses to the content and code
  available on internet of other participants or using artificial intelligence.
• Measuring multi-line insertion of content or code directly into the assessment.
• Locking the browser while attempting the assessment.
• Restricting speech to text during the assessment period.
• Restricting switching of machines during the assessment period.
• Code replay feature for Automata assessments.

At the time of assessment, independently of this notice, you may be asked to
provide your express consent.

What we do with the data

We use the Conduct Data on behalf of the Employer to:

a. to combine it with Assessment results from the corresponding Assessment to
compile a report given to the Employer’s authorised representatives ("Assessment Report");

b. provide our services to the Employer; and

c. manage and administer our services.

Why this data is collected and how long it is retained by us

We hold and process your Candidate Data, Image Data, Proctoring Data, Assessment Data, Results Data, along with Employer Provided Data, in accordance with the Employer's instructions. The reasons why the Employer collects your Personal Information will vary but generally, the Employer will instruct us to process your Personal Information based on one or more of the following lawful bases:

• to evaluate your suitability for a role you have applied for;
• to perform analytics on the characteristic profile required for the role; and
• to evaluate your promotion opportunities or development requirements.

as part of an overall recruiting/development/promotion process.

We will keep your Personal Information on behalf of the Employer in accordance with the Employer's instructions. The period of time that we are instructed to hold your Personal Information, varies from Employer to Employer. We will not delete your Personal Information if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

You should contact the Employer directly if you require more information on this
section.

Employer’s Data Sharing

We will only share your Personal Information processed on behalf of the Employer with the Employer and on the Employer’s instructions. Contact the Employer for more information to confirm with whom they share your Personal Information.

Section 3 - SHL as the Data Controller

When you complete an Assessment we will collect Personal Information about you for the purposes detailed below. We will be data controller in respect of this information and we will be responsible for your Personal Information including for what purposes your information is collected and used.

If you have any questions on the processing of your data by SHL as data controller you can contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

What we collect

a) We collect information that you or the Employer give us when you complete an
Assessment: including your Candidate Data,Assessment Data, Results Data, Image Data, Proctoring Data and any Employer Provided Data.

b) OPTIONAL RESEARCH QUESTIONS - At the beginning or the end of some
Assessments, we will ask you to answer a set of optional demographic research
questions, which generates "Research Data". This demographic data may include questions of a sensitive nature classified as special category of personal information. Accordingly, if you chose to answer, you will be providing us with your consent to process this information.

Providing this information is completely voluntary. If you do not want to answer a
question, simply select the "Prefer not to answer" option. If you choose not to answer these questions, it will not prevent you from taking the Assessment or affect the Assessment results in any way. We will store your Research Data in a de-identified format and only use it in an anonymised format for research purposes as further detailed below. Your Research Data will NOT be provided to the Employer. The questions ask you to provide certain types of demographic information for research purposes including your:

• Gender;
• Age;
• First language;
• Country of Origin/Residence;
• Educational attainment;
• Job experience;
• Role and industry information; or
• Ethnicity

c) Technical Information relating to the systems you used to take the Assessment
including:

• browser types;
• operating systems; and
• Date / time stamps.

d) We also collect your country or region of residence ( Country of Residence
Information).

How we use data

We anonymise a combination of your Assessment Data, Results Data, any Employer Provided Data and Research Data for our own purposes provided below. Once anonymised we use this data to:

a. ensure that our Assessments remain fair, objective and prevent unfair
discrimination;

b. develop and improve the services and assessments we offer; and

c. create aggregate benchmark measurements against industry recognised
differences for different groups, jobs and industries (“Benchmark Data”) to be
used for the above purposes.

If you have provided us with your express consent at the beginning of this Notice, we use your name and email address, for our own purposes, to:

a. request that you participate in future test trials and surveys; and

b. request that you provide us with further information relating to the assessment to further our research and develop our assessment processes.

We use your Technical Information to primarily provide you or the Employer with
service support and for our own purposes including to identify issues with the
assessment and your experience of it.

We collect your Country of Residence Information for the lawful basis to comply with legislation applicable to the SHL group, in particular US Trade Sanctions law.

Why we use it

We anonymise your Assessment Data, your Results Data, your Employer Provided Data, Research Data, and Candidate Data because we have a legitimate interest
and/or to perform our legal obligations to maintain our products and create Benchmark Data to develop and improve our services.

We use your Technical Information because we provide technical support to the Employer as well as inspaniduals who reach out to us using our web help form and we have a legitimate business interest to meet our contractual obligation to provide technical support via the web help form to candidates and to understand how our assessments are accessed, how they are used and any problems users have with them across multiple devices.

If you require further information regarding our legitimate interests as applied to your personal data, you may contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

We will also process your Personal Information if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claims against us.

How long we keep it

We keep your Assessment Data, Results Data, Employer Provided Data, Candidate
Data, and Research Data, for our own purposes in a de-identified form for a maximum of seven years. We will not delete your Personal Information if it is relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

We keep your Technical Information and Country of Residence for seven years.

Where your Personal Information will be held

We store your Personal Information in data centres located in Germany and backed up in Ireland. SHL affiliates also transfer your Personal Information within the Europe Economic Area (“EEA”).

Additionally, your Personal Information is transferred to the United States, India, South Africa and United Kingdom (“ SHL Non EEA Processing Locations”) where a limited number of personnel in our SHL Non EEA Processing Locations, as well as our trusted third party vendors and service providers, have access to Personal Information in order to provide services. As the SHL Non EEA Processing Locations are in countries which do not have equivalent data protection laws to those applicable in the EEA we have an Intragroup Agreement in place, signed by all SHL affiliates, which contains the European Union ( EU) Standard Contractual Clauses (SCCs) which have been approved by the EU data protection authorities for the transfer of data outside the EEA.

Our third party vendors and service providers are also required to sign up to SCCs in accordance with Article 46 of the General Data Protection Regulation. All SHL affiliates have the same technical, physical, and administrative security controls and are required to comply with our data protection policies and procedures, applicable laws, governing the collection and use of personal information.

We are happy to provide you with copies of the regulator-approved SCCs, which you can request from the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

When do we share Personal Information

We have set out the circumstances in which we will share your data with third parties below:

• We will share a combination of your Assessment Data, Results Data, Employer Provided Data and Research Data within our group companies when required to provide maintenance and support services and so that we can continue to improve the services we provide across the group.
• We will also share your information with our trusted third party service providers, including our survey tool provider, scheduling tool, video back-up support, IT security provider and cloud hosting platform provider. Our service providers will be required to meet our standards on processing information and security.

Section 4 – Data Sharing and Your Rights

Data Sharing

The Employer and SHL, each in their role as data controller, will share your data with the following third parties in the below circumstances:

a. If we are discussing selling or transferring part or all of our business, Personal Information will be transferred to prospective purchasers under suitable terms as to confidentiality;

b. If we are reorganised or sold, Personal Information will be transferred to a buyer who can continue to provide services to you;

c. If we are required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority - for example the Police; and

d. If we are defending a legal claim your Personal Information will be transferred as required in connection with defending such claim.

Data Subject Rights under the EU General Data Protection Regulation (GDPR)

In certain circumstances, you may have rights under GDPR. If the GDPR applies to your data, we have listed the rights you have over your Personal Information and how you can use them below. These rights are subject to exemptions in applicable law and will only apply to certain types of information or processing. As described above, the Employer will be data controller so you should contact them directly if you want to exercise a right over data for which they are data controller.

a. The right to withdraw consent: Where we or the Employer have obtained
consent for some of the ways we use your information you can remove that consent at any time by contacting the Employer or the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

b. You can ask us to:

1. confirm if we are processing your Personal Information and, if we are, you can ask for access to that Personal Information as well as further details including why your data is being used and for what purposes;

2. correct your Personal Information held by us and the Employer if it is
wrong.

c. You can ask us and the Employer to:

1. delete your Personal Information;

2. restrict how we use your Personal Information;

3. help you move certain Personal Information to other companies in
compliance with data protection law requirements. To help with that you have a right to ask that we or the Employer provide your Personal Information in a machine-readable format;

4. stop using your Personal Information in certain cases. However, we may be entitled to continue processing your information if we have a lawful basis; and

d. Any other rights provided under data protection law.

You also have a right to make a complaint to a supervisory authority, which is the local data protection regulator in your jurisdiction.

Where the Employer is the data controller, you can contact the regulator in the location where the Employer is based.

Questions or Complaints: Questions about the results of your assessment or the
Employer’s use of your Personal Information should be sent directly to the Employer at whose request you are taking the assessment. If you have any questions about this Notice please contact the SHL Data Protection Officer whose contact details are listed at the start and the end of this Notice.

If you have any questions about this Notice please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

Changes to the Notice

This Notice will be changed from time to time. If we change anything important about this Notice (the information we collect, how we use it or why) we will provide a
prominent notice to bring your attention to such importance changes for a reasonable length of time following the change.

If you would like to access previous versions of this Notice, please contact the SHL
Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the
end of this Notice.

Other policies

Security : We are committed to keeping your personal information safe. We have
implemented physical, technical and administrative measures to help prevent
unauthorised access or use of your information. For information about SHL security
measures, see:Security Policy.

Sanctions : SHL products and services are subject to US sanctions law. As a result,
prohibited inspaniduals, or those located in certain countries (Cuba, Iran, North Korea, and Syria), are not authorised to take assessments on our systems.

SHL Data Protection Officer Contact Details :

Email: dpo@shl.com or via post to the Data Protection Officer

SHL Nederland BV
9th floor, Central Park
Stadsplateau 29
3521 AZ Utrecht
The Netherlands

For all other users:

Data Protection Officer
SHL Group Ltd.
The Pavilion
1 Atwell Place
Thames Ditton, Surrey
England KT7 0NE
United Kingdom