Data Protection Notice for Face-to-Face Assessment

Effective Date: 31 August 2023

Version no: 1.1

This Notice describes how the Employer; and SHL (together, SHL or we or us), respectively use your information collected through this face-to-face Assessment describing what is collected, how it is collected, how it is used, why it is used, who it is shared with, and the rights to which you will be entitled.

SHL will process and collect your Personal Information today, in accordance with this Notice. This information will be combined with your online assessment results, and together are defined as the SHL assessment (“Assessment”).

This Notice also covers us, and our affiliated group of companies, where we are data controller. Each group company is a data controller and we've listed them at https://www.shl.com/en/global-offices/registration/.

This Notice provides further information on processing your personal information by the Employer as the data controller and provides additional information on who SHL and the Employer share your data with and an overview of your rights under data protection law.

Employer as the Data Controller

The Employer will be the data controller in respect of your Personal Information, and the Employer will decide what data is collected, the purposes for which it is collected, and who it is shared with. You will be able to exercise your rights directly against the Employer in respect of this Personal Information.

The data collected

We collect and process the categories of data on behalf of the Employer as set out below. The categories of data that are collected about you vary depending on the type of Assessment and instructions we receive from the Employer. Not all the categories of data listed below may be collected about you. If you require further information as to the extent of the data that is collected, you should contact the Employer directly.

What we collect

Information that you give us and the Employer when you complete an Assessment, including:

  1. "Candidate Data" which includes your name and email address.
  2. "Assessment Data" which are your answers to the Assessment questions, interviews, engagements, role-play events, and any other online assessments you complete.

Using the Candidate Data and Assessment Data, we generate the "Results Data", which includes the results of your Assessment.

Additionally, we will collect information if provided to us by your Employer ("Employer Provided Data"). To the extent provided by your Employer to us, this will include:

  • CV or resume information (including your employment history, educational background, skills, languages, and hobbies);
  • details of the role you are in or applying for.
  • your manager's rating of performance.
  • confirmation whether you were hired; and
  • performance appraisals.

What we do with the data

We use your Candidate Data, Assessment Data, Results Data, and Employer Provided Data (if provided) on behalf of the Employer to:

  1. use the Results Data to compile a report given to the authorized representatives of the Employer (“Assessment Report”).
  2. when instructed by the Employer, provide you with an Assessment Report.
  3. provide our services to the Employer.
  4. when instructed by the Employer, compare your Candidate Data, Assessment Data, Results Data, and Employer Provided Data (if provided) with anonymized Benchmark Data (as defined below) to provide talent analytics services to the Employer so that the Employer can understand how your Personal Information compares to the market in the role you are in or applying for; and
  5. manage and administer our services.

Why this data is collected and how long it is retained by us

We hold and process your Candidate Data, Assessment Data, Results Data, along with Employer Provided Data, in accordance with the Employer's instructions. The reasons why the Employer collects your Personal Information will vary but generally, the Employer will instruct us to process your Personal Information because they have one or more of the following legitimate interests:

  1. to evaluate your suitability for a role you have applied for.
  2. to perform analytics on the characteristic profile required for the role.
  3. to evaluate your promotion opportunities or development requirements.
  4. as part of an overall recruiting/development/promotion process.

The Employer may also instruct us to process your Personal Information because you have provided consent or if it is necessary on reasonable request by a law enforcement or regulatory authority, body, or agency or in the defense of legal claims on behalf of the Employer.

We will keep your Personal Information on behalf of the Employer in accordance with the Employer's instructions. The period that we are instructed to hold your Personal Information varies from Employer to Employer. We will not delete your Personal Information if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

You should contact the Employer directly if you require more information on this section.

Data Sharing

We will only share your Personal Information processed on behalf of the Employer with the Employer and on the Employer's instructions. The Employer as data controller or SHL as the Data Processor will share your data with the following third parties in the below circumstances:

  • If we are discussing selling or transferring part or all our business, Personal Information will be transferred to prospective purchasers under suitable terms as to confidentiality.
  • If we are reorganized or sold, Personal Information will be transferred to a buyer who can continue to provide services to you.
  • If we are required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority – for example the Police.
  • If we are defending a legal claim, your Personal Information will be transferred as required in connection with defending such a claim.

You should contact the Employer for more information on who they share your Personal Information with.

Where your Personal Information will be held

We store your Personal Information in data centers located in Germany and backed up in Ireland. SHL affiliates also transfer your Personal Information within the EEA (Europe Economic Area). Our trusted third-party vendors and service providers will have access to Personal Information solely as required to provide our services. We have an Intragroup Agreement in place, signed by all SHL affiliates, which contains the European Union (EU) Standard Contractual Clauses (SCCs) which have been approved by the EU data protection authorities for the transfer of data outside the EEA, and our third-party vendors and service providers are also required to sign up to SCCs in accordance with Article 46 of the General Data Protection Regulation. All SHL affiliates have the same technical, physical, and administrative security controls and are required to comply with our data protection policies and procedures, applicable laws, governing the collection and use of personal information.

We are happy to provide you with copies of the regulator-approved SCCs, which you can request from the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

When do we share Personal Information?

We have set out the circumstances in which we will share your data with third parties below:

  • We will share a combination of your Assessment Data, Results Data, and Employer Provided Data within our group companies when required to provide maintenance and support services and so that we can continue to improve the services we provide across the group.
  • We will also share your information with our trusted third-party service providers, including our survey tool provider, IT security provider, and cloud hosting platform provider. Our service providers will be required to meet our standards on processing information and security.

Data Subject Rights

We've listed the rights you have over your Personal Information and how you can use them below. These rights are subject to exemptions in applicable law and will only apply to certain types of information or processing. As described above, the Employer will be the data controller so you should contact them directly if you want to exercise a right over data for which they are data controller.

For the Personal Information where we are the data controller, you can exercise these rights by contacting the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

  1. The right to withdraw consent: Where we or the Employer have obtained consent for some of the ways we use your information you can remove that consent at any time by contacting the Employer or the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.
  2. You can ask us to confirm if we are processing your Personal Information and, if we are, you can ask for access to that Personal Information as well as further details including why your data is being used and for what purposes.
  3. You can ask to correct your Personal Information held by us and the Employer if it is wrong.
  4. You can ask us and the Employer to delete your Personal Information.
  5. You can ask us and the Employer to restrict how we use your Personal Information.
  6. You can ask us and the Employer to help you move certain Personal Information to other companies. To help with that, you have a right to ask that we or the Employer provide your Personal Information in a machine-readable format to another company.
  7. You can ask us and the Employer to stop using your Personal Information, but only in certain cases. This applies where we are processing your personal information based on a legitimate interest (or those of a third party) and you can object to processing on this ground. However, we will be entitled to continue processing your information based on our compelling legitimate interests.

You have a right to make a complaint to a Supervisory Authority. You can contact the regulator in the location where the Employer is based.

Questions or Complaints

Questions about the results of your assessment or the Employer’s use of your Personal Information should be sent directly to the Employer at whose request you are taking the assessment.

If you have any questions about this Notice, please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or the contact details included at the end of this Notice.

Security

We are committed to keeping your personal information safe. We have implemented physical, technical, and administrative measures to help prevent unauthorized access or use of your information. For more information about the security measures, please clicked the link: Security & Compliance | SHL.

Changes to the Notice

This Notice will be changed from time to time. If we change anything important about this Notice (the information we collect, how we use it or why) we will provide a prominent link to it for a reasonable length of time following the change, providing the prior notices at least one year in arrears.

If you would like to access previous versions of this Notice, please contact the SHL Data Protection Officer (DPO) on dpo@shl.com or at the Postal Address: Data Protection Officer, SHL Group Ltd, The Pavilion, 1 Atwell Place, Thames Ditton, Surrey, KT7 0NE, England.