SOVA Assessment Limited Privacy Notice (Candidates)

V1.1 – 180801 – 1st August 2018

This Privacy Notice is made available for the benefit of all candidates and individuals who upload personal data and other information to the online assessment tool and related services which are provided by Sova Assessment Limited (Sova Assessment Tools). The Sova Assessment Tools are provided on behalf of an employer, potential employer or other client organisation which has decided to use the Sova Assessment Tools (Client Organisation) as part of a particular recruitment campaign or similar project.

For the purpose of this Privacy Notice, a candidate or individual refers to any person who is either seeking employment with a Client Organisation; or is in the process of going through a recruitment or development campaign, or similar project.


1. Introduction

Sova Assessment is committed to acting in compliance with current data protection legislation including the UK Data Protection Act 2018 and the General Data Protection Regulation (Data Protection Legislation), and therefore, to protecting your privacy.

This Privacy Notice sets out how we process data, and includes:

  • our status, for the purposes of Data Protection Legislation
  • the scope and who the notice covers in terms of personal data
  • who we are and who to contact
  • the personal data that we collect and hold on you
  • how we collect this data
  • how we store and use personal data
  • our legal bases for processing your personal data
  • information on transfers to third parties and international transfers
  • your rights as a data subject

2. We act as Data Processor on behalf of the Client Organisation

For the purpose of Data Protection Legislation, Sova Assessment acts as a data processor. This means that Sova processes your personal data on the instructions of the Client Organisation (i.e. the employer or potential employer you are connected with) which has commissioned the use of the Sova Assessment Tools.

The Client Organisation is the data controller for the purpose of Data Protection Legislation. Further information regarding the Client Organisation’s collection and processing of your personal data will be contained in the Client Organisation’s Privacy Notice.

In respect of the personal data collected as part of the candidate experience (IP addresses) for the performance of our platform, we are acting in terms of GDPR as the controller.


3. Scope

This Privacy Notice is provided for the benefit of all candidates whose personal data is collected via self-input on the Sova Assessment Tools, where feedback is provided following completion of an online assessment, and/or following participation in any type of recruitment or development process; or similar project. The scope also covers all candidates whose personal data is collected via the Client Organisation (the employer or potential employer you are connected with) and provided to us, in line with the requirements of Data Protection Legislation.


4. Who we are and who to contact

4.1 Who we are

We are Sova Assessment Limited, a company registered in England whose registered office is at Denmark House, 143 High Street, Chalfont St Peter, Buckinghamshire, SL9 9QL.

We are online assessment specialists whose aim is to help employers make accurate and informed decisions; and ensure assessments deliver the best possible experience for candidates. We provide digital assessment solutions, talent management consultancy services alongside a range of bespoke training solutions.

4.2 Responsibilities

At Sova Assessment we have a Data Protection representative who is responsible within our business for ensuring that this notice is made available to candidates prior to Sova Assessment collecting/processing their personal data.

Our Data Protection representatives can be contacted directly here (although we would recommend that you contact the Client Organisation – as the data controller - in the first instance, if you have any questions regarding your personal data):

Sova Assessment has contracted the services of GRCI Law to act as its Data Protection Officer (DPO). Accordingly, Sova Assessment will seek advice, guidance and input from the DPO where necessary.


5. What personal data we process

The personal data we process on behalf of the Sova Client when you use the Sova Assessment Tools are listed below:

Personal data typeSource
Name and email addressYou - when you complete an online assessment, where feedback is provided following completion of an online assessment and/or where you participate in any type of recruitment or development process; or similar project. Data may also be collected from the Client Organisation (the employer/potential employer you are connected with)
Username or similar identifierAutomatically generated from our online assessment platform
Contact numberYou – following completion of an online assessment where feedback is provided to you. Data may also be collected from the Client Organisation (the employer/potential employer you are connected with)
AgeYou - when you complete an online assessment, where feedback is provided following completion of an online assessment and/or where you participate in any type of recruitment or development process; or similar project. Data may also be collected from the Client Organisation (the employer/potential employer you are connected with)
Your photographYou may be asked for this by the Client Organisation (the employer/potential employer you are connected with) when you participate in any type of recruitment or development process; or similar project.
A video InterviewYou may be asked to take part in a video interview as part of the recruitment and/or development process; or similar project.
Information gathered and entered into a CV You may be asked for this by the Client Organisation (the employer/potential employer you are connected with) when you participate in any type of recruitment or development process; or similar project.
Information of any disability you have You - when you complete an online assessment, and/or where you participate in any type of recruitment or development process; or similar project. Data may also be collected direct from the Client Organisation (the employer/potential employer you are connected with)
Details on your education and employment historyYou - where you participate in any type of recruitment or development process; or similar project. Data may also be collected from the Client Organisation (the employer/potential employer you are connected with)
IP addressYou - where you participate in any type of recruitment or development process; or similar project.

6. Our processing of your personal data

We process your personal data on behalf of the Client Organisation who has commissioned the use of the Sova Assessment Tools (and related services) for the following purposes:

Personal data typePurpose
Name, email address, telephone number and username or similar identifierTo administer to you, a computer-generated invitation which will enable you to complete the online assessment.

To provide you and/or the Client Organisation (the employer/potential employer you are connected with) with an assessment report which displays your assessment outcomes.

Where feedback is provided following completion of an online assessment, in order for the feedback session to be conducted with ourselves

Where you participate in any type of recruitment or development process; or similar project, to help the employer make accurate and informed decisions as part of this process.
AgeWe use this for research and development purposes only, in anonymised form; to produce psychometric norms and validity data and/or to help produce our psychometric manuals
Your photographTo help the Client Organisation (employer/potential employer you are connected with) identify you when participating in any type of recruitment or development process; or similar project.
A video InterviewTo use as part of the recruitment and/or development process; or similar project, in order to help the Client Organisation (employer/potential employer you are connected with) make accurate and informed decisions.
Information gathered and entered into a CV To use as part of the recruitment and/or development process; or similar project, in order to help the Client Organisation (employer/potential employer you are connected with) make accurate and informed decisions.
Information of any disability you have Where you require for reasonable adjustments to be made to enable you to complete the online assessment and/or participate in any type of recruitment or development process; or similar project.
Details on your education and employment historyWe use this for research and development purposes only, in anonymised form; to produce psychometric norms and validity data and/or to help produce our psychometric manuals
IP addressFor the functioning of our platform

7. Our legal basis of processing

We process your personal data only in accordance with the instructions included in the contract with the Client Organisation. Our legal grounds for processing your data derive from those of the Client Organisation (the employer/potential employer you are connected with), and include:

Legitimate Interest

  • to provide our online psychometric assessments and any other of our products and services
  • to help enable the Client Organisation (the employer/potential employer you are connected with) to make accurate and informed decisions for their own recruitment and/or development purposes
  • to provide feedback on any assessment outcomes, to you as the individual
  • to keep our records up-to-date
  • to conduct research and development to improve our products and services

Performance of a Contract

  • to enable the performance of a contract (such as an existing contract of employment) or to take steps prior to the entering into of a contract (such as a potential new contract of employment for a new prospective recruit).

Consent:

  • with respect to the processing of special category data (which we only process when the Client Organisation requires us to do so)
Personal data typeLegal basis for processing
Name and email addressLegitimate Interest

Username or similar identifierLegitimate Interest
Contact numberLegitimate Interest
AgeLegitimate Interest
Your photographLegitimate Interest
A video InterviewLegitimate Interest
Information gathered and entered into a CV Legitimate Interest
Information of any disability you have Legitimate Interest
Details on your education and employment historyLegitimate Interest
IP addressConsent

8. Special categories of data

We process special category data from you on behalf of the Client Organisation, (the employer/potential employer you are connected with) only when you have consented. Such special category data is only that which is provided by you, the data subject, and is only processed by us where you have consented to this when agreeing to use the Sova Assessment Tools for the purposes of the Client Organisation’s recruitment campaign or project.

The special categories of personal data concerned are:

Personal data typeLegal basis for processing:
Nationality
Gender
Ethnicity
Race
Plus, any additional special categories of data that may be requested by the Client Organisation (the employer you are connected with)
Legitimate Interest
Consent

9. Consent

Consent is required for Sova Assessment to process the special category data referred to above. Such consent is obtained by the Client Organisation (the employer/potential employer you are connected with) at the point that you agree to the use of the Sova Assessment Tool prior to you entering any information to such tool.

You may withdraw consent to our processing of special category data at any time by contacting the Client Organisation (the employer/potential employer you are connected with) to let them know that your consent is withdrawn. The process by which you should contact the Client Organisation may be found in the Privacy Notice of the client.


10. Disclosure

Sova Assessment may share your data with third parties and for the purposes set out below:

Subsidiaries of Sova Assessment

  • Any of our subsidiaries for research and development purposes, for example; to produce psychometric norms and validity data and/or to help produce our psychometric manuals. In this regard, data is only shared in anonymous or aggregate form.

Third parties (acting as sub-processors)

  • Associates who provide services on our behalf.
  • Suppliers who provide IT, system administration and platform services to us, as well as suppliers providing any other services connected to the service we provide.

As required by Data Protection Legislation, any sharing of personal data is subject to appropriate confidentiality obligations and safeguards, as per the below;

  • relevant contractual clauses are in operation to ensure third party due diligence in relation to data security
  • third party processes are checked to ensure appropriate safeguards are adopted
Personal data typeLegal basis for processing:
Subsidiaries of Sova Legitimate Interest
Consent
Third parties (acting as sub-processors)Performance of a contract

11. International transfers of personal data

Where personal data is transferred outside the EEA (which includes all EU countries plus Iceland, Liechtenstein and Norway), we take all reasonably necessary measures to ensure that the protection offered by the GDPR will travel with the data and, that your data is treated securely and in accordance with this Privacy Notice and the requirements of Data Protection Legislation. This means that when exporting data abroad, we will ensure one of the following measures are adhered to:

  • the non-EU country's protections are deemed adequate by the EU.
  • relevant contractual clauses are in operation to ensure third party due diligence in relation to data security
  • third party processes are checked to ensure appropriate safeguards are adopted
  • specific grounds for the transfer (derogations) such as the consent of the individual are applicable

12. Retention period

Sova Assessment will process personal data for as long as necessary to fulfil the purposes for which the data was collected, as agreed with the Client Organisation (the employer/potential employer you are connected with). For further information, please refer to the Client Organisation’s Privacy Potice.

In relation to personal data collected online, as a result of the completion of an online assessment, where feedback is provided and/or your participation in an assessment or development process, all data collected in the Sova system will be anonymised after 6 months following completion, unless otherwise directed by the Client Organisation.

Once anonymised, data can for instance continue to be used for developing new norms, but personally identifiable data will have been removed. This anonymised and aggregated data may continue to be used indefinitely without further consent from you as the individual.

If you require further information on specific retention periods, please contact us (see section 4.2 for how to contact us).


13. Automated Decision-Making

Automated decision-making means making decisions about you using no human involvement. The products and services that Sova Assessment provide to you, on behalf of our clients (the employer/potential employer you are connected with) are usually not used in isolation in the recruitment or development process, but rather are used to help employers make accurate and informed decisions.

Where a Client Organisation (the employer/potential employer you are connected with) uses the Sova Assessment Tools in such a manner that a decision is taken in relation to you solely on the basis of your interaction with the Sova Assessment Tools, such use will either be on the basis that this is necessary for entering into, or performance of, a contract between the Client Organisation and you, or on the grounds of your explicit consent. In such cases, under Data Protection Legislation you have various rights in relation to such processing, including the right to object and the right to obtain human intervention on the part of the Client Organisation, to express your point of view and to contest the decision. Please contact the Client Organisation (the employer/potential employer you are connected with) if you have any questions on the use of Automated decision-making in this situation.


14. How we keep your data secure

Sova Assessment are committed to ensuring the security of your data. As the data processor, we ensure that all necessary steps are taken to protect against the potential loss, unauthorised disclosure of, or access to, the personal data we process or use. Sova Assessment adopts the following safeguards to ensure the security of your data.

  • candidate data will be anonymised 6 months following completion, unless otherwise directed by the Client Organisation you are connected with.
  • access to personal data is restricted to authorised individuals
  • secure encryption policies are in operation
  • all the provisions of ISO 27001 certification

15. Your rights as a data subject

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

  • Right of access – you have the right to request a copy of the information that we hold about you.
  • Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
  • Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
  • Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
  • Right of portability – you have the right to have the data we hold about you transferred to another organisation in certain situations.
  • Right to object – you have the right to object to certain types of processing such as direct marketing.
  • Right to object to automated processing, including profiling.
  • Right to judicial review: in the event that we refuse your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 17 below.

You can exercise your right by contacting us at the following email address – compliance@sovaassessment.com

All of the above requests will be forwarded on to the Client Organisation, acting as a data Controller or, should there be a third party involved (as stated in 10 above) in the processing of your personal data.


16. Changes

We may update and vary this Privacy Notice from time to time. Any updates will be published on our website


17. Complaints

In the event that you wish to make a complaint about how your personal data is being processed by Sova Assessment (or third parties as described in 10 above), or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and Sova Assessment’s data protection representatives.

Sova Assessment has contracted the services of GRCI Law to act as its Data Protection Officer (DPO). Accordingly, Sova Assessment will seek advice, guidance and input from the DPO where necessary.

The details for each of these contacts are:

Contact nameSupervisory authorityDPO
Address line 1:UK Informtion Commissioner’s Office (ICO)GRCI Law
Address line 2:Wycliffe House, Water LaneGRC International Group Plc
Unit 3, Clive Court
Address line 3:WilmslowBartholomew’s Walk
Cambridgeshire Business Park
Address line 4:CheshireEly
Cambridgeshire
Postcode:SK9 5AFEly
CB7 4EA
Email:casework@ico.org.ukcompliance@sovaassessment.com