Please read this Data Protection Notice ("Notice") to continue. It sets out how and why your Employer and SHL collect your personal information. For any defined terms which are not defined on this page, please see the definitions included within the Notice.
Please read the entire Notice carefully.
If you have questions about this Notice, please refer to FAQ page.
This Notice was last updated on 22 March 2019.
CHANGES TO THIS NOTICE:This Notice has been updated to address the possibility of the United Kingdom leaving the European Union and the migration of our data storage facilities during 2019.
1 Who we are
This Notice describes how:
respectively use your information collected through this online Assessment.
SHL will process and collect information about you when you complete an SHL assessment ("Assessment") in accordance with this Notice. Some information is ("Personal Information"), personal information about you or from which we can identify you.
This Notice also covers us, and our affiliated group of companies. Each group company is listed here.
This Notice sets out the way the Employer and SHL use your information: what is collected, how it is collected, how it is used, why it is used, who it is shared with and the rights to which you will be entitled.
Section 2 (Employer as the Data Controller) provides further information on processing of your personal information by the Employer as the data controller.
Section 3 (SHL as the Data Controller) describes processing of your Personal Information by SHL for our own purposes as data controller.
Section 4 (The Employer and SHL as the Data Controller) provides additional information on who SHL and the Employer share your data with and an overview of your rights under data protection law.
2 Employer as the Data Controller
SHL collects your Personal Information on behalf of your Employer. If you have a query as to the identity of the Employer, please contact the SHL Data Protection Officer (DPO) on email@example.com or the contact details included at the end of this Notice.
The Employer will be the data controller in respect of your Personal Information and the Employer will decide what data is collected, the purposes for which it is collected and who it is shared with. You will be able to exercise your rights directly against the Employer in respect of this Personal Information (see section 4 (The Employer and SHL as the Data Controller) for more information)).
The data collected
We collect and process the categories of data on behalf of the Employer as set out below. The categories of data which are collected about you vary depending on the type of Assessment and instructions we receive from the Employer. Not all the categories of data listed below may be collected about you. If you require further information as to the extent of the data that is collected you should contact the Employer directly.
What we collect
Information that you give us and the Employer when you complete an Assessment, including:
i. "Candidate Data" which includes your:
ii. "Assessment Data" which are your answers to the Assessment questions.
Using the Candidate Data and Assessment Data, we generate the ("Results Data"), which includes the results of your Assessment.
Additionally, we will collect information if provided to us by your Employer ("Employer Provided Data"). To the extent provided by your Employer to us, this will include:
What we do with the data
We use your Candidate Data, Assessment Data, Results Data, and Employer Provided Data (if provided) on behalf of the Employer to:
Why this data is collected and how long it is retained by us
We hold and process your Candidate Data, Assessment Data, Results Data, along with Employer Provided Data, in accordance with the Employer's instructions. The reasons why the Employer collects your Personal Information will vary but generally, the Employer will instruct us to process your Personal Information because they have one or more of the following legitimate interests:
We will keep your Personal Information on behalf of the Employer in accordance with the Employer's instructions. The period of time that we are instructed to hold your Personal Information, varies from Employer to Employer. We will not delete your Personal Information if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.
You should contact the Employer directly if you require more information on this section.
We will only share your Personal Information processed on behalf of the Employer with the Employer and on the Employer's instructions. The Employer may share your Personal Information with other third parties including its group companies and those parties listed at section 4. You should contact the Employer for more information on who they share your Personal Information with.
3 SHL as the Data Controller
When you complete an Assessment we will collect Personal Information about you for the purposes outlined below. We will be data controller in respect of this information and we will be responsible for your Personal Information including for what purposes your information is collected and used.
If you have any questions on the processing of your data by SHL as data controller you can contact the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice.
What we collect
How we use it
We anonymise a combination of your Assessment Data, Results Data, Employer Provided Data (if any) and Research Data for our own purposes. Once anonymised we use this data to:
Only if you have provided us with your express consent, we use your name and email address, for our own purposes, to:
We use your Technical Information to primarily provide you or the Employer with service support and for our own purposes including to identify issues with the assessment and your experience of it.
We collect your Country of Residence Information because we have a legitimate interest to comply with legislation applicable to the SHL group, in particular US Trade Sanctions law.
Why we use it
We anonymise your Assessment Data, your Results Data, your Employer Provided Data, Research Data, and Candidate Data because we have a legitimate interest to create Benchmark Data to develop and improve our services.
We use your Technical Information because we provide technical support to the Employer as well as individuals who reach out to us using our web help form and we have a legitimate business interest in understanding how our assessments are accessed, how they are used and any problems users have with them across multiple devices.
If you require further information regarding our legitimate interests as applied to your personal data, you may contact the SHL Data Protection Officer (DPO) on email@example.com or the contact details included at the end of this Notice.
We will also process your Personal Information if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claims against us.
How long we keep it
We keep your Assessment Data, Results Data, Employer Provided Data, Candidate Data, and Research Data, for our own purposes in a de-identified form for a maximum of seven years. We will not delete your Personal Information if it is relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.
We keep your Technical Information and Country of Residence for seven years.
Where your Personal Information will be held
We store your Personal Information in data centres located in Germany and backed up in Ireland. SHL affiliates also transfer your Personal Information within the EEA (Europe Economic Area).
Additionally, your Personal Information is transferred to the United States, India, South Africa and United Kingdom ("SHL Non EEA Processing Locations") where a limited number of personnel in our SHL Non EEA Processing Locations, as well as our trusted third party vendors and service providers, have access to Personal Information in order to provide services. As the SHL Non EEA Processing Locations are in countries which do not have equivalent data protection laws to those applicable in the EEA we have an Intragroup Agreement in place, signed by all SHL affiliates, which contains the European Union (EU) Standard Contractual Clauses (SCCs) which have been approved by the EU data protection authorities for the transfer of data outside the EEA. Our third party vendors and service providers are also required to sign up to SCCs in accordance with Article 46 of the General Data Protection Regulation. All SHL affiliates have the same technical, physical, and administrative security controls and are required to comply with our data protection policies and procedures, applicable laws, governing the collection and use of personal information.
We are happy to provide you with copies of the regulator-approved SCCs,which you can request from the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice.
When do we share Personal Information
We have set out the circumstances in which we will share your data with third parties below:
4 The Employer and SHL as the Data Controller
The Employer and SHL as data controller will share your data with the following third parties in the below circumstances:
Data Subject Rights
We've listed the rights you have over your Personal Information and how you can use them below. These rights are subject to exemptions in applicable law and will only apply to certain types of information or processing. As described above, the Employer will be data controller so you should contact them directly if you want to exercise a right over data for which they are data controller.
You also have a right to make a complaint to a Supervisory Authority. Where we are the data controller you can contact the UK Information Commissioner's Office; or the local data protection regulator in your jurisdiction.
Where the Employer is the data controller, you can contact the regulator in the location where the Employer is based.
Questions or Complaints
Questions about the results of your assessment or the Employer's use of your Personal Information should be sent directly to the Employer at whose request you are taking the assessment.
If you have any questions about this Notice please contact the SHL Data Protection Officer (DPO) on email@example.com or the contact details included at the end of this Notice.
Changes to the Notice
This Notice will be changed from time to time. If we change anything important about this Notice (the information we collect, how we use it or why) we will provide a prominent notice to bring your attention to such importance changes for a reasonable length of time following the change.
If you would like to access previous versions of this Notice, please contact the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice.
We are committed to keeping your personal information safe. We have implemented physical, technical and administrative measures to help prevent unauthorised access or use of your information. For more information about the security measures we have please see our: Security Policy.
SHL products and services are subject to US sanctions law. As a result, prohibited individuals, or those located in certain countries (Cuba, Iran, North Korea, Sudan and Syria), are not authorised to take assessments on our systems. Please contact us at email@example.com with any questions.
SHL Data Protection Officer Contact Details:
Postal Address: Data Protection Officer, SHL Group Ltd, The Pavilion, 1 Atwell Place, Thames Ditton, Surrey, KT7 0NE, England.