Privacy Policy

Introduction

This privacy policy ("Policy") explains how Assess4Me bv ("Assess4Me", "we", "us", "our"), established in Belgium, collects, processes, stores and protects personal data when you use our website, platform and services. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Belgian law.

Please read this Policy carefully. Where we rely on your consent (for example for newsletters), we ask for it separately and you can withdraw it at any time.

What has changed in this version

• We keep an anonymised copy of each completed game play to calibrate and validate our games. The copy contains no name, e-mail address or other identifier, and is never used to evaluate an individual candidate (sections 3 and 7).

1. Data Controller

Assess4Me bv is the data controller for the personal data we process for our own purposes: user accounts, billing, security, marketing, our website and the free game demo.

When an Organisation uses our services to assess candidates, Assess4Me acts as a data processor on behalf of that Organisation. The Organisation is then the data controller for the candidate data (including assessment results, AI evaluations and hiring outcomes), and decides why and how that data is used. If you are a candidate and have questions about how an Organisation uses your results, please contact that Organisation; we will assist them in answering your request.

The same applies when an Organisation or one of its recruitment partners connects its own systems to Assess4Me (for example an applicant tracking system, our API or webhooks): the Organisation or partner is the controller for the data it sends to and receives from us.

Contact details: Assess4Me bv (enterprise number 1037.227.532) Maarschalk Gérardstraat 23/101, 2000 Antwerpen, Belgium E-mail: support@assess4me.com

2. What personal data do we collect?

2.1 Account data

• E-mail address and e-mail verification status
• Password (stored hashed); whether you sign in with a password or with Google
• Display name, company name and profile picture
• Google sign-in data (when you sign in with Google): name, e-mail address and profile picture
• The version and date of the Terms of Service and Privacy Policy you accepted
• Notification preferences (which e-mails and in-app notifications you want to receive)

2.2 Candidate profile data (optional)

Candidates can add the following to their profile:

• Phone number
• Location
• Headline (for example your current role)
• LinkedIn profile URL

Your name, headline, e-mail address, phone number, location, LinkedIn profile and photo are shared with an Organisation as soon as you accept its assessment invitation, before you start the assessment. They are not shared with Organisations whose invitation you have not accepted.

2.3 Organisation and team data

• Organisation name, website domain, logo and settings
• Members of the organisation, their role (creator or member), functional role (for example recruiter or hiring manager), status and who invited them
• Invitations to join an organisation (e-mail address, role, status)
• Company background information that an Organisation provides to tailor our AI features (industry, what the company does, ways of working, tools used)

2.4 Candidate and assessment data

• E-mail address and name (from the invitation, from your account, or supplied by an Organisation's recruitment partner)
• Invitation and reminder history for each vacancy
• Game and quiz results: scores, reaction times, response times per question, answers selected in quizzes, number of attempts and time spent
• Browser-tab activity during an assessment: when you leave the assessment tab or window and for how long. This is shown to the Organisation as context alongside your results, and is included in the AI analysis (see section 4).
• AI-generated evaluations, skill scores, category results and rankings within a vacancy
• Hiring outcomes recorded by the Organisation (for example which candidate was hired, the hire date and follow-up notes)
• Internal reviews and notes added by the Organisation's team

2.5 Partner integration data

When an Organisation or its recruitment partner connects an applicant tracking system or other software to Assess4Me, that system may send us the candidate's name, e-mail address, the partner's own reference for the candidate, and other information the partner chooses to include. We create an account for the candidate so the assessment can be completed, and return results to the partner.

2.6 Billing data

• Organisation name, size, industry, website, billing address and VAT number
• Name and e-mail address of the person who sets up the subscription
• Stripe customer and subscription identifiers, payment status and invoices (card details are processed by Stripe; we never see or store full card numbers)
• Per-candidate charges, linked to an internal candidate identifier (not the candidate's name or e-mail)
• If a sign-up or checkout is started but not completed, we keep the details entered so we can follow up

2.7 Free game demo (website)

If you try a game on our website, we collect your name, e-mail address, an optional message about your interest, your game results and the AI evaluation we send you by e-mail.

2.8 Technical and usage data

• IP address: used briefly in memory to protect the platform against abuse (rate limiting); our servers do not store it in logs
• Server logs: request time, path, status and user identifier, for security and troubleshooting
• Browser type and device (user agent), for example when you submit a bug report

2.9 Communication and support data

• Contact form: name, e-mail address and message
• Newsletter subscription: e-mail address, source and consent status
• Bug reports: your e-mail address, account role, the page you were on, your description and your browser type
• Feedback you give on AI results (rating and comment)
• E-mail and in-app notifications we send you

2.10 Developer and integration data

• API keys (stored hashed), their name, creator and last use
• Webhook endpoints and the delivery history of webhook messages, which contain results data (for example vacancy title, candidate identifiers and scores)

2.11 Audit data

• Actions on the platform (logins, changes, deletions, data exports and staff access) for security and compliance purposes

3. What do we use your data for?

4. AI processing and automated decision-making

Assess4Me uses AI models from OpenAI to support recruiters. We use AI for:

• Evaluations of game and quiz results at skill, category and vacancy level, used in rankings and PDF reports;
• Interview guides that suggest topics to explore with a candidate;
• An AI assistant that answers a recruiter's questions about one candidate or about all candidates in a vacancy;
• Content generation: drafting vacancies, assessments and quizzes, explaining assessment choices and translating quizzes. This uses the Organisation's own content and company background, not candidate data.

The following applies:

• No fully automated decision-making: AI output is a tool for recruiters and is never the sole basis for a hiring decision. The final decision always rests with the recruiter or hiring manager.
• What data is sent to the AI: game and quiz results (scores, response times, attempts, answers), browser-tab activity during the assessment, the vacancy title and description, and the Organisation's company background. For evaluations and for questions about a single candidate, we do not send the candidate's name or e-mail address; candidates are identified only by an internal identifier. When a recruiter asks the AI assistant to compare the candidates of a vacancy, the candidates' display names are included so that the answer can refer to them. The recruiter's own questions are also sent.
• No training on your data: OpenAI does not use data sent through its API to train its models. OpenAI may keep API data for up to 30 days to detect abuse, after which it is deleted.
• Consistency and caching: evaluations are configured to give consistent output, and results are cached based on a fingerprint of the input data (without names), so identical results produce the same evaluation without repeated AI calls.
• Storage: cached evaluations are kept for a limited time (see section 7) and regenerated when needed. We keep a log of AI requests (fingerprint, model, cost and internal identifiers), not the full content.
• Free game demo: if you try a game on our website, your result is evaluated by the AI and the evaluation is e-mailed to you. Your name and e-mail address are not sent to the AI.

You have the right to request a human review of any AI evaluation. As a candidate, please address this request to the Organisation that assessed you; you may also contact us at support@assess4me.com and we will forward it.

5. Who do we share data with?

We do not sell your personal data. We share data only with the following categories of recipients.

5.1 Sub-processors

An up-to-date sub-processor list is available on request at support@assess4me.com. Organisations will be informed of new sub-processors as set out in our Data Processing Agreement.

5.2 Organisations (clients)

When you accept an assessment invitation from an Organisation, your profile (see 2.2) is shared with that Organisation, and your results, browser-tab activity and AI evaluations are shared with that Organisation's team. If you take part in assessments for several Organisations, each Organisation only sees the data relating to its own invitations.

5.3 Integrations chosen by an Organisation

An Organisation can send its candidates' results to its own systems: an applicant tracking system via a recruitment partner, its own software via our API or webhooks, or its own AI assistant via our integration for AI tools (MCP). Once data leaves Assess4Me through such an integration, the Organisation is responsible for it.

5.4 Legal obligations

We may share data where required by law, for example at the request of a competent authority.

6. International data transfers

Some of our sub-processors are located outside the European Economic Area (EEA), notably in the United States, or are US-based providers that may access data from the United States. We base these transfers on:

• The EU-US Data Privacy Framework (where the provider is certified)
• Standard Contractual Clauses (SCCs) issued by the European Commission
• Additional technical and organisational measures where necessary

Our website, platform, database and service e-mails run on Amazon Web Services in the EU (Ireland region). Public website files, uploaded images and game files are also delivered through Amazon CloudFront, which keeps temporary copies on servers worldwide so they load quickly; account and assessment data are not cached there.

7. How long do we retain data?

When data is deleted from our live systems, it disappears from our encrypted database backups within 30 days. When you delete your account, we keep a record in the audit log that the account was deleted, including the e-mail address, for accountability; billing records are kept for the statutory period.

8. Your rights

Under the GDPR you have the following rights:

• Right of access: you may request what data we process about you.
• Right to rectification: you may have inaccurate data corrected.
• Right to erasure ("right to be forgotten"): you may request that we erase your data.
• Right to restriction of processing: you may ask us to temporarily restrict processing.
• Right to data portability: you may request your data in a structured, commonly used format.
• Right to object: you may object to processing based on legitimate interest.
• Right to withdraw consent: you may withdraw previously given consent (e.g. for newsletters) at any time.
• Right to human intervention: you may request a human review of AI evaluations.

How to exercise your rights

• Edit your profile: via your account settings.
• Export your data: via the "Your data" section of your account settings.
• Delete your account: via the "Your data" section of your account settings. Deletion is immediate and permanent.
• Unsubscribe from e-mails: via the unsubscribe link at the bottom of our notification and marketing e-mails, via your notification preferences, or by e-mailing us. Service e-mails that are needed to use the platform (such as e-mail verification, password reset, invitations and billing) cannot be switched off.
• Other requests: send an e-mail to support@assess4me.com. We will respond within 30 days.

Candidates: for data held on behalf of an Organisation (your results for a vacancy), the Organisation is the controller. You can contact the Organisation directly, or contact us and we will pass your request on and help the Organisation answer it.

Filing a complaint

You have the right to file a complaint with the Belgian Data Protection Authority (GBA): Drukpersstraat 35, 1000 Brussels Website: gegevensbeschermingsautoriteit.be

9. Cookies and tracking

We use cookies and similar technologies. Details can be found in our Cookie Policy.

Summary:

• Necessary cookies and storage: required for sign-in, sessions, security and remembering your choices.
• Analytics and marketing cookies: we do not use any, so we do not show a cookie banner. If that changes, we will update this policy first and only place such cookies with your consent.

10. Security and staff access

We take appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of stored data, including the database, its backups and uploaded files
• Hashed passwords and hashed API keys
• HttpOnly cookies for long-lived session tokens
• Role-based access control and organisation membership
• Rate limiting to protect against abuse
• Audit logs of sensitive actions
• Secrets management for API keys and tokens

Staff access: a limited number of authorised Assess4Me staff can access accounts and organisations for support, billing and security purposes. This includes the ability to view the platform as a specific user in order to resolve a problem. Such access is limited to what is needed, time-limited and recorded in the audit log.

11. Children

Our services are not aimed at persons under the age of 16. We do not knowingly collect personal data from children. If we discover that we have collected data from a child, we will delete it as soon as possible.

12. Changes to this policy

We may update this privacy policy from time to time. In the event of material changes we will inform you by e-mail or via a notification on the platform, and ask you to review the updated policy. The version date at the top indicates when the policy was last updated. Previous versions remain available on this page.

13. Contact

For questions about this privacy policy or your personal data:

• Assess4Me bv
• Enterprise number: 1037.227.532 (VAT BE 1037.227.532), RLE Antwerp, division Antwerp
• E-mail: support@assess4me.com
• Address: Maarschalk Gérardstraat 23/101, 2000 Antwerpen, Belgium