Privacy Policy for Candidates/Participants
This document explains what happens to your data when you complete an assessment on the Heroify platform. Questions: gdpr@heroify.co.
1. Who is responsible for your data
In the assessment process, your data is processed by two parties in different roles.
The company that invited you to the assessment (the Controller). This is the employer or organization running the recruitment or employee evaluation. It decides why it is assessing you, how long it keeps your results and what it does with them. It is also responsible for informing you about how your data is processed in its process (Article 13 or 14 GDPR), for example in the invitation or the job posting. For questions about the legal basis of the recruitment, the hiring decision, deleting your data from the process or accessing it, contact that company.
Heroify (the platform provider). Heroify sp. z o.o., ul. Padewska 23/7, 00-777 Warsaw, Poland, NIP 5213930518. We provide the technology and, for the most part, act on behalf of the Controller, solely on its instructions (we are then the Processor). We don't make decisions about hiring you.
In a few narrowly defined areas, Heroify itself decides on the purpose of processing and is then the controller of your data. This applies to: confirming by e-mail or SMS code that you're using your own invitation, and the test integrity mechanisms (Section 4); your candidate profile with your results history (Section 6); and statistical norms and test quality analyses (Section 7). For these matters, write to us directly.
Contact for data protection matters: gdpr@heroify.co.
The Platform is intended for adults.
2. What data we process and why
| Data | Why | Who decides |
|---|---|---|
| First name, last name, e-mail address | Creating your test session, sending the invitation, verification code and results | Controller |
| Phone number (only if the Controller has enabled SMS verification) | Contacting you during the process (Controller); confirming by SMS code that it's you using the invitation (Heroify) | Controller and Heroify |
| Your answers to closed and open questions, attachments | Calculating results and preparing the report | Controller |
| Results, competency reports, AI-generated summary, statuses and notes added by the recruiter | Supporting the Controller in the evaluation | Controller |
| Technical session data: IP address, device and browser type, response times, events in the browser window (Section 4) | Test integrity | Heroify |
| A copy of your results and feedback reports in your candidate profile | Your access to your own results after the process ends | Heroify |
| Test results with metadata (test, language, job level, quarter), without first name, last name or e-mail | Comparative norms, test quality analyses and product development (Section 7) | Heroify |
Providing your first name, last name, e-mail and answers is voluntary, but without them you can't take part in the assessment. Your phone number is needed only when the Controller has enabled SMS verification. Using the candidate profile after the process ends is your choice.
3. Verification and time to complete
Before you start, you confirm with a code sent by e-mail, by SMS or by both methods that you're using your own invitation (the Controller decides which method) and you accept the Assessment Integrity Policy. You see the time to complete before you start; once it runs out, the assessment is closed and you can't restart it yourself. If the Controller asks Heroify to let you take it again, your first completion is deleted and you start the assessment from scratch.
4. Integrity mechanisms (anti-cheating)
Assessments are completed remotely, without a person supervising. To keep results reliable and fair for everyone, during an active test session we record technical data in the following categories:
- events in the browser window in which you're taking the test (for example leaving the test tab),
- response time for individual questions and the start and end time of the session,
- IP address and device and browser type.
We don't publish the detailed rules by which we evaluate this data, because disclosing them would make it easier to get around the safeguards; the categories of data collected are, however, exactly as listed above.
Based on this, the system calculates a trust indicator (high, medium, low). The recruiter sees the indicator and its explanation: the browser window events and response times the indicator is based on. The indicator and its explanation become part of your result held by the Controller and are stored as long as the result (Section 10); we delete the remaining technical session data (IP address, device, browser, records about codes) after 6 months. The indicator is only a signal: the system doesn't reject you automatically, doesn't invalidate your result and doesn't hide it from the recruiter. The signals are assessed and the decision is made by a person on the Controller's side, to whom you can raise objections. We don't use your camera or microphone, we don't collect biometric data, we don't record the session and we don't monitor anything outside the active test session. In the event of a technical error, we save a pseudonymized error report (without the content of your answers, your name, e-mail or IP address), which is used solely to fix the fault.
Heroify is the controller of this data on the basis of legitimate interest (Article 6(1)(f) GDPR): ensuring the integrity of the assessment in the interest of Controllers and honest candidates. You can object (Article 21 GDPR); we'll consider your objection individually and inform you and the company that invited you. Recording technical data is necessary to run a remote test, so it usually can't be taken without this mechanism; the company that invited you decides on any alternative form of assessment.
5. How we use artificial intelligence
The Heroify Platform uses artificial intelligence systems, including a language model, to prepare an evaluation for the recruiter.
What AI does. Answers to closed questions are scored algorithmically. The content of some questions may be tailored with AI to the position you're applying for, and for some tests AI selects questions from a pool prepared by Heroify's psychometric team so that question sets don't repeat between assessments; the scoring method is the same for all candidates in the same test. Based on the test results and the job requirements entered by the recruiter, the language model generates a short summary: your strengths, areas to explore further in the interview and potential points of concern. The Platform also displays the overall score, your place in the ranking of candidates in a given assessment and the trust indicator.
What is sent to the language model provider. The job title, level and description, your test and scale results with interpretations, and competency names. What is not sent: your first and last name, e-mail, phone number, the content of your answers, IP address. The data is pseudonymized; the provider doesn't use it to train its models.
Who decides. Everything AI generates is support for the recruiter. The decision to invite you to an interview, hire, promote or reject you is made by a person on the Controller's side. Heroify doesn't make automated decisions about you within the meaning of Article 22 GDPR.
What AI doesn't do. It doesn't recognize emotions, doesn't analyze voice or images, doesn't draw inferences about your origin, beliefs, health or other legally protected characteristics, and doesn't learn from your data.
Your rights in relation to AI. You have the right to know that you're being assessed with the use of an AI system (the Controller informs you of this; this document is part of that). You can ask the Controller to explain what role the result from the Platform played in a decision concerning you; Heroify provides the Controller with a description of the factors that influenced the result. More about the AI system: https://heroify.co/ai.
Heroify is a provider of a high-risk AI system within the meaning of the EU AI Act (systems used for recruitment and employee evaluation).
6. Your candidate profile
After every completed assessment, we give you a feedback report. We believe that everyone who spends time on a test deserves feedback, so this is a permanent feature of the Platform that the company inviting you accepts by using Heroify. The feedback report contains general information about the level of your results (for example below average, above average, significantly above average) and a short discussion; it doesn't contain detailed numerical results, notes, statuses or recruiters' decisions.
We save a copy of your feedback reports in your candidate profile, so you can come back to them even after the process run by the company that invited you has ended. Only you can see your profile, and it is not shared with employers. We run it as a controller, on the basis of legitimate interest (Article 6(1)(f) GDPR), which is giving you access to your own results.
Rules for using the profile. The candidate profile is a free service of Heroify sp. z o.o. (ul. Padewska 23/7, 00-777 Warsaw, Poland, KRS 0000903229, NIP 5213930518), provided electronically on the following rules, which you accept when you first log in:
- You log in with a one-time code sent to the e-mail address or phone number you used in the assessment. You need a device with internet access and an up-to-date browser with JavaScript enabled and the cookies needed for the session to work.
- You use only your own profile and don't share login codes with anyone else. You must not take any action that disrupts the Platform or aims to gain access to other people's data. Test content visible in the reports is the property of Heroify and may not be copied or distributed.
- You can close your profile at any time by writing to gdpr@heroify.co; this is also how you object to us running it. We also close it 12 months after your last login (or after creation, if you have never logged in). After closing, we delete the data used solely for the profile and disable access; this doesn't delete the data we process on behalf of the company running your assessment process, and we forward requests concerning that data to that company.
- The profile is a free service, provided as is; we make every effort to keep it working properly, but we don't guarantee uninterrupted availability. Send complaints about how the profile works to contact@heroify.co; we respond within 14 days. This doesn't exclude your rights under mandatory legal provisions, including consumer protection law.
- You can always find the current rules for using the profile in this Policy (Section 6), with the version date at the top of the document; if you don't accept the changes, you can close your profile at any time. The rules are governed by Polish law.
7. Comparative norms and test quality analyses
So that results can be compared with other people taking the same test, we build statistical norms (percentiles) and analyze the psychometric quality of tests in order to improve them. For this we use your test results with metadata (test, language, job level, quarter), without your first name, last name or e-mail. As long as your results are stored in the process of the company that invited you, this is pseudonymized data (it can be linked to you in our database), which we process as a controller on the basis of legitimate interest (Article 6(1)(f) GDPR); you can object, and if we uphold your objection, your results are no longer used for norms or analyses. Once your results are deleted from the company's process, only aggregated statistics remain, which can't be linked to you. The norms in reports contain only aggregated figures. We are supported in these analyses by a provider of analytics tools acting on our behalf; the same provider may, on behalf of the company that invited you, help diagnose an individual result, always without your identifying data. We don't evaluate you on the basis of these analyses.
8. Who we share your data with
- The Controller (the company that invited you) and its recruitment system (ATS), if it has connected one with us.
- Technical providers acting on our behalf (categories): hosting (servers in the EU), e-mail delivery, SMS delivery, traffic protection, language model provider, error monitoring, analytics tools for studying test quality (on data without first name, last name or e-mail).
- Public authorities solely on the basis of a legal obligation.
We provide information about specific recipients on request (gdpr@heroify.co).
9. Data transfers outside the EEA
The Platform's main infrastructure (the application and databases) is located on servers in the European Union. Some providers (traffic protection, SMS, e-mail, language model, error monitoring, analytics tools) may process data in the USA. In such cases we base the transfer on a European Commission adequacy decision (Article 45 GDPR; the EU-US Data Privacy Framework for certified US providers) or on Standard Contractual Clauses (Article 46 GDPR), and we assess the transfer risk. We provide a copy of the safeguards on request. We send only pseudonymized data to the language model provider, without your identifying data.
10. How long we keep data
| Data | Period |
|---|---|
| Answers, results, reports, AI summary, recruiter notes (Controller's data) | Until deleted by the Controller or until its contract with Heroify ends. Heroify may delete the data of an assessment that expired more than 24 months earlier, after notifying the Controller. After the contract ends: 30 days for the Controller to download the data (when switching providers, counted from the end of the transition period), then deletion within 45 days, including backups. The Controller informs you about the retention period in its process |
| Trust indicator and its explanation (browser window events, response times) | Same as results held by the Controller above: this is part of your result visible to the recruiter |
| Remaining technical session data (IP, device, browser), records of codes sent | 6 months from the end of your test session (phone number as contact data: same as the Controller's data above) |
| E-mail/SMS verification codes | The code expires shortly after it's sent; we keep the record that a code was sent (without its content) like technical session data, for 6 months |
| Technical error reports | 30 days |
| Candidate profile | Until closed by you or 12 months from your last login (from creation, if you have never logged in) |
| Results for norms and analyses (pseudonymized stage) | No longer than your results in the company's process |
| Aggregated norms | No limit; they are not personal data |
| Correspondence with us about your data | 3 years from the end of the matter |
If a complaint, dispute or proceedings before an authority are ongoing, we may keep the data covered by that matter longer, until it is concluded.
11. Your rights
You have the right to: access your data and get a copy of it (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability to the extent that processing is based on a contract or consent (Article 20), objection to processing based on legitimate interest (Article 21), and the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl).
Who to contact:
- about data from the recruitment process (answers, results, decisions, deletion from the process): the company that invited you. If you write to us, we'll forward your request to that company and let you know;
- about your candidate profile, verification codes, technical session data, norms and analyses: us, at gdpr@heroify.co. We respond within one month at the latest.
You can see your feedback reports in your candidate profile. For full information under Article 15 GDPR (including detailed results, technical data, recipients and retention periods; we forward requests concerning data processed on behalf of the company running your process to that company), write to gdpr@heroify.co.
12. Cookies
During the assessment we use only the cookies needed for the session to work and stay secure (including a bot protection tool). We don't use marketing or analytics cookies for candidates. Technical error reports are described in Section 4.
13. Security
We apply technical and organizational data protection measures appropriate to the risk, including encryption, access control and separation of each Controller's data.
14. Changes to this Policy
We announce changes by publishing a new version with the date at the top of the document; the current version is always available at this address and linked in your candidate profile. In the event of any discrepancy with the English version, the Polish version prevails.
15. Contact
E-mail: gdpr@heroify.co Address: Heroify sp. z o.o., ul. Padewska 23/7, 00-777 Warsaw, Poland