Data Protection Notice
Introduction to the Data Protection Notice
Please read this Data Protection Notice (“Notice”) to continue. It sets out how and why SHL collect your personal information. For any defined terms which are not defined on this page, please see the definitions included within the Notice.
Please read the entire Notice carefully.
If you have questions about this Notice, please contact email@example.com.
Data Protection Notice
This Notice was last updated 14 May 2018.
1 Who we are
This Notice describes how;
(1) SHL Group Limited of The Pavilion, 1 Atwell Place, Thames Ditton, Surrey KT7 0NE, England (together, SHL or we or us)
use your information collected through this online Assessment.
SHL will process and collect information about you when you complete an SHL assessment (“Assessment”) in accordance with this Notice. Some information is “Personal Information”, personal information about you or from which we can identify you.
This Notice also covers us, and our affiliated group of companies, where we are data controller. Each group company is a data controller and we've listed them here.
This Notice sets out the way SHL uses your information: what is collected, how it is collected, how it is used, why it is used, who it is shared with and the rights to which you will be entitled.
Section 2 (SHL as the Data Controller) describes the processing of your Personal Information by SHL for our own purposes as data controller as well as additional information on who SHL share your data with and an overview of your rights under data protection law.
2 SHL as the Data Controller
We collect and process the categories of data as set out below. The categories of data which are collected about you vary depending on the type of Assessment. Not all the categories of data listed below may be collected about you based on the Assessment you complete.
When you complete an Assessment we will collect Personal Information about you for the purposes outlined below. We will be data controller in respect of this information and we will be responsible for your Personal Information including for what purposes your information is collected and used.
If you have any questions on the processing of your data by SHL as data controller you can contact the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice.
What we collect
Information that you give us when you complete an Assessment, including:
i. “Candidate Data” which includes your:
· email address; and
· account log in details.
ii. “Assessment Data” which are your answers to the Assessment questions.
Using the Candidate Data and Assessment Data, we generate the (“Results Data”), which includes the results of your Assessment.
iii. OPTIONAL RESEARCH QUESTIONS - At the beginning of an Assessment, we will ask you to answer a set of optional demographic research questions (“Research Data”). Some of this demographic data collected will be of a sensitive nature and be classified as a special category of personal information as such you will be required to provide us with your consent to process this information during the Assessment. Providing this information is completely voluntary – if you do not want to answer a question, simply select the “Prefer not to answer” option. If you choose not to answer these questions, it will not prevent you from taking the Assessment or affect the Assessment results in any way. We will store your Research Data in a de-identified format and only use it in an anonymised format for research purposes as further detailed below.The questions ask you to provide certain types of demographic information for research purposes including your:
· First language;
· Country of Origin;
· Country of Residence;
· Highest educational qualification attached;
· Highest education qualification you are working toward;
· Level at current job;
· Years of Employment Experience; and
· Business function and Industry section you are currently working in.
iv. Technical Information relating to the systems you used to take the Assessment including:
· browser types;
· operating systems;
· IP addresses;
· Date / time stamps.
v. We also collect your country of residence (Country of Residence Information).
How we use it
We anonymise a combination of your Assessment Data, Results Data, and Research Data for our own purposes. Once anonymised we use this data to:
1. ensure that our Assessments remain fair, objective and prevent unfair discrimination;
2. develop and improve the services and assessments we offer; and
3. create aggregate benchmark measurements against industry recognised differences for different groups, jobs and industries (Benchmark Data) to be used for the above purposes.
We use your Technical Information to primarily provide you or the Employer with service support and for our own purposes including to identify issues with the assessment and your experience of it.
We collect your Country of Residence Information because we have a legitimate interest to comply with legislation applicable to the SHL group, in particular US Trade Sanctions law.
Why we use it
We anonymise your Assessment Data, your Results Data, Research Data, and Candidate Data because we have a legitimate interest to create Benchmark Data to develop and improve our services.
We use your Technical Information because we provide technical support to individuals who reach out to us using our web help form and we have a legitimate business interest in understanding how our assessments are accessed, how they are used and any problems users have with them across multiple devices.
If you require further information regarding our legitimate interests as applied to your personal data, you may contact the SHL Data Protection Officer (DPO) on email@example.com or the contact details included at the end of this Notice
We will also process your Personal Information if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claims against us.
How long we keep it
We keep your Assessment Data, Results Data, Candidate Data, and Research Data, for our own purposes in a de-identified form for a maximum of seven years. We will not delete your Personal Information if it is relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.
We keep your Technical Information and Country of Residence for seven years.
Where your Personal Information will be held
We store your Personal Information in data centres located in the United Kingdom.
Your Personal Information will be transferred to the United States, South Africa or India where a limited number of personnel in our US, South Africa and India offices, as well as our trusted third party vendors and service providers, will have access to Personal Information in order to provide their services. As the U.S., South Africa and India do not have equivalent data protection laws to those applicable in the EEA we have an Intragroup Agreement in place, signed by all SHL affiliates, which contains the European Union (EU) Standard Contractual Clauses (SCCs) which have been approved by the EU data protection authorities for the transfer of data outside the EEA, and our third party vendors and service providers are also required to sign up to SCCs in accordance with Article 46 of the General Data Protection Regulation. All SHL affiliates have the same technical, physical, and administrative security controls and are required to comply with our data protection policies and procedures, applicable laws, governing the collection and use of personal information.
We are happy to provide you with copies of the regulator-approved SCCs, which you can request from the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice
When do we share Personal Information
We have set out the circumstances in which we will share your data with third parties below:
· We will share a combination of your Assessment Data, Results Data and Research Data within our group companies when required to provide maintenance and support services and so that we can continue to improve the services we provide across the group.
· We will also share your information with our trusted third party service providers, including our survey tool provider, IT security provider and cloud hosting platform provider. Our service providers will be required to meet our standards on processing information and security.
Data Subject Rights
We've listed the rights you have over your Personal Information and how you can use them below. These rights are subject to exemptions in applicable law and will only apply to certain types of information or processing.
For the Personal Information where we are data controller, you can exercise these rights by contacting the SHL Data Protection Officer (DPO) on email@example.com or the contact details included at the end of this Notice
1. The right to withdraw consent: Where we have obtained consent for some of the ways we use your information you can remove that consent at any time by contacting the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice
2. You can ask us to confirm if we are processing your information and, if we are, you can ask for access to that information as well as further details including why your data is being used and for what purposes.
3. You can ask to correct your Personal Information held by us if it is wrong.
4. You can ask us to delete certain of your information.
5. You can ask us to restrict how we use your Personal Information.
6. You can ask us to help you move certain Personal Information to other companies. To help with that you have a right to ask that we provide your Personal Information in a machine readable format to another company.
7. You can ask us to stop using your Personal Information, but only in certain cases. This applies where we are processing your personal information based on a legitimate interest (or those of a third party) and you can object to processing on this ground. However we will be entitled to continue processing your information based on our compelling legitimate interests.
You also have a right to make a complaint to a Supervisory Authority. Where we are the data controller you can contact the UK Information Commissioner's Office; or the local data protection regulator in your jurisdiction.
Questions or Complaints
If you have any questions about this Notice please contact the please contact the SHL Data Protection Officer (DPO) on email@example.com or the contact details included at the end of this Notice.
Changes to the Notice
This Notice will be changed from time to time. If we change anything important about this Notice (the information we collect, how we use it or why) we will provide a prominent link to it for a reasonable length of time following the change.
If you would like to access previous versions of this Notice, please contact the SHL Data Protection Officer (DPO) on firstname.lastname@example.org or the contact details included at the end of this Notice
We are committed to keeping your personal information safe. We have implemented physical, technical and administrative measures to help prevent unauthorised access or use of your information. For more information about the security measures we have please see our: Security Policy.
SHL products and services are subject to US sanctions law. As a result, prohibited individuals, or those located in certain countries (Cuba, Iran, North Korea, Sudan and Syria), are not authorised to take assessments on our systems. Please contact us at email@example.com with any questions.
SHL Data Protection Officer Contact Details:
Postal Address: Data Protection Officer, SHL Group Ltd, The Pavilion, 1 Atwell Place, Thames Ditton, Surrey, KT7 0NE, England.