How we handle your personal data

For candidates, users and website visitors

Introduction

The Selection Lab takes your privacy very seriously and processes your personal data with the utmost care and security. In this privacy statement, we explain how we handle your personal data and what your rights are. We recommend reading this statement carefully.

If you have questions or comments, please contact us at [email protected].

Who is The Selection Lab?

The Selection Lab B.V. is a private limited company, registered at Sint Pieterspoortsteeg 19, 1012 HM Amsterdam, The Netherlands. We are listed in the Dutch Chamber of Commerce under registration number 71341730.

The Selection Lab acts as the data controller for the processing of personal data.

We have appointed a Data Protection Officer (DPO), Ondřej Sloup, who can be contacted via [email protected].

How does The Selection Lab use your personal data?

Service provision and client management

Product: Skill profile via assessments

• Purpose: To assess the match between a candidate and an organization using a skill profile.
• Legal basis: Explicit consent.
• Consent question: "Do you agree to us processing your data to create a skills profile and based on that determine your match with different positions?"
• Data: Name, email address, telephone number where the assessment runs by telephone, and data generated during the assessment (including psychometric data classified as special category personal data).
• Retention period: 6 months.

Product: Skill profile (long-term access)

• Purpose: To store the digital skill profile so the individual retains access.
• Legal basis: Explicit consent (individuals are clearly informed that they are free to refuse without consequences).
• Consent question: "Do you want to keep unlimited access to your own digital skills profile?"
• Data: Same as above.
• Retention period: Until consent is withdrawn or up to 20 years.

Product: Skill profile (algorithm improvement)

• Purpose: To improve the selection algorithm.
• Legal basis: Explicit consent (refusal has no effect on the selection procedure).
• Consent question: "Can we supplement and analyze your data to optimize the process of matching candidates to this organization?"
• Data: See above, plus classification data provided by organizations (e.g., department, hiring phase, job offer status, and performance evaluations).
• Retention period: 5 years.

Product: Talent pool (only for individual users)

• Purpose: To match job seekers or interns with one or more organizations.
• Legal basis: Explicit consent.
• Data: Name, email address, telephone number where the assessment runs by telephone, and psychometric assessment data.
• Retention period: Until consent is withdrawn or up to 20 years.

Marketing

Direct marketing, newsletter, re-targeting

•  
• Data: Name, email address, browsing behavior, social media accounts.
• Legal basis: Consent.
• Retention period: 1 month after consent is withdrawn.

Social media marketing

• Purpose: Targeting visitors of our website with ads through a tracking pixel.
• Data: Same as above.
• Legal basis: Consent.
• Retention period: 1 month after consent is withdrawn.

Website

Website analytics

• Purpose: Analyze website behavior and improve the platform.
• Data: Browsing behavior.
• Legal basis: Consent.
• Retention period: 1 month after consent is withdrawn.

How do we obtain your personal data?

We receive your data directly from you or from the organization you are associated with (e.g., your employer).

How do we ensure that employees are free to give their consent?

The Selection Lab ensures in three ways that employees of organisations cannot suffer in any way as a result of whether or not their personal data are provided to The Selection Lab.

What are your rights?

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — You may request access to your data at any time.
• Right to rectification — You may request corrections to incorrect or incomplete data.
• Right to erasure — You may ask us to delete your data. We delete everything we hold, whichever organisation invited you.
• Right to restriction of processing — You may ask us to limit how we use your data.
• Right to object — You may object to processing based on legitimate interests.
• Right to data portability — You can request a structured, machine-readable copy of your data.
• Right to human intervention — In case of fully automated decisions, you can ask for human review.
• Right to withdraw consent — You can withdraw your consent at any time.

Requests can be sent to [email protected]. We will respond as soon as possible, and no later than one (1) month. If we reject your request, we will explain why.

Data recipients

We only share personal data with:

• Processors who provide services on our behalf.
• Parties involved in an agreement with you.
• Government authorities, if legally required.

Specifically, this includes the following parties:

Communication and authentication

• Brevo — email delivery (France)
• Auth0 — authentication and login management (Germany)
• HubSpot — communication platform and customer support (Germany/Ireland)
• Superhuman — email client for staff mailboxes (United States)

Data storage and processing

• Amazon Web Services (AWS) — database and file storage (Germany)
• Heroku — application hosting (Ireland)
• Redis Cloud — temporary data storage (Germany)
• CloudAMQP — message processing (EU)
• Google Workspace — email and file storage (Europe)
• Cloudflare — DNS, security and content delivery (global network; United States)

Analytics and monitoring

• Pendo — user statistics and analytics (Europe)
• Sentry — application logging (Germany/EU)
• Papertrail — application log storage (United States)

Assessments and forms

• Typeform, VideoAsk — assessment questionnaires and video forms (Spain; responses hosted in the United States)
• Testportal — hard-skill tests (Poland)
• Aivy (Germany), Brght (EU), Cappr (Netherlands), CriteriaCorp (United States and Australia), Talogy (EU), Ixly (Netherlands), NOA (Netherlands/Germany) — assessment providers, each only where the organisation you apply to uses that assessment

AI chat, only where the organisation you apply to uses it

• OpenAI — language model (United States; personal identifiers are filtered out by a PII gateway first)
• Langfuse — monitoring of the language model (Ireland)
• 360dialog — WhatsApp Business API (Germany)
• WhatsApp Ireland — message delivery (Ireland)

Data transfer outside the EEA

Your data is stored and processed within the European Economic Area (EEA). Some of the parties listed above are established in the United States or store data there: Typeform and VideoAsk, Cloudflare, Papertrail, Superhuman, CriteriaCorp (also Australia) and, for the AI chat, OpenAI. These transfers rest on the European Commission's Standard Contractual Clauses.

Automated decision-making

In recruitment procedures with a large number of applicants, the organisation you apply to may use a score threshold that is set in advance. Candidates who score above it move on; candidates below it do not, without a person deciding on each candidate. This is an automated decision within the meaning of Article 22 GDPR. It rests on the steps needed before entering into a contract (Art. 22(2)(a) GDPR) or, where that applies, on your explicit consent, and for the assessment data itself always on your explicit consent (Art. 9(2)(a) GDPR). The score is calculated by fixed rules, not by artificial intelligence. You are told before the assessment when this applies. Via [email protected] you can ask for a review by a qualified person, give your point of view and contest the decision; we respond within one month.

AI chat (SmartChat)

Some organisations offer an AI chat, in the browser or on WhatsApp, to answer questions and to take in your answers to screening questions. The chat's opening message tells you that the conversation uses AI. Before anything is submitted, the chat sends you a summary of your answers as it understood them; you can change any answer in the conversation and then confirm. The chat does not assess you. Messages are processed by OpenAI (United States) after personal identifiers are filtered out by a PII gateway.

Cookies

The Selection Lab uses small text files called cookies. These are stored on your device to enhance your browsing experience.

We use:

• Analytics cookies (Google Analytics, HubSpot) — to measure how the website is used.
• Advertising cookies (Facebook pixel) — to show relevant advertisements.

You can change or withdraw your choice at any time via "Cookies settings" at the bottom of every page.

Changes to this privacy statement

This statement may be updated periodically. You will be informed in advance of substantial changes. We recommend reviewing this page regularly at www.selectionlab.com/pages/privacy.

Reference documents

Questions or complaints

Questions or complaints? Email us at [email protected].

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).