GDPR & Data Policy

1. GDPR Compliance

SkillCertify is fully committed to GDPR compliance. We act as a Data Controller for personal data collected directly from users, and as a Data Processor when processing data on behalf of organizations using our assessment platform.

Our approach to GDPR compliance includes:

• Privacy by design and by default — we collect the minimum data necessary.
• Automated data deletion: webcam proctoring snapshots are automatically and permanently deleted after 7 days by a job that runs every hour and removes every stored copy; account data is deleted immediately on account deletion (see Section 4 for the few records we keep).
• Webcam snapshots — integrity verification only: snapshots captured during proctored assessments are used only to confirm the candidate's presence and the integrity of the session: an automated check counts the faces in each image for the integrity score. They are shown only to the hiring team of the organization that sent the assessment; our staff access them only to investigate fraud or answer the candidate's support request. They are never used to train AI or any machine-learning model, never used for facial recognition or biometric profiling, never sold or shared with anyone else, and never included in any backup. They are kept only for the short window a human reviewer may need them (7 days), then erased.
• Sub-processors are listed below. We are putting written data processing agreements in place with each of them, including Standard Contractual Clauses (SCCs) where data leaves the EEA.
• A designated Data Protection Officer (DPO) reachable at dpo@skillcertify.io.
• Data subject requests (access, portability, erasure, restriction, objection) are handled by email at privacy@skillcertify.io and answered within the time required by applicable law (generally within 30 days, extendable for complex or numerous requests to the extent the law permits).
• A commitment to notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach, as GDPR requires (see Section 7).

2. Data We Process

3. AI Processing & Automated Decisions

SkillCertify uses AI (SkillCertify AI) for the following features:

• Talent Matching: AI analyzes job descriptions and matches them against validated skill profiles. This is used as a recommendation tool — organizations always make the final hiring decision.
• Interview Generation: AI generates interview questions based on job descriptions. No personal data is shared with the AI for this feature.
• Assessment Scoring: Lab tasks are scored automatically by checks that test objective completion criteria. Anti-fraud detection uses behavioral signals during sessions.
• Interview Scoring and Hiring Reports: In an AI interview stage your answers are transcribed (ElevenLabs) and the text is scored by an AI model (Anthropic Claude); an AI hiring report summarising a candidate's workflow results is written for the hiring organization (Anthropic Claude).
• In-Lab AI Assistant: In labs that include it, an AI coding assistant (OpenAI) answers your prompts. Every prompt and reply is logged with your session and, when an organization sent you the lab, shown in its report.
• Fallback providers: If the usual AI provider for a feature is unavailable, the same request may be sent to another provider listed in Section 5 (Anthropic, Google or OpenAI) so the feature keeps working.

Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing. AI-generated scores, summaries and recommendations on SkillCertify are advisory: the hiring organization makes the hiring decision, and our Terms require organizations to review results themselves. You can request a human review of any automated score by contacting support.

4. Your Data Rights

You can exercise the following rights through your account settings or by emailing privacy@skillcertify.io:

5. Data Sub-Processors

We use the following third-party sub-processors:

6. Assessment Session Data

During technical assessments, we collect additional data for scoring and fraud prevention. Here is exactly what we capture:

• Webcam Snapshots (proctored sessions): Periodic still-image snapshots (JPEG) are taken at intervals during the stages of hiring workflows (never during labs, tests or interviews taken on their own), only after the candidate accepts the webcam check shown before the assessment starts (one check per workflow; declining ends the assessment). These are used solely to verify that the registered user is present throughout the session. In a lab stage, a screenshot of the lab desktop is also taken about once a minute; it is stored, shown and deleted exactly like the webcam snapshots. We do not record continuous video. Snapshots are stored in private, access-controlled object storage (Amazon S3, us-east-1, USA). They are automatically and permanently deleted 7 days after the session by an automated retention job that runs every hour and removes every stored copy. You may also request immediate deletion by emailing privacy@skillcertify.io.
• Anti-Fraud Signals: Browser focus changes, session heartbeat intervals and, in hiring workflows, face-presence counts (from snapshots) are analyzed to produce a Trust Score. These signals are processed in-session. Only the aggregated Trust Score and flag counts are stored — raw signal streams are not retained. In a hiring workflow stage that requires the webcam, the Trust Score is lowered if no face is detected; labs and tests you take on your own are never penalised for the webcam. A low Trust Score flags the session for human review; it never fails a candidate automatically.
• AI Interview Pipeline (if applicable): If a company has configured an AI interview stage, your spoken answers are sent to ElevenLabs to be transcribed (the audio is not stored), and your transcribed or typed answers are scored by AI. No video of you is recorded. Conversation transcripts are retained as part of the assessment record for as long as the assessment is available to the company, so results can be reviewed or disputed, and are deleted when you delete your account or on request. No facial recognition or biometric identification is performed at any stage — face detection is presence-only.
• In-Lab AI Assistant Logs (if applicable): In labs that include an AI coding assistant, each prompt and reply is stored with the session record and, when an organization sent you the lab, shown in its report. They are deleted when you delete your account.
• Certificates: Passing an approved lab or knowledge test issues a certificate with a public verification page (name, test, score, pass mark, date, skills), reachable by anyone with its code and not indexed by search engines. Lab certificates are issued only for labs whose checks run outside the candidate's reach, so a result cannot be faked. Certificates stay valid while your account exists and are deleted with it.
• Lab Environment: The virtual machine used for your lab session is destroyed immediately after the session ends. No data from within the VM (files you create, commands you run) is retained after destruction.

Summary of assessment data retention:

• Webcam snapshots: deleted automatically after 7 days, or immediately on account deletion.
• Trust Score and fraud flags: stored with the session record, deleted on account deletion.
• Lab scores and task results: stored on your profile, deleted on account deletion.
• VM environment: destroyed immediately after session completion.
• AI interview transcripts (if applicable): retained with the assessment record; deleted on account deletion or on request. Interview audio: never stored.
• In-lab AI assistant logs (if applicable): retained with the session record; deleted on account deletion.
• Certificates: kept while your account exists; deleted on account deletion.

7. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by applicable law.
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights.
• Document all breaches, their effects, and remedial actions taken.

8. Data Processing Agreement

Organizations using SkillCertify to assess candidates are Data Controllers for candidate assessment data. SkillCertify acts as a Data Processor under GDPR Article 28. We are preparing a Data Processing Agreement (DPA) for organizations; contact us to discuss your requirements.

Organizations can connect their own systems through our Integration API and webhooks, and connect an AI assistant (such as Claude or ChatGPT) through our MCP server. Candidate data an organization retrieves this way (names, emails, invitation status, stage scores, pass/fail, report links and, through an AI assistant, AI result summaries; never webcam snapshots) leaves SkillCertify on the organization's instruction, and the organization is responsible for it as controller, including under the terms of the AI provider it chose.

To request a DPA or for any data protection inquiries, contact our Data Protection Officer at dpo@skillcertify.io.