How we handle your personal data

For candidates, users and website visitors

Introduction

The Selection Lab takes your privacy very seriously and processes your personal data with the utmost care and security. In this privacy statement, we explain how we handle your personal data and what your rights are. We recommend reading this statement carefully.

If you have questions or comments, please contact us at [email protected].

Who is The Selection Lab?

The Selection Lab B.V. is a private limited company, registered at Sint Pieterspoortsteeg 19, 1012 HM Amsterdam, The Netherlands. We are listed in the Dutch Chamber of Commerce under registration number 71341730.

The Selection Lab acts as the data controller for the processing of personal data.

We have appointed a Data Protection Officer (DPO), Ondřej Sloup, who can be contacted via [email protected].

How does The Selection Lab use your personal data?

Service provision and client management

Product: Skill profile via assessments

• Purpose: To assess the match between a candidate and an organization using a skill profile.
• Legal basis: Explicit consent.
• Consent question: "Do you agree to us processing your data to create a skills profile and based on that determine your match with different positions?"
• Data: Name, email address, telephone number where the assessment runs by telephone, and data generated during the assessment (including psychometric data classified as special category personal data).
• Retention period: 6 months.

Product: Skill profile (long-term access)

• Purpose: To store the digital skill profile so the individual retains access.
• Legal basis: Explicit consent (individuals are clearly informed that they are free to refuse without consequences).
• Consent question: "Do you want to keep unlimited access to your own digital skills profile?"
• Data: Same as above.
• Retention period: Until consent is withdrawn or up to 20 years.

Product: Skill profile (algorithm improvement)

• Purpose: To improve the selection algorithm.
• Legal basis: Explicit consent (refusal has no effect on the selection procedure).
• Consent question: "Can we supplement and analyze your data to optimize the process of matching candidates to this organization?"
• Data: See above, plus classification data provided by organizations (e.g., department, hiring phase, job offer status, and performance evaluations).
• Retention period: 5 years.

Product: Proctored test (only where the organisation you apply to uses it)

• Purpose: To check that no outside help is used during a test.
• Legal basis: Explicit consent, asked separately before the test.
• Data: Screenshots of the test page, camera snapshots, audio recordings and mouse movements, combined into one review video. The organisation you apply to can see that video in your report. The recordings are not analysed automatically.
• Retention period: 30 days; backup copies are removed within a further 35 days.

Product: Talent pool (only for individual users)

• Purpose: To match job seekers or interns with one or more organizations.
• Legal basis: Explicit consent.
• Data: Name, email address, telephone number where the assessment runs by telephone, and psychometric assessment data.
• Retention period: Until consent is withdrawn or up to 20 years.

Marketing

Direct marketing, newsletter, re-targeting

• Data: Name, email address, browsing behavior, social media accounts.
• Legal basis: Consent.
• Retention period: 1 month after consent is withdrawn.

Social media marketing

• Purpose: Targeting visitors of our website with ads through a tracking pixel.
• Data: Same as above.
• Legal basis: Consent.
• Retention period: 1 month after consent is withdrawn.

Website

Website analytics

• Purpose: Analyze how the website is used and improve it.
• Data: Browsing behavior.
• Legal basis: Consent.
• Retention period: 1 month after consent is withdrawn.

How do we obtain your personal data?

We receive your data directly from you or from the organization you are associated with (e.g., your employer).

How do we ensure that employees are free to give their consent?

The Selection Lab ensures in three ways that employees of organisations cannot suffer in any way as a result of whether or not their personal data are provided to The Selection Lab.

What are your rights?

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — You may request access to your data at any time.
• Right to rectification — You may request corrections to incorrect or incomplete data.
• Right to erasure — You may ask us to delete your data. We delete everything we hold, whichever organisation invited you.
• Right to restriction of processing — You may ask us to limit how we use your data.
• Right to object — You may object to processing based on legitimate interests.
• Right to data portability — You can request a structured, machine-readable copy of your data.
• Right to human intervention — In case of fully automated decisions, you can ask for human review.
• Right to withdraw consent — You can withdraw your consent at any time.

Requests can be sent to [email protected]. We will respond as soon as possible, and no later than one (1) month. If we reject your request, we will explain why.

Data recipients

We only share personal data with:

• Processors who provide services on our behalf.
• Advertising platforms that also use data from our website for their own purposes, only after you allow advertising cookies.
• Parties involved in an agreement with you.
• Government authorities, if legally required.

Specifically, this includes the following parties:

Communication and authentication

• Brevo — email delivery (France)
• 360dialog — WhatsApp Business API, for messages about your application where the organisation uses WhatsApp (Germany)
• WhatsApp Ireland — delivery of those messages (Ireland)
• Auth0 — platform accounts and login (Germany)
• HubSpot — client communication and website statistics (Germany/Ireland)
• Superhuman — email client for staff mailboxes (United States)
• Intercom — support chat for client users and people a report is shared with, and on our website (United States)

Data storage and processing

• Amazon Web Services (AWS) — database and file storage (Germany)
• Heroku — application hosting (Ireland)
• Redis Cloud — temporary data storage (Germany)
• CloudAMQP — message processing (EU)
• Google Workspace — email and file storage (Europe)
• Cloudflare — DNS, security and content delivery (global network; United States)
• Zapier — passing applications from some organisations' systems to the platform, and workflow automation between our business tools (United States)

Analytics and monitoring

• Pendo — user statistics and analytics until 9 October 2026; the data collected until then is held until the Pendo subscriptions are closed and Pendo has deleted it (Europe and United States)
• Sentry — application logging and recordings of some sessions (Germany/EU)
• Papertrail — application log storage (United States)

Assessments and forms

• Typeform — questionnaires in your assessment, and a feedback question afterwards (Spain; responses hosted in the United States)
• VideoAsk — videos shown in your assessment (Spain; hosted in the United States)
• Testportal — hard-skill tests in your assessment (Poland)
• Aivy (Germany), Brght (EU), Cappr (Netherlands), CriteriaCorp (United States and Australia), Talogy (EU), Ixly (Netherlands), NOA (Netherlands/Germany) — assessment providers, each only where the organisation you apply to uses that assessment

Language model

• OpenAI — language model for the AI chat and for entering your answers into the organisation's recruitment system, where the organisation uses these (United States; personal identifiers are filtered out by a PII gateway first)
• Langfuse — monitoring of the language model (Ireland)

Website analytics and advertising, only after you allow the cookies

This concerns visits to www.selectionlab.com and to the sign-up and pricing pages of the platform only. The pages on which you take an assessment or use the AI chat load none of these tools, and no assessment data reaches them.

• Google — website statistics (Google Analytics) and advertising and campaign measurement (Google Ads) (Europe and United States)
• Promptwatch — statistics on visits from AI search engines (Netherlands)
• Meta — advertising on Facebook and Instagram, through the Meta pixel (Ireland and United States)
• LinkedIn — advertising and campaign measurement, through the Insight Tag (Ireland and United States)
• Microsoft — advertising and campaign measurement (Microsoft Advertising) and recordings of website visits (Microsoft Clarity) (Ireland and United States)
• OpenAI — measurement of our advertising in ChatGPT (Ireland and United States)
• Leadinfo (Netherlands), Leadfeeder (Germany), Lead Forensics (United Kingdom) — recognising which company visits the website

Google (for Google Ads), Meta, LinkedIn, Microsoft and OpenAI also use the data they receive for their own purposes, as controllers in their own right. Their privacy statements describe that use: Google, Meta, LinkedIn, Microsoft, OpenAI. For the Meta pixel, The Selection Lab and Meta Platforms Ireland Limited are joint controllers for collecting the data on our website and sending it to Meta. Meta Ireland is responsible for what it does with the data afterwards and for your rights over the data it holds; you can exercise those rights with Meta directly. Questions about the collection on our website can be sent to us.

Data transfer outside the EEA

Your data is stored and processed within the European Economic Area (EEA). Some of the parties listed above are established in the United States or store data there: Typeform and VideoAsk, Cloudflare, Papertrail, Superhuman, Zapier, Intercom, Pendo, CriteriaCorp (also Australia) and OpenAI. These transfers rest on the European Commission's Standard Contractual Clauses; for Zapier, Intercom and Pendo, on the EU-U.S. Data Privacy Framework.

If you allow cookies on our website, Google, Meta, LinkedIn, Microsoft and OpenAI also receive data about your visit in the United States. Google, Meta, LinkedIn and Microsoft are certified under the EU-U.S. Data Privacy Framework; where the framework does not apply, the transfer rests on Standard Contractual Clauses. OpenAI receives the data through OpenAI Ireland Limited and relies on adequacy decisions and Standard Contractual Clauses for transfers onward. Lead Forensics is established in the United Kingdom, for which the European Commission has adopted an adequacy decision.

Automated decision-making

The organisation you apply to may set requirements in advance: a score threshold in procedures with a large number of applicants, or expected answers to screening questions. Candidates who meet them move on; the others do not, without a person deciding on each candidate. This is an automated decision within the meaning of Article 22 GDPR. It rests on the steps needed before entering into a contract (Art. 22(2)(a) GDPR) or, where that applies, on your explicit consent, and for the assessment data itself always on your explicit consent (Art. 9(2)(a) GDPR). The score is calculated by fixed rules, not by artificial intelligence. Answers to screening questions in the AI chat are marked against the expected answer by a language model. You are told before the assessment when a score threshold applies. Via [email protected] you can ask for a review by a qualified person, give your point of view and contest the decision; we respond within one month.

AI chat (SmartChat)

Some organisations offer an AI chat, in the browser or on WhatsApp, to answer questions and to take in your answers to screening questions. The chat's opening message tells you that the conversation uses AI. When you have answered the questions, the chat sends you a summary of your answers as it understood them; you can change any answer in the conversation and then confirm. If you stop the conversation or do not respond, the answers you gave are kept and your application does not continue. The chat does not score your skills or personality. For screening questions it records your answer and marks whether it matches what the organisation asked for; the outcome can decide whether your application continues (see Automated decision-making). Messages are processed by OpenAI (United States) after personal identifiers are filtered out by a PII gateway.

Cookies

We use, with your consent:

• Analytics cookies (Google Analytics, HubSpot, Promptwatch) — to measure how the website is used.
• Advertising cookies (Meta pixel, LinkedIn Insight Tag, Microsoft Advertising and Clarity, Google Ads, HubSpot, OpenAI) — to measure our campaigns and show relevant advertisements.
• Company identification (Leadinfo, Leadfeeder, Lead Forensics) — to recognise from your IP address which company visits the website.
• Functionality cookies (Intercom) — for the support chat on the website.

You can change or withdraw your choice at any time via "Cookies settings" at the bottom of every page.

Changes to this privacy statement

This statement may be updated periodically. You will be informed in advance of substantial changes. We recommend reviewing this page regularly at www.selectionlab.com/pages/privacy.

Reference documents

Questions or complaints

Questions or complaints? Email us at [email protected].

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).