Privacy notice

This notice explains how [Company legal name] ("Second Opinion", "we") handles personal data. Contact: [privacy contact email]. Postal address: [registered address].

1. Our roles

• Processor for employers. When an employer uses Second Opinion for recruitment, the employer is the controller of candidate data and we process it on the employer's instructions. The terms are in our data processing agreement.
• Controller for our own account data. We are the controller of the data needed to run user accounts, billing, security and support.
• Controller for anonymised research data. Where a candidate or manager has given optional research consent, we keep anonymised results to improve the questionnaire. This consent is separate and can be withdrawn.

2. Information for candidates (GDPR art. 13)

When you open a questionnaire link, you see this information before you start.

• What we process: your name or code, contact details if the employer entered them, your answers, time taken, derived results, and any files the employer attached.
• Purpose: to give the hiring manager conversation material for the interview and a second opinion when comparing candidates.
• Legal basis: the employer's legitimate interest in recruitment (GDPR art. 6(1)(f)). Research use rests on your explicit, optional consent.
• Recipients: the employer, and our sub-processors listed in the data processing agreement. Data is hosted in the EU.
• Retention: by default 12 months after the employer closes the job, then deleted. The deletion date is shown to you.

3. No automated decisions (GDPR art. 22)

Second Opinion never makes or changes a decision about you on its own. It does not screen candidates out and shows no verdict word. Every status change is made by a person at the employer.

4. Your rights

You can ask for access to your data, including your report and raw answers; correction of inaccurate data; deletion; restriction of processing; and to object. Make the request through the employer or write to us. We answer within 30 days.

You may complain to Datatilsynet (Norway) or to the data protection authority in your own country.

5. South Africa

For people in South Africa we follow POPIA, including section 71 on automated decision-making. The Information Regulator is the complaints authority.

6. Account data and cookies

We use only the cookies needed to sign in and keep the service secure. Account data is kept while the account exists, and invoices as required by accounting law.

7. Security

Data is encrypted in transit and at rest. Access is limited and logged. We will notify the employer without undue delay of a personal data breach.

8. Changes

We will publish changes here and update the version number.