Privacy Policy - Candidates/Participants

As part of the competency assessment process, your data is processed by two entities performing different roles:

Data Controller (Heroify Client):
The entity (company/employer) that invited you to complete the assessment. This entity decides for what purpose your skills are being assessed (e.g., recruitment, promotion, training planning). The obligation to provide you with information pursuant to Articles 13 or 14 of the GDPR rests with the Controller and should be communicated to you directly by that company, for example in the invitation to the process.

Data Processor (Heroify):
Heroify sp. z o.o., with its registered office in Warsaw, ul. Padewska 23/7, 00-777 Warsaw, VAT ID: 5213930518, provides the technology and processes data on behalf of the Controller, acting solely in accordance with its instructions. Heroify does not make employment decisions and does not use candidates’ data for other recruitment purposes without their consent.

Independent Controller (Heroify) – for selected categories of data:
With regard to certain categories of data, Heroify acts as an independent data controller (Article 4(7) GDPR). This applies to:

The legal basis for this processing is Heroify’s legitimate interest (Article 6(1)(f) GDPR), consisting in ensuring the reliability and security of the assessment process for all platform users.

Contact regarding data protection matters: gdpr@heroify.co

We collect data necessary for a reliable assessment of your professional potential:

Identification and contact data
First name, last name, and email address – necessary to create a test session and provide you with your results. Heroify processes this data on behalf of the Controller (the company that invited you).

Phone number
In recruitment processes, providing a phone number is required. This number is used to verify your identity via SMS code and ensure the integrity of the assessment process.

In employee assessment processes, the Controller (your employer) may disable the requirement to provide a phone number in the platform configuration. If this option has been enabled, we will not ask you to provide your number.

Heroify processes the phone number as an independent data controller based on legitimate interest (Article 6(1)(f) GDPR).

Assessment results
We record your responses in tests and open-ended questions. Heroify processes this data on behalf of the Controller.

Integrity mechanisms (anti-cheating)
To ensure objectivity and equal opportunities for all assessed individuals, the system monitors certain activities during the test session in order to detect unfair practices. For this purpose, we process the following categories of technical and behavioral data:

Detailed monitoring mechanisms are not publicly disclosed in order to prevent circumvention. Monitoring takes place only during an active test session. Heroify processes this data as an independent controller based on legitimate interest (Article 6(1)(f) GDPR).

Fairness Policy
Before starting the test, you will be asked to accept the Fairness Policy, which sets out the rules for completing tasks independently (prohibition on using AI tools, prohibition on assistance from third parties). Acceptance is a condition for participating in the assessment.

Feedback
Based on your results, we generate a report to help you understand your strengths and areas for development.

We process your data on the basis of:

The Heroify platform generates results and reports based on the answers provided in assessments. These results serve solely as support for the decision-making process – final decisions regarding employment, promotion, or other use of the results are always made by the Data Controller (employer or entity organizing the assessment).

Heroify does not make any automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR.

Your data may be shared with the following categories of recipients:

We do not sell your personal data to third parties.

Your personal data is stored on servers located within the European Union. If we use tools provided by suppliers outside the EEA, we apply appropriate safeguards in accordance with Article 46 GDPR, in particular Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the supplier’s registration under the EU-US Data Privacy Framework (DPF). In this way, we ensure an adequate level of data protection.

As a user, you have access to a dedicated panel where you can view the history of all your assessments completed on the Heroify platform. This allows you to track your own development independently of the organization that commissioned the assessment and constitutes the implementation of your right of access to data and right to data portability.

The Heroify platform uses cookies and records session logs only to the extent necessary for the proper functioning of the service, ensuring security, and analytical purposes. This data is processed on the basis of Heroify’s legitimate interest (Article 6(1)(f) GDPR).

The retention period depends on the purpose of processing:

Under the GDPR, you have the right to:

Please note: With regard to data for which the company inviting you to the assessment is the controller, your requests should be directed directly to that company. Heroify will forward requests to the Controller if they are sent to us. With regard to data for which Heroify acts as an independent controller (user profile, phone number, anti-cheating data), requests should be sent directly to us at gdpr@heroify.co.

For matters relating to your personal data on the Heroify platform, please contact us:

Email: gdpr@heroify.co
Address: Heroify sp. z o.o., ul. Padewska 23/7, 00-777 Warsaw