About this notice
This Candidate Privacy Notice explains how personal data is collected and used when you receive an invitation to complete a cybersecurity assessment on the CyberHire platform.
If you are a business customer or a visitor to our marketing site, please read our main Privacy Policy instead.
Who the controller is
When you take an assessment, the company that invited you (the "Customer") is the controller of your personal data. They decide why and how your data is processed, and they hold the primary relationship with you for the purposes of this assessment.
CyberHire Limited (a company incorporated in England and Wales with company number 17389369; registered office 66 Paul Street, London EC2A 4NA, United Kingdom) operates the assessment platform and acts as a processor, handling your data strictly on the Customer's written instructions and under a Data Processing Addendum. If you have a question about why you are being assessed, what role you are being considered for, or how the Customer will use the result, please contact the Customer directly - usually the hiring team or HR contact who invited you.
Certain narrow processing activities are carried out by CyberHire as an independent controller - for example, platform security and fraud prevention, preventing multiple concurrent assessments for the same candidate, and complying with our own legal obligations. Where that is the case, this notice explains our legal basis.
What personal data we process
We collect and process the following categories of personal data about you when you take an assessment:
Information provided by the Customer or by you
- Your name and email address (provided by the Customer when they invite you, either directly or from their applicant tracking system if they have connected one).
- Optional profile information you choose to add (e.g. a profile picture).
- A password if you create a candidate account - stored as a bcrypt hash, never in plain text.
- If you enable multi-factor authentication, the MFA secret used to generate time-based codes, stored encrypted at rest.
Assessment activity
- Your answers to each question or challenge.
- Timestamps for when you started, submitted, and completed each task.
- Scores calculated from your answers.
- Any commands you run inside a challenge environment (for technical challenges that run on an ephemeral Linux virtual machine - see below).
- Whether you marked items for review.
Challenge environments
Some challenges run inside a dedicated, ephemeral Linux virtual machine provisioned just for you on our infrastructure provider (Fly.io). The VM is bound to your assessment attempt and is destroyed once you finish or time out. Activity inside the VM (commands, files created, artefacts) is associated with your assessment result for the Customer to review and is retained according to the retention policy below.
Integrity signals
For each assessment the Customer starts from one of three modes - Unmonitored, Standard Monitoring or Proctor Mode - and can switch each of the checks below on or off. The checks that apply to your assessment are listed in your invitation email and on the assessment page before you sign in or start. Unmonitored switches every check off; Standard Monitoring switches on everything except webcam photos and requiring a single screen; Proctor Mode switches everything on.
| Check | What is recorded |
|---|---|
| Always, on every assessment | IP address, approximate location (country and city only, from an offline geolocation database - no precise coordinates) and browser, captured once the test begins and every few minutes during it. Not captured from the assessment introduction page. |
| Time away from the test | When you leave the assessment window (by switching tab or application), and for how long. |
| Pastes from outside the test | Text pasted that did not come from inside the assessment, with its length and the question it was pasted into. Copying and pasting within the assessment is not recorded, and copying is never recorded. |
| Require fullscreen | Each time fullscreen is left, and the total time spent outside it. |
| Detect a second screen | Whether a second screen is connected during the assessment, where the browser can tell us (Chrome and Edge). |
| Require a single screen | That only one screen is connected at the start, and any second screen during the assessment. |
| Webcam photos | If you consent, still photos (not video, no audio) every 2, 5 or 10 minutes. Also whether you chose not to use the webcam, and whether capture stopped during the assessment. |
Integrity signals are shared with the Customer alongside your result so they can review the conditions in which the assessment was taken. They are presented as what happened, not as a finding about you. Neither CyberHire nor the platform makes any hiring decision based on them; the Customer decides how to interpret them. Choosing not to use the webcam is never scored or presented as a concern.
Technical and session data
- Your IP address, which we use to detect abuse (for example, many attempts from the same address) and to derive your approximate location (country / country code / city) using an offline IP database (DB-IP Lite). We do not resolve precise coordinates, postal address, or street.
- Your User-Agent string and basic browser / device information.
- Authentication tokens, session duration, login timestamps.
What we do not collect
- We do not record webcam video or audio. Webcam photos are still photos only, and only taken with your consent.
- We do not use facial recognition or biometric matching, and no AI analyses webcam photos.
- We do not record your keystrokes or typing patterns, or attempt to identify you from how you type.
- We do not record your screen or what you copy.
- We do not access files on your device outside the challenge environment.
- We do not monitor your screen or webcam between assessments.
- We do not run advertising pixels or tracking cookies on the candidate assessment interface.
Legal bases for processing
Where CyberHire processes your data on behalf of the Customer, the Customer determines and relies on their own lawful basis (usually the performance of a contract, or the Customer's legitimate interest in hiring). Contact the Customer to understand their specific basis.
Where CyberHire processes your data as an independent controller (primarily for platform security and fraud prevention), we rely on our legitimate interests (UK GDPR Art. 6(1)(f)) - running a secure platform for all users.
Where the mode involves webcam capture, the Customer relies on your consent (Art. 6(1)(a)), collected in-browser before any capture occurs. We record when you gave it, the wording you were shown, and your IP address and browser at the time. Giving consent is optional: you can take the same assessment without the webcam, and the Customer has agreed not to treat that choice as a negative. You can withdraw consent during the assessment by turning off camera access in your browser; no further photos are taken. Photos already taken are deleted as described below, or sooner if you exercise your right to erasure.
Anonymised and aggregated statistics
We produce anonymised, aggregated statistics from assessment activity and platform usage. Examples include how a cohort performed on a particular challenge, how long candidates typically take, how often a given integrity signal occurs, and whether declared certifications or years of experience correspond to demonstrated practical performance.
We may use those statistics to improve and calibrate the platform and its challenges, and we may publish them - for example as research, benchmarks or industry reporting. Nothing we publish identifies you. Published output is aggregated so that no individual candidate can be picked out, directly or indirectly, and we do not name the employer you applied to without their agreement. We do not attempt to reverse the anonymisation.
Once data has been anonymised in this way it is no longer personal data, so data-protection law and this notice no longer apply to it. The act of creating that anonymised data does involve processing your personal data first. We do that on the Customer's documented instructions, and, where we act as an independent controller for platform improvement, on the basis of our legitimate interests (UK GDPR Art. 6(1)(f)) in operating, calibrating and improving a fair and accurate assessment platform. You can object to that processing - see Your rights below.
Who we share your data with
- The Customer - your answers, scores, integrity signals, webcam photos (if they were switched on and you consented), and assessment session metadata are visible to authorised reviewers at the Customer.
- Our sub-processors - a small set of service providers that help us run the platform (email, file storage, hosting and content delivery, ATS integration where the Customer has connected an ATS, AI generation of challenges). The full list is at Sub-processors. Each is bound by a written processor contract with UK GDPR Article 28 terms.
- Law enforcement, regulators or courts, only where we are legally required to do so.
We do not sell your data. We do not share assessment data with other Customers.
International transfers
The platform is hosted in the United Kingdom and the European Economic Area. Some of our sub-processors process personal data outside the UK: Postmark (which sends your invitation and notification emails, United States), Cloudflare (content delivery and DDoS protection, global network), Supabase (file storage including any webcam photos, EEA), Merge (ATS integration where the Customer uses it, EEA), Anthropic (AI challenge generation, United States) and Stripe (Customer invoice payments, with infrastructure in the United States). The full list is at Sub-processors. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as appropriate. Full details are in our Privacy Policy.
How long we keep candidate data
Unless the Customer instructs us otherwise in writing (subject to applicable law), we retain candidate assessment data for 24 months from the date the assessment closes. This covers:
- Your answers and scores
- Integrity signals (time away, pastes from outside the assessment, fullscreen exits, second-screen detection, etc.)
- IP address and derived approximate location
- Challenge-environment logs and artefacts
Webcam photos are kept for a shorter time: they are deleted 90 days after they are taken, whatever the retention period for the rest of your result. Your result then records how many photos were taken and when they were deleted, but not the photos themselves.
After 24 months, these records are deleted or anonymised. Note that the Customer may export a copy of your result for their own records before the retention period ends - any such export is held by the Customer under their own retention policy; contact them directly to find out how long they keep it.
If you are invited to further assessments by a different Customer, those assessments start their own 24-month clock and are stored separately.
Your rights
You have the following rights under UK GDPR in relation to your personal data:
- Access - a copy of your personal data
- Rectification - correction of inaccurate data
- Erasure - deletion in defined circumstances
- Restriction - limitation of processing in defined circumstances
- Portability - a structured, machine-readable copy
- Objection - to processing based on legitimate interests
- Withdraw consent - where processing is based on consent (e.g. webcam capture)
- Not to be subject to solely-automated decisions that produce legal or similarly significant effects
How to exercise your rights
- For assessment data (answers, scores, integrity signals, webcam photos): the Customer is the controller. Please contact the hiring team or HR contact who invited you. If you cannot reach them, or you do not know who the Customer is, email us at [email protected] and we will help you identify the right contact and pass the request on.
- For your CyberHire candidate account itself (name, email, password, profile): email us directly at [email protected]. We will respond within one calendar month.
We do not make hiring decisions based on automated processing. Any automated scoring of your answers is reviewed by the Customer before any hiring decision is made.
Security
We protect candidate data with the same technical and organisational measures set out in Annex II of our Data Processing Addendum, including encryption in transit and at rest, role-based access, audit logging, and documented incident response.
How to complain
If you are unhappy with how your data has been handled, please contact us first at [email protected], or the Customer directly. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or - if you are in the European Economic Area - your local supervisory authority.
Contact
Our Data Protection Officer is Michael Carthy. You can reach the DPO at [email protected].