Legal
Privacy policy
What is collected, why, for how long, and who else touches it.
Who runs this
SharpAssessment is an independent product built by the team behind 100Hires. It is not yet operated through a separate legal entity, so the honest answer to "who is the controller" is the people reachable at[email protected], which is the address for every request described on this page. If your procurement needs a contract with a named company, ask and we will tell you exactly what can be signed today rather than leaving you to find out later.
The two roles we play
| Whose data | Our role | Who decides |
|---|---|---|
| Visitors to this website | Controller | Us |
| People who sign up | Controller | Us |
| Candidates assessed by an employer | Processor | The employer, under the data processing agreement |
Visitors to this website
- Server logs. IP address, page requested, time, user agent and referring page, written by the web server. Used to keep the site running and to deal with abuse. Deleted within 30 days.
- Analytics. Google Analytics 4, which sets cookies and reports aggregate usage. Details, including how to opt out, are on the cookies page.
- A first-party click counter. Records which page a call to action was seen or clicked on. It stores a path and an event name and sets no cookie, and nothing a visitor types is ever sent to it.
Legal basis: legitimate interests in operating, securing and measuring a website, except for analytics cookies where consent applies under local law.
People who sign up
- What is collected. Your email address, optionally what you are hiring for and your expected hiring volume, which page you signed up from, and the address of the page that referred you, stripped of its query string.
- Why. To set up your account with tests that fit your roles, and to email you when your batch opens. Not for a newsletter, and never sold or shared with anyone else.
- How it is stored. In a file outside the web root, readable only by the account that writes it. Addresses are never placed in a URL and never written to a plaintext access log; see thesecurity page.
- How long. Until you ask to be removed, or 24 months after the last contact with you, whichever comes first.
- Legal basis. Steps taken at your request before entering into a contract, and legitimate interests in replying to a business enquiry.
Candidates
When an employer assesses a candidate, the employer decides what is collected and why. We process it on their instructions and for no other purpose. In practice that means the candidate's name and email address as supplied by the employer, their answers, their score, and timestamps.
- Kept for 12 months by default, then deleted. The employer can delete sooner.
- Stored on infrastructure in Germany (EU).
- Never sold, never shared between employers, never used for advertising, never used to train AI models.
- Candidate-facing explanation of all of this, in plain language, is on the candidate page.
A candidate can contact us directly. Where a request needs the employer's decision, we pass it on and tell the candidate we have done so.
Who else processes data
The current list, with what each one does and where it is, is on the sub-processors page. Customers are notified before a new sub-processor starts handling candidate data.
International transfers
Stored data sits in Germany (EU). Two services in the list are US companies operating global networks: Cloudflare, which handles requests in transit, and Google Analytics, which is used on the public marketing site only and never on candidate assessments. Where those transfers involve personal data leaving the EEA or the UK, they rely on the European Commission's standard contractual clauses and the UK addendum.
Your rights
If you are in the EU or the UK, you have the right to access your personal data, to have inaccurate data corrected, to have data deleted, to restrict or object to processing, and to receive your data in a portable form. Similar rights apply in a growing number of US states. To exercise any of them, email[email protected]. We answer within 30 days and will tell you if a request has to be routed through an employer.
You also have the right to complain to a supervisory authority: your national data protection authority in the EU, or the Information Commissioner's Office in the UK. We would rather you told us first, but that is your call, not a condition.
Changes
When this page changes materially, the date at the top changes and anyone with an account is emailed. Older versions are available on request. We do not quietly rewrite a policy and backdate it.
Contact
Any question about this page, or any request under it:[email protected].