Examiz Privacy Notice

Version 1.0 — effective September 2026. This notice replaces any earlier privacy statement.

This notice explains how Examiz Limited ("Examiz", "we", "us") processes personal data when you visit our websites, use the Examiz Talent Suite (Examiz MATCH, Examiz PULSE, Examiz OCEAN and related services), hold an Examiz MyCareer account, apply to a job or take part in a process run by one of our customers, or contact us. It also explains your rights and how to exercise them.

1. Who we are and how to contact us

Controller / processor: Examiz Limited, Company No. 674918, 71 Baggot Street Lower, D02 P593 Dublin, Ireland.

Data-protection contact: data.protection@examiz.com · General support: support@examiz.com · Postal: address above, attention "Data Protection".

Examiz has not designated a statutory data protection officer; our data-protection contact above handles all data-protection matters and requests.

2. Our role: when we are responsible, and when a customer is

Examiz acts in two different roles. Which one applies determines who you should contact about your data.

Examiz is the controller (we decide why and how your data is processed) for:

• visitors to our websites and people who contact us;
• users of our customers' accounts (recruiters, hiring managers, administrators), in respect of their own account, billing and support data;
• individuals who hold an Examiz MyCareer account, including Talents who have opted into the Examiz OCEAN marketplace, in respect of the profile they maintain with us;
• subscribers to our newsletters and job alerts, and people who use our Career Guide or CV Guru tools in their own name;
• our own accountability records (contract, billing, acceptance and disclosure records, do-not-contact lists).

Examiz is a processor (we act on a customer's instructions) when a company uses the Examiz Talent Suite to run its own recruitment, testing, interviewing, onboarding, offboarding or exit-interview processes. In that case the company is the controller of your data, its own privacy notice applies, and you should direct requests to that company. We describe that processing in Section 4 for transparency and we provide the company with tools to answer your requests. If you contact us instead, we will forward your request to the company and help route it.

Where a company transfers your application into the Marketplace, or shares you within a shared talent pool, you will be asked to opt in or be informed of the arrangement, as described in Section 5.

3. Personal data we process as controller

3.1 Website visitors

When you visit examiz.com or the platform's public pages we process technical data needed to deliver the page and keep it secure: IP address (used transiently for security and rate limiting and not stored with your identity), browser and device information, the pages requested and timestamps. Our platform sets only technically necessary cookies and local storage (session, language, security tokens); we do not use third-party analytics, advertising or tracking cookies in the platform. If our public website uses any non-essential cookies, a consent banner will tell you and ask first.

Legal basis: legitimate interest in providing and securing our websites (Art. 6(1)(f) GDPR).

3.2 Customer users (recruiters, hiring managers, administrators)

If your employer uses the Examiz Talent Suite, we process your name, business e-mail address, role and permissions, language, login and security data (including single-sign-on identifiers and group memberships received from your employer's identity provider), your actions in the platform (audit log), your support requests, and — if you connect your Google Calendar for interview scheduling — your Google account e-mail, encrypted access credentials, your free/busy times and the interview events we create in your calendar (see Section 7).

Legal bases: performance of our contract with your employer and our legitimate interest in operating, securing and supporting the platform (Art. 6(1)(b) and (f) GDPR); for the optional calendar connection, your consent given in the Google authorisation screen (Art. 6(1)(a)), which you can withdraw at any time by disconnecting.

3.3 Examiz MyCareer members and Examiz OCEAN Talents

If you create a MyCareer account (directly, by claiming an invitation from a company, or by using CV Guru) we process:

• account data: name, e-mail address, password (hashed), language, device registrations for notifications;
• your profile: CV documents and their parsed content, career history, education, skills, languages, certifications, job preferences (roles, locations, availability, expected remuneration), work-permit information you choose to provide, portfolio links;
• optional self-reported fields: date of birth, current or last monthly earnings — used only for aggregated, anonymous labour-market statistics computed above a minimum group size, for legal compliance and (date of birth) a birthday greeting; never shown to companies and never used for matching, ranking or scoring;
• an estimated year of birth derived from your education history when you have not provided a date of birth, used only for the same aggregated statistics and clearly marked as an estimate;
• your marketplace settings: whether you are discoverable, whether you show your name (contract-labour profiles only), your consents and withdrawals, contact requests you receive and your responses, messages exchanged with companies, blocks you set;
• assessments and tests you complete through a company's process and choose to keep in your profile, and their results;
• coarse location: the postal code you provide or, if none, a city-level location derived once from your IP address when you first use the service (the IP address itself is not stored);
• purchase data if you buy MyCareer Plus (order and payment status; card details are held by our payment provider, not by us);
• conversations with our Max assistant (deleted within 24 hours, see Section 6.4).

How the Marketplace protects you: companies searching the Marketplace see your profile in pseudonymised form. Your name and contact details are revealed only when you explicitly accept a company's contact request (or, for contract-labour profiles, when you have chosen to display your name). You can decline, withdraw or object at any time.

Legal bases: performance of your MyCareer contract with us (Art. 6(1)(b)); your consent for marketplace discoverability, cross-company visibility, talent-pool sharing and optional fields (Art. 6(1)(a)), withdrawable at any time; our legitimate interest in security, fraud prevention and aggregated statistics (Art. 6(1)(f)).

Where a company invites you into the Marketplace after you applied to it, your application data is held by that company as controller until you opt in; if you do not opt in, it remains subject to the company's own retention period and is never absorbed into the Marketplace.

3.4 Job-alert and newsletter subscribers

E-mail address, chosen preferences and confirmation status; a lightweight record is created so that we can send you the alerts you asked for and honour your unsubscribe. Legal basis: consent (Art. 6(1)(a)); withdrawable via the link in every message.

3.5 Career Guide and CV Guru users

Questions and answers you exchange with the Career Guide assistant on a company's career page (an automated assistant; some replies may be generated with AI) and the content you provide to CV Guru to build a CV. Legal basis: performance of the service you requested (Art. 6(1)(b)); consent where you choose to save the result to a MyCareer account.

3.6 People who contact us

Name, contact details, the content of your message and our reply, and — for data-protection requests — the information needed to verify your identity and document our response. Legal basis: legitimate interest in handling enquiries and legal obligation for data-protection requests (Art. 6(1)(c) and (f)).

4. Personal data processed on behalf of our customers (Examiz as processor)

The following applies when a company uses the Examiz Talent Suite for its own processes. The company is the controller; its privacy notice governs.

Special categories of data (for example health, religion, trade-union membership) are not requested by the platform. If you include such information in free text or documents, it is processed only as part of that content. Companies can use our anonymisation ("blind review") tools to hide identifying information from reviewers.

5. Sharing, transfers into the Marketplace and shared talent pools

• From application to Marketplace: a company may invite you to join Examiz MyCareer / OCEAN. Only your explicit opt-in transfers your data to Examiz as controller. Silence never counts as consent.
• Shared talent pools: groups of companies may share candidate profiles either (a) with your consent, asked per group and per share and withdrawable per group, or (b) between companies that have accepted a joint-controller arrangement, in which case the company that received your application must have named the pool in the privacy notice you saw before you applied, you receive a notice naming every recipient and the essence of the arrangement, and you can object at any time — an objection is always honoured. Shared profiles never include your pipeline stage, outcomes, notes, ratings or salary information.
• Blocks: a company may record that it does not wish to list or contact you in the Marketplace; such records are never shown to you, are aggregated by Examiz, and may lead to a temporary, automatically applied restriction of your marketplace visibility if several companies report you. A restriction never deletes your account and never prevents you from applying to a job. Restrictions decided by a person are communicated to you with a contact address; automatic restrictions are limited to 180 days and lift automatically.

6. Automated processing, profiling and AI-assisted functions

6.1 Scoring and ranking (profiling)

When you apply through a company using Examiz MATCH, your questionnaire responses, test results and structured CV data are compared against the role's requirements by a deterministic, rule-based scoring engine authored by people. The engine produces match, professional, personality, culture and skill scores and a ranked list. This is automated processing and, under the GDPR, profiling. It is decision support: the ranking is a proposal that the company's recruiters review; the platform records that review and supports human-authored reasons for every outcome. No function of the platform automatically rejects an application. Optional automatic next steps (for example inviting the top-ranked candidates to a test) are limited to approval lists a person reviews.

You are told about this before your data is ranked (a notice appears on application forms, status pages and in messaging channels). From your application status page you can request a human review and an explanation of the logic and your own Article 15 data package, which includes your scores and the method used.

6.2 AI-assisted functions

Some functions of the platform use large language models to draft, translate, summarise, structure, classify or answer — for example structuring an uploaded CV, drafting job advertisements or test questions for a recruiter, summarising panel comments for a recruiter who already has the full comments, anonymising documents, rewording your own CV text in CV Guru, or answering a user's product question in the Max assistant. These functions:

• never produce a score, ranking, knockout, rejection or other decision about you;
• produce drafts or summaries that a person reviews and can change or discard;
• are labelled where you interact with them ("automated assistant", "drafted with AI assistance");
• fall back to a non-AI path when the AI component is unavailable.

Where AI processing happens: all AI processing of candidate-related content takes place on infrastructure operated by Examiz in the EU. Only limited, non-personal content — a user's typed product question and its documentation passages, or role requirements for a job-advertisement draft — may be sent to the external AI model providers listed in Section 8, after an automated check that refuses transmission of name-like or identifier-like content. Candidate documents, answers, assessment responses and scores are never sent to an external AI provider. Our AI providers are contractually prohibited from using this content to train models.

6.3 Your rights concerning automated processing

Under Article 22 GDPR you have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. Because every hiring decision is taken by the company's people, the platform does not make such decisions; nevertheless, you may at any time request human intervention, express your point of view and contest an assessment through the company or through us, and we will route your request.

6.4 The Max assistant

Requests you type to the Max assistant are logged for 24 hours to operate and debug the assistant and are then deleted; they are not used for profiling. Anything Max actually does on your instruction is recorded in the normal audit log of the account.

7. Google Calendar integration and Google user data

Interviewers may connect their Google Calendar to the platform so that candidates are only offered interview times when the interviewer is actually free, and so that booked interviews appear in the interviewer's own calendar. If you connect your calendar, we request the following Google permissions: view your availability (free/busy) in your calendars and see, create, change and delete events on calendars you own. We use these permissions solely to (a) read the start and end times of busy periods (never event titles, attendees, locations or descriptions), (b) create, update and delete the interview events we generate in your own calendar (without attendees), and (c) show you which Google account is connected. Access tokens are stored encrypted, busy times are refreshed every 15 minutes for a rolling 90-day window and deleted when you disconnect, and we revoke our access with Google when you disconnect. You can also revoke access at any time at https://myaccount.google.com/permissions.

Limited Use disclosure: Examiz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as necessary to provide this feature or as required by law, and do not allow humans to read it except with your consent, for security purposes, to comply with law, or for internal operations where the data has been aggregated or anonymised. We do not use data obtained through Google Workspace APIs, including Google Calendar data, to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models, and we do not transfer it to any AI provider.

8. Recipients and international transfers

We share personal data only with the following categories of recipients, and only to the extent necessary:

• Our customers (the companies whose processes you take part in) and, in the Marketplace, the companies whose contact requests you accept.
• Service providers (sub-processors) who process data on our behalf under data-processing agreements:

• Services engaged by our customers or by you directly — for example a company's own identity provider for single sign-on, a company's own e-mail domain, an external assessment provider a company connects, or job boards a company selects — process data under their own terms.
• Authorities and advisers where required by law or to establish, exercise or defend legal claims.

International transfers. We host and process personal data in the EU. Where a recipient above is located outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (and, where the recipient is certified, the EU-US Data Privacy Framework), supported by a transfer impact assessment and supplementary measures. You can request a copy of the relevant safeguards from data.protection@examiz.com.

9. How long we keep your data

10. Your rights and how to exercise them

You have the right to access your data, to have it rectified or erased, to restrict or object to processing, to data portability, to withdraw any consent at any time (without affecting prior processing), not to be subject to solely automated decisions, and to lodge a complaint with a supervisory authority — in Ireland the Data Protection Commission (www.dataprotection.ie) — or with the authority of your place of residence or work.

10.1 Self-service

• MyCareer members: in your account you can download all your data in a machine-readable format ("Download my data") and delete your account ("Delete my account"). You can change your discoverability, consents, blocks and optional fields at any time, and cancel a MyCareer Plus purchase from the same page.
• Applicants: from your application status page you can request your Article 15 data package ("Request My Personal Data"), request a human review of your ranking, and withdraw your application. The company reviews and releases your package; the platform tracks the statutory deadline for the company.
• Interviewers: disconnect your Google Calendar in the availability settings.

10.2 By e-mail

Write to data.protection@examiz.com. We may need to verify your identity. Where the request concerns a company's processing, we forward it to the company and help route it. We respond within one month, extendable by two months for complex requests.

10.3 What deletion means

When you delete your MyCareer account, your profile, documents, consents, messages, assistant logs and marketplace data are erased. Please note:

• Companies you applied to are notified and must either erase their copy of your application immediately or, if they need it to establish, exercise or defend legal claims (for example an equal-treatment claim), retain it for at most 6 months from your request, after which identifying data is erased automatically; anonymous statistics without your identity remain.
• A hashed record (a one-way hash of your e-mail address and the reason) is retained if your address ever bounced or you reported a message as unwanted, so that we never contact that address again. This record cannot be turned back into your address by anyone who does not already know it.
• A minimal tombstone (a hash of your e-mail address and the date of erasure) is retained to document that the erasure took place.
• Immutable accountability records — such as the record that a data package was disclosed to you — are retained as required to demonstrate compliance.

11. Security

We host all data in ISO 27001-certified EU data centres; encrypt data at rest (AES-256) and in transit (TLS 1.2+); additionally encrypt candidate identity and contact data at field level with per-record keys and search it only through keyed blind indexes; isolate every customer's data; enforce role-based access and multi-factor authentication for administrative access; log every access to personal data; apply k-anonymity floors to all statistics; do not record video interviews; and train all staff annually. Platform staff have no standing access to customer accounts. Our detailed technical and organisational measures are set out in our Data Processing Agreement.

12. Children

Our services are intended for persons aged 16 and over. We do not knowingly process data of younger persons; please contact us if you believe we have done so.

13. Changes to this notice

We update this notice when our services, providers or legal requirements change. The version and date appear at the top. Material changes to processing that rely on your consent will be brought to your attention and, where required, your consent will be sought again. The English version is authoritative; translations are provided for convenience.