Privacy Policy

1. Who We Are

PRODICTA Ltd ("Prodicta", "we", "us", "our") is the data controller for personal data processed through the Prodicta platform. Our contact details are:

For data protection queries, contact us at admin@prodicta.co.uk.

2. Data We Collect

Account and profile data: when you create an account, we collect your email address, company name, and account type (direct employer or recruitment agency). We also collect any profile information you add in Settings.

Assessment content: job titles, job descriptions, skill weightings, and assessment templates you create.

SSP and employment records: statutory sick pay calculations, absence records, holiday pay entitlements, attendance logs, assignment review notes, and Compliance Documentation Packs generated through the platform. You are the data controller for this data; we process it on your behalf as a data processor.

Document templates: pre-filled employment document templates generated through the platform including assignment letters, SSP forms, and probation letters.

Candidate data: names, email addresses, and assessment responses of candidates you invite. You are the data controller for this data; we process it on your behalf as a data processor.

Usage data: information about how you use the Service, including pages visited, features used, and assessment activity. This helps us improve the platform and enforce usage limits.

Technical data: IP address, browser type, device information, and session data collected automatically when you use the Service.

Payment data: if you have a paid subscription, payment processing is handled by our payment provider. We do not store full card numbers.

2a. How AI is used in PRODICTA

PRODICTA uses AI to analyse candidate assessment responses and produce structured reports. This section explains what data the AI uses, what it does not use, how long outputs are stored, and how candidates can request human review of AI-generated findings.

What data the AI receives

When a candidate completes an assessment, the following information is provided to the AI scoring engine:

• The job description for the role
• The role context information provided by the agency or employer (e.g. seniority, key responsibilities, sector)
• The candidate's name, which is used in the written sections of the report
• The candidate's typed responses to each scenario, and the written transcripts of any spoken or video answers
• Time taken to complete each scenario
• Typing and timing signals for each scenario, including time to the first keystroke and typing speed. On UK assessments, these are not used for a candidate who says they use assistive software, dictation or another way of entering text, or who asks for an adjustment

The AI uses this information to generate scoring across defined skill dimensions, identify strengths and watch-outs with evidence, and produce a structured assessment report.

What data the AI does not use

The AI scoring engine does not receive or use:

• Candidate age or date of birth
• Demographic information including ethnicity, nationality, religion, or sexual orientation
• Photographs, video, voice recordings, or biometric data
• Information from previous assessments unless explicitly part of the current role context
• How the answers were entered, which PRODICTA records for UK assessments only: how many times text was pasted and how many characters, when entering text started and finished, and how much of the text entered was kept. It never includes what was pasted or each key pressed. It is shown to the hiring team as evidence, is never part of the score, and is not recorded for a candidate who says they use assistive software, dictation or another way of entering text, or who asks for an adjustment

PRODICTA does not use AI to make decisions based on protected characteristics under the Equality Act 2010.

How long AI-generated outputs are stored

Assessment reports, scoring data and supporting analysis are kept for as long as the employer's account is active. A candidate can ask us to delete their data by emailing admin@prodicta.co.uk, and we will respond within one month.

Candidates have the right to request deletion of their assessment data at any time by contacting the agency or employer who invited them, or by emailing admin@prodicta.co.uk.

Right to challenge AI-generated findings

Under UK GDPR Article 22, candidates have the right to request human review of any decision made about them that is significantly informed by AI processing.

To request human review, candidates can:

• Contact the agency or employer who invited them to the assessment
• Email admin@prodicta.co.uk with the candidate's name, the role assessed for, and the specific finding being challenged

A candidate can ask for a human review of their result by emailing admin@prodicta.co.uk. We will respond within one month.

It is important to note that all hiring decisions made via PRODICTA are made by humans (the agency or employer who invited the candidate). PRODICTA's AI scoring is provided as input to that human decision-maker; it does not make hiring decisions on its own.

3. How We Use Your Data

• To create and manage your account and provide access to the Service
• To generate AI-powered candidate assessments and scoring
• To send transactional emails such as candidate invitation links, account confirmations, and password resets
• To enforce plan usage limits and manage your subscription
• To respond to support requests and communications
• To generate SSP calculations, holiday pay records, Fair Work Agency compliance documentation, and employment document templates
• To send automated alerts for SSP checks, placement health changes, assignment performance deviations, and pre-start risk notifications
• To comply with legal obligations and enforce our Terms of Service
• To send product updates and service announcements (you can opt out at any time)

4. Legal Basis for Processing

5. Who receives your data

We use service providers to run PRODICTA: hosting and database, AI analysis of assessment responses, speech transcription, email delivery, payment processing and error monitoring. Some of this processing takes place outside the UK and the EU, including in the United States, and where it does we rely on approved safeguards such as standard contractual clauses. If an employer connects their applicant tracking system, data is shared with that system at the employer's direction. We do not sell personal data. For the names of our providers, email admin@prodicta.co.uk.

6. Data Retention

• Account data is kept for as long as your account is active. After an account is closed, we will delete it on request within one month, unless the law requires us to keep it
• Candidate assessment data is kept for as long as your account is active. A candidate can ask us to delete their data by emailing admin@prodicta.co.uk, and we will respond within one month
• Video and audio recordings of candidates' answers are deleted automatically 30 days after the assessment result is delivered to the employer, or 90 days after upload if no result is ever delivered. Deletion runs once a night and removes at most 500 recordings a night, so when more than 500 are due at once, the rest are deleted on following nights. If an employer deletes a candidate, that candidate's recordings are not yet removed automatically. The written transcripts of spoken and video answers are kept with the candidate's assessment data and are not deleted with the recording. Video briefings that employers record for a role are not covered by this rule
• Billing and transaction records are retained for 7 years as required by UK tax law
• SSP records and absence documentation are retained for a minimum of 3 years in accordance with HMRC requirements
• Holiday pay records are retained for a minimum of 6 years in accordance with HMRC requirements effective 2026
• Compliance Documentation Packs are retained for as long as your account is active
• You may request deletion of your data at any time by emailing admin@prodicta.co.uk

7. Your Rights Under UK GDPR

As a data subject, you have the following rights. To exercise any of these rights, contact us at admin@prodicta.co.uk.

We will respond to requests within one month. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Candidate Data: Special Note for Employers

When you use Prodicta to assess candidates, you act as the data controller for candidate personal data. You are responsible for:

• Informing candidates about how their data will be used before they complete an assessment
• Ensuring you have a lawful basis for processing candidate data
• Responding to candidate data subject requests relating to their assessment data
• Ensuring candidate data is only used for legitimate recruitment purposes

Prodicta's Data Processing Agreement (DPA), available on request, governs our processing of candidate data on your behalf.

9. Cookies

Prodicta uses essential cookies. These are used to run the service, for example to keep a user signed in and to process payments. Optional analytics cookies (Google Analytics) load only if you choose Accept All on the cookie banner. They are not loaded on the public job application page (/apply), and can load on other pages, including assessment pages, once accepted.

You can control cookies through your browser settings, but disabling essential cookies will prevent you from logging in.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encrypted storage, row-level security in our database, and access controls. Despite these measures, no system is perfectly secure. If you believe your account has been compromised, contact us immediately at admin@prodicta.co.uk.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the ICO within 72 hours of becoming aware of the breach.

11. International Transfers

Some of our sub-processors are based outside the UK or EEA. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK ICO, or an adequacy decision.

Our application servers, database and file storage are in London. To score assessments, we send the text of candidate answers (including the text of voice answers) and the assessment content to our AI service provider in the United States, and to write sections of the report we also send the candidate's name. No video or audio is sent to our AI service provider. This transfer is protected by the standard contractual clauses in our AI service provider's data processing agreement, including the UK Addendum for UK data. Voice answers are turned into text by a speech service, and this is processed in the European Union.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice in the platform at least 14 days before the changes take effect. The "last updated" date at the top of this page reflects the most recent revision.

13. Contact and Complaints

For any privacy-related questions or to exercise your rights, contact us at admin@prodicta.co.uk. We aim to respond to all requests within 30 days.

If you are unhappy with how we have handled your data, you may complain to the ICO: ico.org.uk/make-a-complaint.