• GDPR is the General Data Protection Regulation Act.
• POPI is the Protection of Personal Information Act.
  
• Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information are, or are to be, processed.
• Data Processor (Operator) means any natural or legal person who processes personal information on behalf of the Data Controller (Responsible Party).
• Personal data means information which relates to a living identifiable person. It can include names, addresses, telephone numbers, email addresses etc., but it is wider than that and includes any other information relating to that person or a combination of information, which if put together, means that the person can be identified.
• Special category data means personal data about a person’s race, ethnic origin, politics, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.
• Processing covers all activities relating to the use of personal data by an organization from collection through to its storage and disposal and everything in between.
• Data subject means the person whose personal data is being processed.

• We believe user privacy and data protection is of utmost importance.
• We take protecting your privacy seriously, and we recognise that we have a duty of care to the people whose data we hold.
• We will only collect and process data when it is absolutely necessary, and when we do, we will make it clear why we are doing so and how it will be used.
• We will not send you regular email newsletters that you have not subscribed to we hate spam as much as you do! We will always give you the choice to unsubscribe.
• We will not sell or disclose your personal information to third parties for marketing or unrelated purposes. Where we engage authorised service providers to assist in delivering our services, such providers act strictly on our documented instructions and are contractually bound to safeguard personal information.

Different personal data is collected in different ways.

a) Personal data you provide to us

You will provide Integrity International with personal data when you correspond with us via the website either on your own behalf or on behalf of an organization. You will also provide us with personal data when you register as an administrator or complete the candidate information page as part of an online assessment.

b) Personal data we collect automatically

• (i) Information collected by our site - As you use the Online Assessment System, Integrity International will collect technical data including your activity on the system.

• (ii) Log files - As is true of most websites, we gather certain information automatically and store it in log files. This information includes IP addresses, browser type, Internet Service Provider (ISP), date/time stamp. We use this information to analyze trends, administer the Site, track users’ movements around the Site. Except as noted in this Privacy Policy, we do not link this automatically-collected data to Personal Data.

• (iii) Cookies - We also use cookies and URL information gathered regarding the date and time of your visit to provide you with a great online experience. We use session Cookies (which expire once you close your web browser) to provide you with a more personal and interactive experience on our Site. We do not use persistent Cookies (which stay on your computer until you delete them). Please see our Cookie Policy for more information about how we use cookies.

We use the personal data provided to us to verify your identity (for example when you return to the online application and have already logged in).

Depending on your user type we also do the following:

For Assessment System Administrators the personal information which you supply to us collected is used in the following ways:

• a) Administrator contact information is shown in assessment notification emails sent out by the Online Assessment System.

• b) It is also used in Tracking and Reporting on the administrative activities performed by these users of the system.

For Assessment Candidates the personal information collected is used in the following ways:

• a) To identify you and track your progress throughout the assessment process and to capture your responses to assessment questions.

• b) When producing assessment reports reflecting your assessment results. In certain cases, where the requesting organisation has opted to receive additional narrative assessment reports, personal information may be securely transmitted to an authorised third-party report generation service provider acting solely on our instructions. This processing is limited to what is necessary to generate the requested report and forms part of the assessment reporting process.

• c) To maintain your assessment history on our system.

• d) For historical and statistical reporting purposes.

The following legal basis for processing your personal information exist:

a) Consent - When registering as an administrator or providing assessment candidate information you explicitly agree to and accept our privacy policy thereby consenting to our processing of your personal information.

b) Contract - In order to fulfil our contract with the organization who requested the psychometric assessment and to provide valid and accurate psychometric assessments with relevant results, we are required to process and store assessment candidates personal and contact information as well as psychometric profile information. We also need to maintain a history of administrator actions on the system for auditing purposes, which requires retaining administrator personal information.

Where additional narrative reports are requested by a client organisation, personal information may be processed by authorised third-party service providers acting on our instructions. Such processing is necessary for the performance of our contract with the requesting organisation and does not constitute a new processing purpose.

Where the legal basis for us processing your personal data is that you have provided consent, you may withdraw your consent by making a request per email to [email protected].

How long will Integ keep my personal information?

Your personal data will not be kept for longer than is necessary to fulfil the specific purposes outlined in this privacy policy and to allow us to fulfil our legal obligation.

In order to maintain an assessment history, we are required to retain assessment information and identifying information including candidate id numbers for a period of up to 5 years after the last meaningful assessment interaction.

After this period assessment and identifying information is retained for historical, statistical or research purposes only, further processing is carried out solely for such purposes and will not be published in an identifiable form. Appropriate safeguards are in place to ensure that the records are not used for any other purpose.

Where personal information is processed by authorised service providers, retention is aligned with our contractual instructions and applicable retention policies.

Data Sharing

We do not sell or disclose personal information to third parties for marketing or unrelated purposes.

We may share personal information with carefully selected third-party service providers who act as Data Processors (Operators) on our behalf, strictly for the purpose of delivering services requested by client organisations.

Where a client organisation has opted to receive additional narrative assessment reports, certain candidate information may be securely transmitted to an authorised third-party report generation provider for the sole purpose of producing such reports.

The information shared may include:

• Candidate first and last name
• Date of birth
• Job title
• Gender (if specified)
• Name of the organisation requesting the assessment
• Assessment scores and results

Such third-party providers:

• Act only on our documented instructions
• Are bound by a written Data Processing Agreement
• Are required to implement technical and organisational safeguards at least equivalent to those applied by us
• May not use personal information for independent purposes
• May not reuse the information beyond the contracted service scope
• Where processing occurs outside South Africa, such transfer is conducted in accordance with applicable data protection laws and subject to contractual safeguards.

The authorised reporting service provider does not currently engage sub-processors in connection with the Services. Any future appointment of sub-processors would be subject to prior authorisation and equivalent contractual safeguards.

Personal information is not used by authorised service providers for artificial intelligence model training, independent analytics, profiling, or secondary purposes beyond the generation of requested assessment reports.

Integrity International remains responsible for the lawful processing of personal information.

Data Storage and Processing Location

Personal information processed directly by Integrity International is stored and hosted on secure servers located within the Republic of South Africa.

Where client organisations opt to receive additional narrative assessment reports, limited assessment information is securely transmitted to an authorised third-party service provider for report generation purposes. The service provider’s hosting infrastructure is located in Ireland.

Accordingly, certain personal information may be processed and stored outside the Republic of South Africa.

Such cross-border processing is subject to a binding written agreement and appropriate technical and organisational safeguards designed to ensure that personal information is afforded a level of protection substantially similar to that required under the Protection of Personal Information Act, 2013.

The authorised service provider does not use personal information for independent purposes.

The hosting location in Ireland is within a jurisdiction that maintains robust data protection standards.

You have the right to view, edit and remove the personal information we are storing about you. If at any time you would like to exercise these rights, please contact us using the information below.

We take great care to protect the confidentiality and integrity of your personal information and value the trust you have placed in us in using and storing your information. However, should our care of your personal information fall short of your expectations, please contact us using the contact information provided below. Alternatively, you have the right to contact your national Data Protection Supervisory Authority.

• The Information Regulator (South Africa)
  33 Hoofd Street
  Forum III, 3rd Floor Braampark
  P.O Box 31533
  Braamfontein, Johannesburg, 2017
  +27 (0) 10 023 5200

Complaints email: [email protected]

General enquiries email: [email protected].

• A full list of EU Supervisory Authorities and their contact details is available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en?utm_

How to contact us

If you have any questions about this notice or in relation to how we use your personal data in association with this site, please contact our Data Protection Officer at [email protected].

We take the security of your personal information seriously and implement appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised access, or unlawful processing of personal information.

In accordance with Section 22 of the Protection of Personal Information Act (POPIA), where we have reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person, we will notify:

The Information Regulator; and

The affected data subject(s), unless the identity of such data subject(s) cannot be established.

Such notification will be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and to restore the integrity of our systems.

The notification will be provided in writing and will contain sufficient information to allow you to take protective measures, including:

A description of the possible consequences of the security compromise;

A description of the measures that we intend to take or have taken to address the compromise;

The identity of the unauthorised person (if known); and

Recommendations on the steps you can take to mitigate the potential adverse effects.

This policy may change from time to time. 

We will update this privacy policy when necessary to reflect changes in legal requirements or operational changes. The latest effective date will be displayed at the top of the policy information and a notice will appear on our website when a new version of this document is released.

We encourage you to periodically review this privacy policy to learn how we are processing your information.

Where changes materially affect how personal information is processed, we will take reasonable steps to notify affected users.

Have any questions? Contact Us!