This is HRM8's global notice for candidates. It explains the information we handle when you apply, are assessed, or hold a candidate profile, how artificial intelligence is used in assessments, and the consent you give. It works alongside the HRM8 Privacy Policy.
This notice is issued by HRM8 Pty Ltd (ACN 694 475 208, ABN 93 694 475 208) and the HRM8 Group (HRM8, we, us).
It covers the personal information we handle about candidates through the HRM8 Applicant Tracking System (ATS) when you apply for, are sourced for, or are considered for a role; the HRM8 Assessment Hub when you take a skills, behavioural, cognitive, leadership or other assessment, an AI interview, or are part of a reference check; and your candidate profile and account on the HRM8 platform and job board.
It is one global notice, written to meet a high common standard across every market. It works alongside, and does not replace, the broader HRM8 Privacy Policy, which has the full detail on our data practices, security and your rights. Where this notice and the Privacy Policy differ, this notice governs for the candidate matters it covers.
Most of the time, the employer or organisation that is hiring (our customer) decides that you should apply or be assessed, and decides what to do with the results. In data protection terms that organisation is usually the controller, and HRM8 acts as its processor: we run the platform and the assessments on the employer's instructions. The employer is identified to you at the point you apply or start an assessment, and is normally your first point of contact for requests about how your information is used in their hiring.
HRM8 is the controller in its own right for things we decide, such as operating your candidate account and job board profile, keeping the platform secure, and preventing misuse. Where we are the processor and you ask us to exercise a right, we will help direct your request to the relevant employer.
Some information may be sensitive (for example health, background, biometric or diversity information). We only handle sensitive information where the law allows it and, where the law requires it, with your explicit consent or on the employer's lawful instructions. We do not require you to provide sensitive information to complete an assessment, except where identity verification or supervision is needed and you have consented to it.
We use your information to: deliver the assessment or process the application, and return the results to the employer; create and operate your candidate account and profile; verify your identity and keep the assessment fair and the platform secure, including detecting and preventing cheating, fraud or misuse; communicate with you about an assessment, application or your account; meet our legal obligations; and improve and develop the Services, using de-identified or aggregated information wherever we can.
Where the law requires a legal basis (for example the GDPR in the EU and UK GDPR in the United Kingdom), we rely on: performance of a contract or steps taken at your request; our legitimate interests in operating, securing and improving the Services, balanced against your rights; compliance with a legal obligation; and your consent, which we ask for where consent is the right basis (such as recording an AI interview, identity verification and integrity monitoring that uses biometric information, handling sensitive information, or marketing). Where we rely on consent you can withdraw it at any time, as described in section 11.
We do not sell your personal information. We do not use your information to train general-purpose AI models without your consent.
Some assessments use AI to score and analyse your responses, and to help the employer compare and shortlist candidates. Certain assessments are delivered for us by specialist assessment providers acting as our sub-processors. The current list of providers is published in the HRM8 Privacy Policy and sub-processor list.
What our AI does, and does not do. Our AI evaluates the substance of your responses against the requirements of the role. We do not use AI to judge your personality, character or emotions from your face or voice in order to decide whether you are suitable. Confirming your identity and preventing cheating is a separate purpose, described next.
To keep assessments fair and to make sure results can be trusted, an employer may ask us to verify your identity and supervise your assessment. Where this applies, we tell you before the assessment begins and ask for your explicit consent. Depending on the assessment, it may involve:
This information is used only to confirm your identity and protect the integrity of the assessment. It is not used to score you, rank you, or to judge your suitability, personality or emotions, and we do not analyse your facial expressions or emotional state to evaluate you. Any flag these checks raise is reviewed by a person before it affects you, and you can ask how a flag was handled. Because this can involve biometric information and identity documents, which are sensitive, we ask for your explicit consent, collect only what is needed, keep it only as long as we need it for verification and integrity and then delete it, and apply heightened security to it. If you would prefer not to take a verified or supervised assessment, you can raise this with the employer, who decides whether an alternative is available.
A person is always involved. This is the most important point. HRM8's AI assists and scores; it does not make the hiring decision, and it never automatically rejects you. The employer makes the decision, using human judgement. You are not subject to a decision that produces legal or similarly significant effects about you based solely on automated processing.
Your choices about AI. You may ask for human review of an assessment that involved AI, ask for an explanation of how AI was used, contest a result, or object to the processing. To do any of these, contact us or the employer using the details in section 14. Requests are handled as the law requires.
Fairness and oversight. Our assessments are designed to be job-relevant and to be applied consistently. AI used in hiring is treated as a high-risk use under emerging law, including the EU AI Act, and we design for transparency, human oversight and the candidate information rights described here. Where a particular city, state or country requires specific steps before AI is used in hiring, for example a bias audit or an advance notice, those steps apply in that place and you will be told where they do.
If an assessment includes an AI interview:
An AI interview may also verify your identity and be supervised, as described in section 5. Where it is, we tell you and ask for your consent before it begins.
If you are part of a reference check, you nominate the referees and we collect the information they provide about you. Referees are told how their information will be used and agree to provide it. Reference information is used for the employer's hiring decision. You may ask to access or correct information held about you, as described in section 11.
We share your information with: the employer you applied to or are being assessed for, which is the purpose of the assessment or application; other members of the HRM8 Group to operate and support the Services; our service providers and sub-processors, such as cloud hosting and specialist assessment providers, under appropriate contracts (our cloud infrastructure is provided on Amazon Web Services, and current sub-processors are in the sub-processor list); and authorities or others where the law requires it, or to enforce our terms, or to protect rights and safety. We do not sell your personal information.
HRM8 operates across multiple regions, and your information may be transferred to and processed in countries other than your own, including by HRM8 Group entities and sub-processors. Where we transfer information across borders, we put appropriate safeguards in place as the law requires, such as standard contractual clauses or other recognised mechanisms. We host the Services on Amazon Web Services and process your information in the AWS region or regions in which the Services are hosted.
We keep your information only as long as needed for the purposes in this notice, to provide the Services, and to meet legal requirements. AI interview recordings and assessment data are kept for up to 12 months and then deleted, unless the law requires otherwise or the employer agreement provides for a different period. Where we hold information on an employer's behalf, we keep it in line with our agreement with them, make it exportable to them, and delete it after a reasonable period following the end of the relationship, except where we must keep it by law.
Identity verification and integrity-monitoring data, including any biometric information, is kept only as long as we need it to verify you and check the integrity of the assessment, and is then deleted. This is normally a short period and shorter than the assessment data above.
Depending on where you are and your relationship with us, you may have the right to: access the information we hold about you; correct it; delete it; object to or restrict certain processing; withdraw consent; receive a copy in a portable form; and not be subject to certain solely automated decisions, including the right to human review of processing that involved AI.
To exercise a right, contact us at info@hrm8.com. If your information is held by us on behalf of an employer, we will direct your request to that employer, who is usually your first point of contact. We respond as the law requires and may need to verify your identity.
Withdrawing consent. Where we rely on your consent (for example to record an AI interview, or to verify your identity using biometric information), you can withdraw it at any time. Withdrawing consent does not affect processing already carried out, and in some cases it may mean you cannot complete a particular assessment.
The Services are for job seekers of legal working age. The minimum age is 16. They are not directed to children, and we do not knowingly collect information from anyone below the minimum age that applies.
We use technical and organisational measures designed to protect your information, including encryption in transit and at rest, access controls and monitoring. You can read more on our Security and Trust page, which describes our compliance programme honestly, including which certifications are held and which are targeted or on our roadmap. No system is completely secure, and you also help by keeping your account credentials safe.
For privacy questions, to exercise a right, or to raise a concern, contact us at info@hrm8.com, or by post to HRM8 Pty Ltd, Level 1, 63-73 Ann Street, Surry Hills, NSW 2010, Australia. Please contact us first so we can try to resolve any concern. You also have the right to complain to your local privacy or data protection regulator.
The following adds to, and where relevant overrides, the rest of this notice for candidates in these regions.
Where the GDPR or UK GDPR applies, you have the rights in section 11, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, with the safeguards the law requires. Identity verification and integrity monitoring that uses biometric information is special category data, which we handle on the basis of your explicit consent or another lawful condition. AI used in recruitment is a high-risk use under the EU AI Act, and we design for transparency and human oversight. You may complain to your local supervisory authority. Where the law requires us to appoint a data protection officer or an EU or UK representative, we will appoint one and publish their contact details. You can reach us about privacy at info@hrm8.com.
We handle personal information in line with the Australian Privacy Principles and applicable New Zealand privacy law, including the additional protections that apply to sensitive information such as biometric information. You may complain to us and, if you are not satisfied, to the Office of the Australian Information Commissioner or the relevant New Zealand authority.
HRM8 operates across the United States, and we follow the privacy and AI-related laws that apply wherever you or the employer are located. Many states give residents rights to know about, access, correct, delete, and limit or opt out of certain uses of their personal information, and the right not to be treated differently for exercising them. These include the California Consumer Privacy Act as amended and comparable laws in a growing number of states, such as Virginia, Colorado, Connecticut, Texas, Utah and Oregon. We honour the rights that apply to you, and we do not sell your personal information.
A number of states and cities also regulate artificial intelligence and biometric information in hiring. Where such a law applies to your assessment, we follow the required steps, which may include: a bias audit and advance notice before an automated employment decision tool is used, for example in New York City; notice and consent before an AI or recorded video interview, for example in Illinois; notice, consent and retention limits where biometric information is collected, for example in Illinois, Texas and Washington; and notice and the ability to opt out of certain significant automated decisions, for example in Colorado and under similar laws as they take effect. We apply these requirements wherever they apply to you, and you will be told where a specific step is required of you.
Where the Digital Personal Data Protection Act 2023 applies, we handle your personal data on the basis of consent or another lawful ground, give you notice, and support your rights to access, correction, erasure and grievance redressal. You can contact us at info@hrm8.com.
Where the Singapore Personal Data Protection Act or similar regional laws apply, we collect, use and disclose your personal data for the purposes in this notice with consent or another lawful basis, and support your access and correction rights.
Additional local rights may apply where HRM8 operates. Contact us at info@hrm8.com to ask how this notice applies to you.
We may update this notice from time to time. We will post the updated version with a new date, and where changes are material we will take reasonable steps to bring them to your attention and, where the law requires, obtain a fresh consent.
By continuing to apply, create or use a candidate profile, or start an assessment, you confirm that:
If you do not agree, do not proceed, and contact the employer or HRM8 to discuss your options.
