Privacy Policy

1. Who we are

Recolect is a product of Trinnovo Group Ltd, a B Corp certified recruitment organisation incorporated in England and Wales (company registration number: 12345678). Our registered address is in London, United Kingdom. When this policy refers to "Recolect", "we", "us", or "our", it means Trinnovo Group Ltd acting as a data controller for the purposes described below.

You can contact us about data matters at privacy@trinnovo.com.

Our data protection lead is contactable at privacy@trinnovo.com.

2. What data we collect

We collect data in three contexts:

• Candidate data.Assessment responses submitted via magic link, including written answers to competency questions and any supporting evidence provided. We do not collect CVs or identity documents unless you explicitly attach them. We collect only a first name and email address for delivery of the magic link.
• Recruiter account data.Name, work email address, and organisation details provided during account creation. Usage data including assessments created, briefs submitted, and reports generated.
• Client briefs.Job descriptions and structured briefs submitted by recruiters to generate assessments. These may contain commercially sensitive role requirements.
• Behavioural assessment signals.When you type or paste text into assessment response fields, we record the timing of keystrokes and paste events. This data is used solely to support recruiter review of assessment integrity and is never used to generate your competency score. The data is stored alongside your assessment responses and follows the same retention period.

3. How we use your data

• Generating tailored assessment questions from client briefs
• Scoring candidate responses against defined competencies
• Producing narrative assessment reports for recruiter review
• Operating and improving the Recolect platform
• Communicating with recruiters about their assessments and account

Our legal basis for processing is legitimate interests (platform operation, service delivery) and, where applicable, contract performance. We do not intentionally collect special category data. If such data is inadvertently submitted within assessment responses, it is processed on the basis of substantial public interest in ensuring equal opportunities in employment.

4. AI processing

Recolect uses artificial intelligence to generate assessment questions and to produce competency scores and narrative reports. We are transparent about this:

• Every report is labelled with AI provenance, identifying which elements were AI generated
• Scoring logic is explainable; recruiters can view the evidence anchoring each score
• Human review is a mandatory step before any report is shared with a client
• We are building toward compliance with the EU AI Act (which classifies hiring AI as high-risk from August 2026), including maintaining the technical documentation and human oversight requirements that regulation requires

Candidates are informed at the start of each assessment that their responses will be processed by AI.

5. Data sharing

We do not sell personal data. We share data only in the following circumstances:

• With the recruiter and their client who created the specific assessment, as required to deliver the service
• With infrastructure providers (cloud hosting, database services) under data processing agreements that restrict use to service delivery only
• With OpenAI for the purpose of question generation and response scoring. Assessment responses are processed on OpenAI servers in the United States, protected by the UK International Data Transfer Agreement (IDTA) and EU Standard Contractual Clauses (SCCs). OpenAI operates under data processing terms that prohibit model training on your data.
• Where required by law or regulatory authority

6. Data retention

Default retention for candidate assessment data is 12 months after the assessment is completed, unless the client has configured a shorter period. Recruiter account data is retained while the account is active. When an organisation's subscription ends, account data is deleted within 6 months. Clients may request deletion of assessment data at any time via their account settings or by contacting us directly. Anonymised, aggregated performance data may be retained indefinitely for platform improvement purposes.

7. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Request erasure of your personal data (the "right to be forgotten")
• Obtain a portable copy of your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@trinnovo.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7a. Automated decision making

Recolect uses AI to generate competency scores from your assessment responses. These scores form part of a structured report provided to the recruiter managing your application.

• AI generated scores assist human decision making; they do not replace it. A recruiter always reviews every report before any hiring decision is taken.
• You have the right to request that a human reviews any AI generated score or assessment outcome.
• You may express your point of view and contest any decision influenced by AI generated outputs.

To exercise any of these rights, contact us at privacy@trinnovo.com.

8. Cookies

Recolect uses functional cookies only. These are strictly necessary for authentication, session management, and maintaining your preferences. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies that require consent. You can control cookies via your browser settings.

9. Contact

For any privacy questions or to exercise your rights, please contact our data team at privacy@trinnovo.com. For general enquiries about Recolect, contact hello@trinnovo.com.