Privacy Policy

1. Who we are

Recolect is a product of Trinnovo Group Ltd, a B Corp certified recruitment organisation incorporated in England and Wales (company registration number: 11722770). Our registered address is in London, United Kingdom. When this policy refers to "Recolect", "we", "us", or "our", it means Trinnovo Group Ltd acting as a data controller for the purposes described below.

You can contact us about data matters at privacy@trinnovo.com.

Our data protection lead is contactable at privacy@trinnovo.com.

2. What data we collect

We collect data in three contexts:

• Candidate data.Assessment responses submitted via magic link, including written answers to competency questions and any supporting evidence provided. We do not collect CVs or identity documents unless you explicitly attach them. We collect only a first name and email address for delivery of the magic link.
• Recruiter account data.Name, work email address, and organisation details provided during account creation. Usage data including assessments created, briefs submitted, and reports generated.
• Client briefs.Job descriptions and structured briefs submitted by recruiters to generate assessments. These may contain commercially sensitive role requirements.
• Behavioural assessment signals.When you type or paste text into assessment response fields, we record the timing of keystrokes and paste events. This data is used solely to support recruiter review of assessment integrity and is never used to generate your competency score. The data is stored alongside your assessment responses and follows the same retention period.

3. How we use your data

• Generating tailored assessment questions from client briefs
• Scoring candidate responses against defined competencies
• Producing narrative assessment reports for recruiter review
• Operating and improving the Recolect platform
• Communicating with recruiters about their assessments and account

Our legal basis for processing is legitimate interests (platform operation, service delivery) and, where applicable, contract performance. We do not intentionally collect special category data. If such data is inadvertently submitted within assessment responses, it is processed on the basis of substantial public interest in ensuring equal opportunities in employment.

4. AI processing

Recolect uses artificial intelligence to generate assessment questions and to produce competency scores and narrative reports. We are transparent about this:

• Every report is labelled with AI provenance, identifying which elements were AI generated
• Scoring logic is explainable; recruiters can view the evidence anchoring each score
• Human review is a mandatory step before any report is shared with a client
• We are building toward compliance with the EU AI Act (which classifies hiring AI as high-risk from August 2026), including maintaining the technical documentation and human oversight requirements that regulation requires

Candidates are informed at the start of each assessment that their responses will be processed by AI.

5. Data sharing

We do not sell personal data. We share data only in the following circumstances:

• With the recruiter and their client who created the specific assessment, as required to deliver the service
• With infrastructure providers (cloud hosting, database services) under data processing agreements that restrict use to service delivery only
• With OpenAI for the purpose of question generation and response scoring. Assessment responses are processed on OpenAI servers in the United States, protected by the UK International Data Transfer Agreement (IDTA) and EU Standard Contractual Clauses (SCCs). OpenAI operates under data processing terms that prohibit model training on your data.
• Where required by law or regulatory authority

6. Data retention

Default retention for candidate assessment data is 12 months after the assessment is completed, unless the client has configured a shorter period. Recruiter account data is retained while the account is active. When an organisation's subscription ends, account data is deleted within 6 months. Clients may request deletion of assessment data at any time via their account settings or by contacting us directly. Anonymised, aggregated performance data may be retained indefinitely for platform improvement purposes.

6a. Video and biometric data

When an assessment is configured for video responses, your recordings include images of your face and your voice. This is biometric data under UK GDPR Article 9.

Lawful basis. We process this data on the basis of substantial public interest in ensuring fair recruitment, under Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018.

What we record. A short audio check before you begin, then a video clip for each question you answer. Recordings are stored encrypted in Supabase Storage.

How it is analysed. Audio is transcribed by OpenAI Whisper and your answer is scored on what you said. A separate observation panel uses OpenAI GPT-4o to surface observable behaviours such as audio clarity, pacing, and structure. These observations are not assessed and do not affect your score. We do not analyse emotion, personality, confidence, eye contact, posture, or any protected characteristic.

How long it is kept. Your recordings are kept for the period set by the recruiter (default 12 months) and then deleted automatically.

Your rights. You can request earlier deletion by emailing privacy@trinnovo.com. You can request an alternative format if recording is a barrier by emailing accessibility@trinnovo.com.

Consent. Recording cannot begin until you have actively consented on the assessment page. Closing the page without submitting wipes all data.

7. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Request erasure of your personal data (the "right to be forgotten")
• Obtain a portable copy of your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@trinnovo.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7a. Automated decision making

Recolect uses AI to generate competency scores from your assessment responses. These scores form part of a structured report provided to the recruiter managing your application.

• AI generated scores assist human decision making; they do not replace it. A recruiter always reviews every report before any hiring decision is taken.
• You have the right to request that a human reviews any AI generated score or assessment outcome.
• You may express your point of view and contest any decision influenced by AI generated outputs.

To exercise any of these rights, contact us at privacy@trinnovo.com.

8. Cookies

Recolect uses functional cookies only. These are strictly necessary for authentication, session management, and maintaining your preferences. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies that require consent. You can control cookies via your browser settings.

9. Contact

For any privacy questions or to exercise your rights, please contact our data team at privacy@trinnovo.com. For general enquiries about Recolect, contact hello@trinnovo.com.