Candidate Consent Notice — DRAFT
Shown to a candidate before an assessment starts. Must be actively accepted (checkbox, not pre-ticked) — not buried inside a longer signup or ToS flow. Per DPDP Act requirements, consent must be specific, informed, and unambiguous per data type, not one blanket "I agree."
Before you begin
[Company Legal Name] ("we", "us", the "Platform") has been asked by [Hiring Company Name] to run a technical assessment as part of your job application. Before you start, here's exactly what happens to your data.
What we collect
| Data | Why we collect it |
|---|---|
| Name and email address | Provided by the hiring company to invite you; used to identify your results to them |
| Code, answers, and responses you submit during the test | This is the assessment itself — it's what gets scored |
| Your score and a breakdown of correct/incorrect answers | Shared with the hiring company to inform their decision |
| IP address, browser/device information, and timestamps | Security and integrity — detecting shared/proxied sessions, confirming when the test was taken |
| [If enabled] Tab-switch or copy-paste events during the test | Anti-cheat — flagged for the hiring company's review, not used to auto-disqualify you |
We do not collect anything beyond what's listed above unless a specific test explicitly asks for it (and if it does, that request will say so separately).
Who sees this data
- [Hiring Company Name] — receives your score, your submitted code, and the security signals above, to evaluate your application.
- [Company Legal Name] — processes your data to run the platform (hosting, execution, scoring). We do not sell your data or share it with anyone other than the hiring company that invited you.
- Infrastructure providers who host and run the platform on our behalf, bound by written data-processing agreements — see our Privacy Policy for the current list.
How long we keep it
By default, your assessment data (code, answers, scores, security logs) is kept for [180] days after the assessment, then permanently deleted, unless:
- The hiring company requests earlier deletion, or
- You exercise your right to erasure (see below), or
- We're required by law to keep it longer.
See data-retention-policy.md for the full schedule.
Your rights
Under India's Digital Personal Data Protection Act (and GDPR, if you're in the EU), you can:
- Ask what we hold about you and get a copy of it.
- Ask us to correct inaccurate data.
- Ask us to delete your data — note that if you do this before completing an assessment, we won't be able to score it, and the hiring company will be informed only that the assessment wasn't completed, not why.
- Withdraw this consent at any point going forward (this doesn't undo processing that already happened).
- Raise a complaint with our Grievance Officer at [grievance-officer@yourcompany.com], or with India's Data Protection Board if unresolved.
Consent
Please confirm each of the following individually:
- I understand my code, answers, and score will be shared with [Hiring Company Name] for hiring evaluation.
- I consent to the collection of IP address, device, and timing data for test-security purposes.
- (If anti-cheat monitoring is enabled) I understand tab-switch/copy-paste activity during the test will be logged and shared with the hiring company.
- I have read and understand the Privacy Policy and this notice.
By clicking "Start Assessment," you confirm all boxes above have been checked and you consent to the processing described here.
Implementation note: each checkbox must be independently required (not one master checkbox) and the consent event (timestamp, IP, which boxes were checked, notice version shown) should be logged server-side as proof of consent — this is what you'd need to produce if a candidate or the Data Protection Board ever asks how consent was obtained.