Privacy policy

For the processing operations for which we determine the purposes and means (customer accounts, billing, security, communication), the data controller is:

VSI INNOVATION, SAS, 14 quartier Voltaire, 59300 Aulnoy-lez-Valenciennes, France (Valenciennes RCS 812 263 697).

Contact for any question relating to personal data and to exercise your rights: [email protected], or by post at the address above.

This distinction is essential because it determines our role and your rights.

a) Customer users (recruiters, HR, consultants, executives) voluntarily create an account to use the Services. For these individuals and for billing, we are the data controller.

b) Assessed individuals (candidates, employees, students, etc.) do not necessarily have an account and did not choose our service: they are invited to complete an assessment by a customer. For these individuals’ data, our customer is the data controller and we act as a processor (see section 7). The terms of this processing are governed by the Data Processing Agreement (DPA) annexed to the Terms and Conditions.

If you take a free test directly on t8.pro without being invited by a customer, we are the data controller for that assessment and the rules for customer users apply.

3.1 Customer users (we are controller)

• Identity and account: first name, last name, email address, password (stored as an encrypted hash, never in clear text), role/permissions.
• Connection data: IP address, last login date, technical logs.
• Billing data: company name, address, VAT number, order and invoice history (processed via our payment provider).
• Where applicable, Google or LinkedIn login identifiers (OAuth), when you choose this authentication method.

3.2 Assessed individuals (we are processor)

• Identity and context: first name, last name, email address, job title, company, phone number.
• Assessment data: questionnaire answers and the resulting behavioural profile, including up to 50 personality facets and a full DISC profile.
• Consent record: version of the consent text accepted, date and time, technical identifier.

These data are not "special category" data within the meaning of Article 9 GDPR. However, because of the personality profiling involved and the context (recruitment, professional assessment), they are subject to a heightened level of protection. Please do not enter health, religious, political or other sensitive information in any free-text field.

The assessment measures behavioural preferences and motivations. It is not a clinical, medical or intelligence test and does not diagnose any condition.

Participation in an assessment is voluntary. You may stop at any time and withdraw your consent afterwards; withdrawal does not affect processing that already took place. We never sell, rent or share your data for advertising purposes.

The Services produce a behavioural profile intended to support reflection (recruitment, career guidance, development, team cohesion). Some modules provide decision-support elements (for example interview question suggestions or watch points). Where an AI layer is used to phrase or structure a report, it does not alter your scores.

These reports are a decision-support tool. They do not produce any decision in a solely automated manner. The final decision (hiring, assignment, etc.) always remains a human assessment by the customer user, who is responsible for it. No decision producing legal effects or significantly affecting you is taken solely on the basis of automated processing within the meaning of Article 22 GDPR.

Customer users are contractually required to use reports only as one element of assessment among others, and not as the sole basis for a decision. You have the right to obtain a human explanation of your results, to express your point of view and to contest any decision based on them.

Because of the systematic evaluation of personality aspects and the asymmetry affecting assessed individuals, a Data Protection Impact Assessment (DPIA) is carried out in accordance with Article 35 GDPR.

At the end of the applicable period, data are deleted or anonymised. The controller customer may, under the DPA, request a different period or early return/deletion of data concerning them. Assessed individuals may request earlier deletion at any time (section 12).

Your data are accessible to our authorised staff and our technical sub-processors, strictly limited to their assignments. Assessed individuals’ reports are also accessible to the controller customer and the users it authorises, including certified consultants who debrief results. We notably use:

Outbound transfers

Transfers outside the European Union are framed by appropriate safeguards (European Commission Standard Contractual Clauses and/or Data Privacy Framework membership), supplemented by additional measures where required. A copy of the safeguards may be requested at the contact address.

Inbound transfers

If you are located outside the EU/EEA, your data are transferred to and processed in France, where they benefit from GDPR protection. Assessment data (answers and profiles) are hosted exclusively in the EU.

We do not sell or rent your data to third parties for advertising purposes, and we never share a report with another organisation without the consent of the assessed individual.

The application (app.t8.pro) only uses cookies that are strictly necessary for its operation, which do not require prior consent:

The application does not set any analytics or advertising cookies; no consent banner is therefore required for the application.

For security and traceability purposes, we keep a log of actions performed on the platform. This log records the email address of the actor who performed the action; the names and emails of data subjects are masked. This processing is based on our legitimate interest in ensuring the security and integrity of the Services and is retained for 12 months.

We implement appropriate technical and organisational measures: password hashing, encryption in transit (TLS) and at rest, data segregation by account (multi-tenant architecture), role-based access control, traffic protection (Cloudflare), rate limiting and anti-abuse quotas, and staff confidentiality obligations.

Report sharing by link

Some reports may be shared via a secure link containing an access token. This link allows anyone who has it to view the report without authentication; it should therefore only be shared with authorised recipients.

Data breaches

In the event of a personal data breach likely to result in a risk to individuals, we notify the competent supervisory authority within 72 hours and the controller customer without undue delay. Where the breach is likely to result in a high risk to you, you will be informed directly.

The Services are intended for people aged 16 and over. Below that age (or below 15 in France, or the age set by your country’s law), an assessment may only be taken with the consent of a parent or legal guardian, which the controller customer is responsible for obtaining. If you believe we hold data about a child without such consent, contact us and we will delete it.

Wherever you live, you have the right to:

• access your data and obtain a copy, including your full report;
• rectify inaccurate data;
• erase your data;
• restrict or object to processing;
• port your data in a structured, machine-readable format;
• withdraw your consent at any time, with effect for the future;
• obtain human intervention, express your point of view and contest any decision based on automated processing;
• define instructions regarding the fate of your data after your death (French law);
• not be discriminated against for exercising any of these rights.

How to exercise them

• Assessed individuals: your primary contact is the customer (company / recruiter) data controller who invited you to the assessment. You may also contact us at [email protected], and we will relay your request to the relevant controller and respond within our role as processor.
• Customer users and free-test users: send your request to [email protected].

We respond within one month (extendable to three months for complex requests) and free of charge. We may ask you to confirm your identity.

Complaints and local laws

You may lodge a complaint with the CNIL (www.cnil.fr) or with the authority of your country of residence. Depending on where you live, the following laws also apply and confirm or extend the rights above:

We may update this policy. Each version is numbered and dated at the top of this page; the version you accepted when starting an assessment is recorded with your consent. Any material change will be brought to users’ attention by an appropriate means before it takes effect. The applicable version is the one in force on the date you use the Services. Earlier versions are available on request.

This policy is available in several languages. In case of discrepancy, the French version prevails.