Privacy policy

1. Data controller

To be completedFull identity and contact details of the data controller and, where applicable, of the data protection officer.

For any question, or to exercise your rights: hello@onbord.be.

One distinction that matters: when a client company assesses its candidates with Onbord, that company is the controller for those applications. Onbord then acts as a processor, on its behalf and on its instructions.

2. Data processed

Recruiter side: name, work email address, company, interface preferences, service usage logs and billing data.

Candidate side: name, email address, CV and uploaded files, answers written during the simulation, audio or video recordings where an exercise calls for them, transcripts of those recordings, scores and the reasoning attached to them.

No special category data within the meaning of the GDPR is requested. A candidate who spontaneously includes such data in a CV shares it of their own accord; it plays no part in the assessment.

3. Purposes and legal bases

Delivering the service — generating the assessment, running it, correcting it, returning results to the recruiter: performance of the contract with the client company, and that company's legitimate interest in assessing its applicants.

Sending messages tied to the process (invitation, reminder, candidate feedback): performance of the contract.

Improving service quality and preventing abuse: legitimate interest, on data kept to the strict minimum.

4. What is never done with your data

Candidate data is not sold, rented, or passed to third parties for advertising purposes.

It is not used to train artificial intelligence models: the providers Onbord relies on are bound by contractual commitments excluding training on content submitted through their business interface.

5. Processors

Onbord relies on a small number of technical providers, each under a data processing agreement: hosting of the application and the website (Vercel), database and authentication (Supabase), AI-assisted generation and correction (Anthropic), transactional email delivery (Resend).

To be completedProcessing locations and, for transfers outside the European Economic Area, the legal mechanism relied upon (standard contractual clauses, adequacy decision).

6. Retention

A candidate's data is kept for the duration of the hiring process concerned, then deleted or anonymised. An automatic purge runs every night on items that have reached their term.

To be completedExact retention period after a hiring process closes, and retention period for inactive recruiter accounts.

7. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right not to be subject to a decision based solely on automated processing (see the AI transparency page).

A candidate should address their request to the company running the assessment, or directly to hello@onbord.be, and we will pass it on.

You may lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

8. Cookies

The public website uses a single cookie, which remembers the language chosen in the switcher. It is strictly necessary for the site to work and serves no advertising tracking.

To be completedTo be completed if analytics or marketing tools are added to the site — their presence would make a consent banner mandatory.