Last updated: 20 September 2026
Key Predict pays particular attention to the protection of personal data. This policy explains, in plain terms, what data we process, why we process it, who can access it, how long it is kept, and how data subjects can exercise their rights.
It applies to the website keypredict.com, our forms, content, events, marketing communications and services, as well as to the Key Predict platform where Key Predict acts as data controller. Where we process the data of candidates, employees, beneficiaries or assessors on behalf of a client, that client is, in principle, the data controller and Key Predict acts as data processor, in accordance with its instructions and the contract entered into with it.
Our GDPR Commitments
What Data Does Key Predict Process?
Depending on your relationship with us, we may process professional contact details, browsing data, account and security data, and data relating to assessments: questionnaire responses, scores, reports, competencies, motivations, aptitudes, matching data and, where the service used provides for it, CVs, photographs, video or audio responses, and their transcripts.
Who “Owns” the Data?
The GDPR is not based on a notion of data ownership. Each individual retains the rights that the regulation grants them over their personal data. The client organising a recruitment, mobility, career guidance or assessment campaign determines the purposes of that processing and generally acts as data controller. Key Predict then processes the data on its behalf and in accordance with its instructions.
How Is the Data Used?
Data is used solely to provide the requested services, administer accounts, carry out and deliver assessments, ensure security and support, manage the business relationship, improve our services within the limits described below, and comply with our legal obligations. Key Predict does not sell personal data.
Where Is the Data Hosted?
The public website is hosted by Google Cloud Platform in Saint-Ghislain, Belgium.
The hosting and processing terms applicable to the platform and its service providers are set out in the contractual documentation and the sub-processor list, available via the client platform.
Can I Get a Copy of My Data?
Yes. You can request access to your data and, where the legal conditions are met, obtain a copy in a structured, commonly used, machine-readable format. For assessments organised by a client company, the request should be addressed to that company in the first instance, as it is the data controller. Key Predict will assist it in handling the request.
Can I Have My Data Corrected or Deleted?
You can request the rectification of inaccurate data and, in the cases provided for by law, its erasure or the restriction of its processing. Deletion may be deferred where retention remains necessary to comply with a legal obligation, to establish or defend legal claims, or to carry out the controller’s lawful instructions.
Article 1 — Who Is Responsible for Your Data?
The data controller is KEY PREDICT SAS. Its full legal identity, registered office, contact details and the information relating to the website publisher are available in the Legal Notice.
Data protection contact: legal@keypredict.com.
For any question or request concerning your personal data, you can use this address.
Depending on the processing concerned, KEY PREDICT SAS may act as data controller or as data processor.
Article 2 — How Are Responsibilities Divided Between the Client and Key Predict?
Key Predict acts as data controller when it determines the purposes and essential means of the processing itself, in particular for website management, demonstration and contact requests, the client relationship, billing, account administration, the security of its systems, its communications and the organisation of its own events.
The client generally acts as data controller for the data of candidates, employees, beneficiaries and assessors it invites onto the platform as part of a recruitment, mobility, career guidance, assessment or development process. It is responsible, in particular, for defining the purpose, the legal basis, the recipients, the criteria used and the retention period, and for informing the individuals concerned.
In this context, Key Predict acts as data processor: we process data in accordance with the client’s documented instructions, apply the agreed security measures, oversee our own sub-processors and assist the client in complying with its GDPR obligations.
For certain technical operations necessary for security, fraud prevention, logging or compliance with legal obligations, Key Predict may act as a separate data controller. This classification is specified in the applicable contractual documents.
Article 3 — What Categories of Data Do We Process?
Website visitors: IP address, technical identifiers, device and browser type, pages visited, date and time of visit, traffic source, cookie preferences and audience measurement data.
Prospects, contacts and event participants: identity, professional contact details, job title, company, country, content of enquiries, professional interests, registrations, participation in webinars, demonstrations or training sessions, and interactions with our communications.
Clients, partners and professional users: identity and professional contact details, role, organisation, contractual and billing data, correspondence history, support requests, account credentials, permissions, and login and activity logs.
Assessment participants: identity, contact details, associated organisation or campaign, questionnaire responses, results, scores, reports, traits and dimensions assessed, competencies, motivations, aptitudes, matching data, and assessor comments or feedback. Depending on the service chosen by the client, a CV, professional profile, photograph, video or audio responses and their transcript may also be processed.
Data from integrations: where the client activates an integration with an ATS, an HRIS or another tool, the categories of data exchanged are those provided for by the integration’s configuration and documentation.
Psychometric data is personal data that calls for enhanced protection because of its nature and use. It does not automatically constitute a special category of data within the meaning of Article 9 of the GDPR.
However, free-text answers or certain contexts may indirectly reveal sensitive information. We ask users not to provide data relating to health, ethnic origin, political opinions, religious beliefs, trade union membership, sex life, sexual orientation, or genetic or biometric data, unless the processing is expressly provided for, has a valid legal basis and is properly governed.
Article 4 — Where Does the Data Come From?
Data may be provided directly by the data subject, transmitted by the client who invites them onto the platform, imported from an ATS or HRIS at the client’s request, generated through use of the website or platform, or produced from the responses given as part of an assessment.
Where a client provides us with data that was not collected directly from the data subject, it is that client’s responsibility to ensure it has a valid legal basis and complies with the information obligations set out in the GDPR. Key Predict provides the information and resources needed to assist it in doing so.
Article 5 — Why Do We Process Data, and on What Legal Bases?
Providing the Website and Technical Security
We process the technical data strictly necessary for the operation of the website, security, abuse prevention and incident diagnosis on the basis of our legitimate interest in providing a safe and accessible service. Non-essential trackers are only placed once consent has been obtained, where consent is required.
Contact, Demonstration and Trial Requests
We process the information provided to respond to enquiries and prepare for a possible contractual relationship. The legal basis is the performance of pre-contractual steps requested by the individual or, depending on the B2B context, our legitimate interest in responding to a professional enquiry.
Managing Clients and Users
We process the data necessary to create and administer accounts, provide the platform, deliver support, manage contracts and handle billing. This processing is based on the performance of the contract, our legitimate interest in managing the relationship with the client’s professional contacts and, for certain records, compliance with legal obligations.
Assessments, Campaigns and Matching
Where these operations are organised by a client, Key Predict processes the data as processor, on the basis of the client’s instructions. The client determines the legal basis applicable to its purpose: recruitment, mobility, competency development, career guidance, team audit or other authorised use.
Newsletters and Marketing Communications
We send newsletters on the basis of consent. In situations where B2B prospecting may lawfully rely on legitimate interest, the message must relate to the recipient’s professional activity, and the recipient may object simply and free of charge at any time. Every marketing communication includes a means of unsubscribing.
Webinars, Events and Training
We process the data necessary for registration, organisation, follow-up and, where applicable, billing, on the basis of pre-contractual steps, performance of the contract or our legitimate interest. Any subsequent marketing communications follow the rules described above.
Product Improvement and Statistics
We may produce usage statistics and improve our services on the basis of our legitimate interest, subject to a balancing test against individuals’ rights, data minimisation measures and, where possible, aggregation or anonymisation. Participant data processed on behalf of a client is not reused for an incompatible purpose or to train an AI system without a valid legal basis, appropriate information and a suitable contractual framework.
Social Media, Advertising and Communications
When you interact with Key Predict’s social media pages, we may process your public profile, associated identifiers, your contact details and the content of your interactions in order to communicate with you and follow up on exchanges relating to our services. This processing is based on our legitimate interest in maintaining our professional presence and responding to enquiries.
Subject to your consent to advertising trackers, Meta/Facebook, Google, LinkedIn and X/Twitter may process cookie identifiers, contact details or browsing data to serve and measure campaigns. No tracker subject to consent is placed before you make your choice, which you can change using the “Manage my cookies” link.
Chats, emails, phone calls and private messages may be retained in order to handle requests, provide support and follow up on the relationship, within the retention periods set out in Article 9.
Disputes and Legal Obligations
We may retain or disclose certain data where necessary to comply with a legal obligation, respond to a competent authority, or establish, exercise or defend legal claims.
Article 6 — Psychometrics, Profiling, Matching and Artificial Intelligence
Key Predict’s assessments may result in profiling within the meaning of the GDPR, since they use personal data to analyse or predict certain aspects relating to professional life, such as aptitudes, preferences, motivations, competencies or suitability for a professional context.
The general logic is as follows: assessment responses are converted into results using documented scoring methods; these results may then be compared against a competency framework or a model defined and weighted by the client; the platform returns indicators, gaps and points of attention intended to inform human analysis.
Talent Brain analyses the transcribed content of interview responses to identify competencies linked to explanatory passages. It does not analyse image, voice, emotions or biometric characteristics, and does not take part in calculating the matching score.
Key Predict does not make recruitment, mobility or development decisions in the client’s place. The score or recommendation must not be the sole basis for a decision producing legal effects or significantly affecting a person. The client remains responsible for ensuring genuine human oversight, examining the tool’s limitations, allowing results to be contested where required, and using criteria relevant to the purpose pursued.
Article 7 — Who Receives the Data?
Within the limits of their permissions and their need to know, data may be accessible to Key Predict’s authorised teams, the client’s authorised users, technical service providers involved in hosting, maintenance, support, email delivery, CRM management, webinars, audience measurement or security, integration partners selected by the client, and authorities or advisers where required by law.
Our service providers act on our instructions, are subject to contractual confidentiality and data protection commitments, and may only use the data for their own purposes where the law and their applicable terms clearly allow it.
An up-to-date list of sub-processors is available via the client platform.
Article 8 — Is Data Transferred Outside the European Economic Area?
Certain group entities or service providers may be located outside the European Economic Area, or may access data from a third country. In such cases, Key Predict relies on a mechanism recognised by the GDPR: an adequacy decision of the European Commission, standard contractual clauses, binding corporate rules where they exist, or another appropriate safeguard.
Where standard contractual clauses are used, we assess the context of the transfer and, where necessary, put additional measures in place. A copy of the relevant safeguards may be requested, subject to the confidential information they contain.
Article 9 — How Long Do We Keep the Data?
Key Predict retains personal data only for as long as necessary for the purposes described in this policy. The applicable period varies according to the individual’s status, the nature of their relationship with Key Predict, and the processing concerned.
Where the data of a participant, candidate, employee or guest is processed on behalf of a client, that client, as data controller, sets the applicable retention period. Key Predict follows its instructions and the agreed contractual terms.
For clients, users, prospects and website visitors, data is retained for the duration of the contractual or business relationship, or for as long as necessary to handle the request, and thereafter, where applicable, for the statutory retention or limitation periods. Data used for prospecting purposes is retained for a maximum of three years from the last active contact, unless an objection is raised earlier. Cookies and other trackers follow the periods set out in the dedicated section below.
At the end of these periods, data is deleted, anonymised or archived where the law, a contractual obligation or the defence of Key Predict’s rights so justifies. To find out the period applicable to a specific piece of data, status or service, you can write to legal@keypredict.com.
Article 10 — How Do We Protect the Data?
Key Predict implements technical and organisational measures proportionate to the risks, including access management, authentication, logging, environment segregation, protection of data exchanges, backups, vulnerability management, business continuity procedures, staff awareness training and the contractual oversight of service providers.
Key Predict is certified ISO/IEC 27001:2022 for the scope defined in its certificate. This certification attests to the existence of an audited information security management system; it does not constitute GDPR certification or a guarantee against incidents.
Article 11 — Cookies and Other Trackers
On your first visit, a consent management tool allows you to accept or reject non-essential trackers with a comparable level of simplicity. No advertising or audience-measurement tracker subject to consent is placed before you make your choice. You can change or withdraw your consent at any time using the “Manage my cookies” link available on the website.
Trackers strictly necessary for the website’s operation, security or for remembering your choice may be exempt from consent. A separate cookie policy sets out the list of trackers, their provider, purpose, duration, legal basis and, where applicable, any associated transfers.
Article 12 — What Are Your Rights?
Depending on the situation and the legal basis of the processing, you may exercise a right of access, rectification, erasure, restriction, objection and portability. You can withdraw your consent at any time for the future. You may also request information about profiling or an automated decision and, where Article 22 of the GDPR applies, obtain human intervention, express your point of view and contest the decision.
For processing for which Key Predict is the controller, you can write to legal@keypredict.com or to
KEY PREDICT SAS, Data Protection, 21 square Saint-Charles, 75012 Paris, France.
For an assessment organised by an employer, a recruiter, a training organisation or another client, please address your request to that organisation in the first instance. Key Predict will assist it and, if you contact us directly, will forward the request to the data controller where necessary.
We may request additional information to verify your identity, but only where there is reasonable doubt. We generally respond within one month, which may be extended by two months where the request is complex or numerous requests have been received; in that case, you will be informed.
You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.
Article 13 — What Happens in the Event of a Data Breach?
Key Predict has a process in place for detecting, analysing and managing incidents. Where a breach concerns data processed on behalf of a client, Key Predict informs that client as soon as possible, in accordance with the contract and Article 33 of the GDPR, and provides the information available to help it assess the risk and, where necessary, notify the supervisory authority or the individuals concerned.
Where Key Predict acts as data controller, it carries out the notifications required by law itself.
Article 14 — Updates to This Policy
This policy may evolve to reflect changes to our services, our practices or the applicable regulations. The update date is shown at the top of the page. In the event of a substantial change, we will use an appropriate means to inform the individuals concerned.