Privacy Policy

This Privacy Policy explains how COGNEXA SOFTWARE LIMITED, Registration No. HE 495932, a company registered in the Republic of Cyprus, handles personal data through its website and workforce management platform.

The platform may include personnel administration tools, work-related psychometric assessments, questionnaires, analytical reports and AI-assisted insights.

1. Where Cognexa Sits in the Data Chain

Cognexa sits in two different privacy roles, depending on why the information is handled.

Cognexa normally acts as a controller when it processes information for its own purposes, including:

  • operating the public website;
  • responding to business inquiries;
  • creating and administering customer accounts;
  • managing contracts and billing;
  • protecting the platform;
  • maintaining legal and business records.

When an employer, recruiter or other customer places candidate or employee information in the platform, that customer normally determines why and how the information is used. In that situation, the customer acts as the controller and Cognexa acts as its processor.

An employer using Cognexa should give participants its own notice explaining the assessment, the purpose, the decision process and the route for questions or challenge.

2. What Enters the Platform

The information processed depends on how the website or platform is used.

Website and inquiry information

This may include:

  • name;
  • company and job title;
  • business contact details;
  • inquiry content;
  • IP address;
  • browser and device information;
  • pages viewed;
  • security and diagnostic records.

Customer account information

This may include:

  • account-holder and administrator details;
  • organisation name;
  • user role and permissions;
  • login and authentication records;
  • subscription, contract and billing information;
  • support communications.

Candidate and employee information

A customer may provide or ask an individual to provide:

  • name and professional details;
  • employment or application information;
  • role-related information;
  • questionnaire and assessment responses;
  • assessment completion records;
  • work-related behavioural or psychometric indicators;
  • scores, summaries and reports;
  • manager, recruiter or reviewer feedback.

The platform is not designed to provide a medical diagnosis or to determine a person’s mental health status.

Customers must not use Cognexa to collect clinical, medical or other specially protected information unless the proposed processing has been reviewed and appropriate legal and technical safeguards have been agreed.

3. What Cognexa Does With Information

Cognexa may process personal data to:

  • provide access to the website and platform;
  • create and manage accounts;
  • conduct assessments requested by a customer;
  • produce structured reports and work-related insights;
  • maintain and improve platform functionality;
  • provide customer support;
  • detect misuse and security threats;
  • administer contracts and payments;
  • comply with applicable law;
  • establish, exercise or defend legal claims.

Where Cognexa acts as controller, processing may rely on:

  • performance of a contract;
  • steps requested before a contract is entered into;
  • compliance with a legal obligation;
  • Cognexa’s legitimate interests in operating and protecting its business;
  • consent, where consent is required.

Where Cognexa acts as processor, the customer is responsible for identifying the appropriate legal basis and issuing lawful instructions.

4. Assessments, Profiles and AI

The platform may analyse submitted responses and other role-related information to generate structured indicators, summaries or recommendations. The platform compares submitted responses and role-related inputs against configured assessment models; it does not read thoughts or know facts that were not provided to it. Assessment results are intended to support a workplace process, not to replace accountable human judgment. A score, profile or recommendation:

  • may contain errors or limitations;
  • may be affected by the quality and context of the information supplied;
  • does not represent a complete account of an individual;
  • does not guarantee future performance;
  • must not be treated as a medical or clinical opinion.

Cognexa does not itself make the employer’s final hiring, dismissal, promotion, compensation or disciplinary decision.

Customers are responsible for:

  • determining whether an assessment is appropriate for the intended role;
  • explaining the use of the assessment to affected individuals;
  • evaluating results alongside other relevant information;
  • providing meaningful human review;
  • allowing inaccurate information to be corrected;
  • providing a route through which a materially affected person can raise concerns.

Individuals should normally direct questions about an employment-related outcome to the employer or organisation that requested the assessment.

We do not sell assessment profiles or use them to build advertising audiences.

5. Who May Receive Information

Personal data may be available to:

  • the customer that requested or administers the assessment;
  • authorised customer administrators, recruiters or managers;
  • Cognexa personnel who require access for their work;
  • hosting, infrastructure, communications and support providers;
  • professional advisers, auditors or insurers;
  • public authorities where disclosure is legally required.

Vendors are selected for a defined function and are restricted by contractual, technical or organisational controls appropriate to that function.

Cognexa does not disclose candidate or employee information to unrelated organisations for their independent marketing.

6. Processing Outside the European Economic Area

Some service providers or authorised personnel may be located outside the European Economic Area. Where personal data is transferred internationally, Cognexa uses an available legal transfer mechanism and appropriate safeguards, which may include:

  • an adequacy decision;
  • standard contractual clauses;
  • contractual privacy and security commitments;
  • access restrictions and data minimisation;
  • other transfer arrangements permitted by applicable law.

7. How Long Information Is Kept

Retention depends on Cognexa’s role and the reason for processing. Customer-controlled assessment and personnel information is normally retained for the period selected by the customer, required by the service agreement or reasonably needed to provide the service. Account, contractual, billing, security and legal records may be retained for longer where required for:

  • financial and tax obligations;
  • dispute management;
  • fraud or security investigation;
  • legal claims;
  • regulatory requirements.

When information is no longer required, it is deleted, anonymised or removed from ordinary operational use.

8. How Information Is Protected

Cognexa uses safeguards proportionate to the type of information and the way the platform is used. These may include:

  • controlled user permissions;
  • authentication measures;
  • restricted staff access;
  • protected development and production environments;
  • secure transmission methods;
  • activity and security records;
  • backup and recovery arrangements;
  • access removal when no longer required;
  • incident investigation procedures.

No online service can eliminate every security risk. Customers are also responsible for their own accounts, users, devices and access decisions.

9. Your Data Rights

Depending on the circumstances, an individual may have the right to:

  • obtain information about the processing;
  • request access to personal data;
  • correct inaccurate information;
  • request deletion;
  • restrict certain processing;
  • object to processing based on legitimate interests;
  • receive portable data where the legal conditions apply;
  • withdraw consent;
  • request human involvement in an applicable automated process;
  • express a point of view and contest a qualifying automated decision;
  • complain to a data protection authority.

Where the information is controlled by a Cognexa customer, Cognexa may refer the request to that customer or assist the customer in responding.

A request concerning data controlled directly by Cognexa may be submitted through the contact form published on the website. The message should be marked Privacy Request and include enough information to identify the relevant account or interaction.

Cognexa may request reasonable proof of identity before releasing or changing personal data.

10. Cookies and Website Technologies

The website may use essential storage, preference tools and optional measurement technologies.

Optional technologies are activated only in accordance with the choices presented through the website’s cookie controls.

Further details are provided in the Cookie Policy.

11. Children

The platform is intended for workplace and professional use.

Customers must not use Cognexa to assess children unless the use is lawful, expressly agreed and supported by appropriate safeguards.

12. Changes and Complaints

This Policy may be revised when the platform, processing activities or legal requirements change. A revised text becomes effective when it is posted on the website, unless a later date is stated.

Privacy questions may be submitted through the website contact form.

Individuals also have the right to complain to the Commissioner for Personal Data Protection of the Republic of Cyprus or another competent supervisory authority.