Privacy Policy

Version 2026-08-17

NON-BINDING SUMMARY. The following summary is provided for convenience only, does not form part of the operative provisions of this Privacy Policy, and shall not be relied upon in the construction of any Clause below. Persons undertaking Assessments are identified throughout the Services by a pseudonymous Code and not by name or email address. A Learner's email address is held in a single Account record which constitutes the sole link between that Learner and the Learner's Code. Assessment sittings are subject to automated integrity monitoring, the parameters of which are set out at Clause 6. Assessment responses are scored by automated means as described at Clause 5. mindsparx does not sell Personal Data and does not disclose Learner email addresses to Clients, employment agencies or recruiters. Records which survive termination of an Account are treated as pseudonymised Personal Data and are not represented as anonymous.

1. Definitions and Interpretation

1.1. In this Privacy Policy, the following expressions shall bear the following meanings:

"Account" means the registered user account of a Learner or a Client upon the Services.

"Aggregate Data" means statistical data derived from Assessment outcomes which relates to no identified or identifiable natural person, which is computed only across a minimum group size, and from which no individual record may be inferred or reconstructed.

"Assessment" means a skill test, practice session or related exercise made available through the Services.

"Candidate" means a natural person who undertakes an Assessment commissioned by a Client and who is identified to mindsparx solely by a Code assigned by that Client.

"Client" means a legal person which procures the Services for the purpose of assessing its own Candidates.

"Code" means the pseudonymous alphanumeric identifier against which a Data Subject's Assessment records are held, whether assigned by mindsparx (in the form IND-XXXXX) or by a Client.

"Controller", "Processor", "Personal Data", "Processing", "Data Subject" and "Personal Data Breach" shall bear the meanings respectively given to them in Article 4 GDPR.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

"Integrity Signals" means the session telemetry specified at Clause 6.2.

"Learner" means a natural person who registers an Account with mindsparx in an individual capacity.

"mindsparx", "we", "us" and "our" mean the entity identified at Clause 2.1.

"Services" means the mindsparx skill-testing platform operated at mindsparx.ai and all functionality made available through it.

"Sub-Processor" means a processor engaged by mindsparx which Processes Personal Data in connection with the Services.

1.2. Clause headings are inserted for convenience only and shall not affect the construction of this Privacy Policy. References to a Clause are references to a Clause hereof. The expressions "including", "includes" and "in particular" shall be construed without limitation. References to any enactment include that enactment as amended, extended or re-enacted from time to time.

1.3. Where any provision hereof conflicts with a mandatory provision of applicable data protection law, the latter shall prevail and the remaining provisions shall continue in full force and effect.

2. Identity and Contact Details of the Controller

2.1. The Controller in respect of the Processing described herein, save as provided at Clause 3, is S.C. Transdesk Communications S.R.L., a limited liability company incorporated under the laws of Romania, having its registered office at Str. Valea Alba 8, Bl. 8, Sc. A, Ap. 4, 600004 Bacau, Romania, registered with the Trade Register under number J04/1695/2007, VAT identification number RO 37074538, trading as "mindsparx".

2.2. All communications concerning this Privacy Policy, including the exercise of the rights conferred by Clause 15, shall be addressed to alex@mindsparx.ai.

2.3. mindsparx has assessed its obligations pursuant to Article 37 GDPR and has determined that it is not required to designate a data protection officer. Enquiries which would otherwise be directed to a data protection officer shall be directed to the address specified at Clause 2.2.

2.4. The lead supervisory authority of mindsparx is the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal), of www.dataprotection.ro.

3. Scope; Allocation of Controller and Processor Roles

3.1. Learners. In respect of Personal Data relating to Learners, mindsparx acts as Controller and this Privacy Policy applies in full.

3.2. Candidates of Clients. In respect of Personal Data relating to Candidates Processed in the course of Assessments commissioned by a Client:

(a) the Client is the Controller and is responsible for informing its Candidates of the Processing and for establishing a lawful basis in respect thereof;

(b) mindsparx acts as Processor and Processes such Personal Data solely upon the documented instructions of the Client pursuant to the data processing agreement referred to at Clause 18; and

(c) mindsparx does not receive, and the Services are designed such that mindsparx cannot receive, the name, email address or other direct identifier of any Candidate, the mapping between Code and identity being retained by the Client outside the Services.

3.3. Reserved Controller functions. Notwithstanding Clause 3.2, mindsparx acts as Controller in its own right, and not as Processor, in respect of: the security of the Services and the prevention and detection of abuse; the integrity monitoring described at Clause 6; the derivation and retention of Aggregate Data; and compliance with legal obligations to which mindsparx is itself subject.

3.4. A Candidate wishing to exercise rights in respect of Processing falling within Clause 3.2 shall address such request to the relevant Client. Where such a request is received by mindsparx directly, mindsparx shall transmit it to the Client without undue delay and shall not respond to its substance save as required by law.

3.5. Where a Learner additionally undertakes an Assessment commissioned by a Client, the records arising from that Assessment shall be maintained separately, and the Client shall have visibility only of the Code assigned by it.

4. Categories of Personal Data, Purposes of Processing and Legal Bases

4.1. mindsparx Processes the categories of Personal Data specified in the table below, for the purposes there specified, upon the legal bases there specified.

4.2. mindsparx does not Process special categories of Personal Data within the meaning of Article 9 GDPR, does not require the submission of identity documentation, and does not undertake profiling for advertising purposes.

4.3. mindsparx does not sell Personal Data. mindsparx shall not disclose the email address of any Learner to any Client, employment agency or recruiter. Where a Learner has given the consent referred to at Clause 4.1, any resulting communication shall be made by mindsparx alone, and the Learner shall determine whether to respond thereto.

5. Automated Decision-Making

5.1. Automated scoring. Assessment responses are evaluated by automated means against an answer key determined by a human reviewer prior to publication of the Assessment. Such evaluation is deterministic and comprises, according to the type of Assessment, exact or set-overlap comparison of categorical responses, word-error-rate computation in respect of transcription, and rule-based comparison of overall judgement and identified problems. Component scores are thereafter combined by reference to weightings fixed in respect of that Assessment. Responses are not re-marked manually in the ordinary course.

5.2. Determination of outcome. A pass is constituted by the attainment of a score equal to or exceeding the pass threshold published in respect of the relevant Assessment.

5.3. Integrity determinations are not solely automated. Where a sitting generates Integrity Signals meeting the applicable thresholds, the automated system shall flag that sitting and shall withhold automatic issuance of the certificate. The determination whether to withhold, to issue or to revoke shall thereafter be made by a natural person acting on behalf of mindsparx. No certificate shall be revoked or permanently withheld by automated means alone.

5.4. Significance and envisaged consequences. The consequence of the Processing described at this Clause 5 is the issuance, withholding or revocation of a credential which the Data Subject may present to third parties. The Data Subject shall be notified where a certificate is withheld or revoked upon integrity grounds.

5.5. Safeguards. To the extent that the Processing described at this Clause 5 constitutes a decision based solely on automated processing within the meaning of Article 22(1) GDPR, the Data Subject shall have the right to obtain human intervention, to express his or her point of view and to contest the decision, in accordance with the procedure prescribed at Clause 5.6.

5.6. Contest procedure. A Data Subject may contest a score, an integrity flag or a revocation by written communication to alex@mindsparx.ai specifying the Code and the Assessment concerned. mindsparx shall acknowledge such communication within five (5) working days, shall procure that a natural person, and not the automated system, reviews the responses, the answer key and any flag, and shall communicate a reasoned determination within thirty (30) days. Where the original determination is found to have been erroneous, the certificate shall be issued or reinstated accordingly. This procedure is without prejudice to the rights conferred by Clause 15.

5.7. mindsparx does not employ the outputs of this Clause 5 to construct any general reputational assessment of a Data Subject, and does not disclose integrity flag data to any Client save as an element of the outcome of an Assessment commissioned by that Client.

6. Assessment Integrity Monitoring

6.1. Assessment sittings are subject to automated monitoring for the purpose stated at Clause 4.1. Notice of such monitoring is given to the Data Subject prior to the commencement of each sitting.

6.2. The Integrity Signals recorded comprise: the duration for which the Assessment window is and is not in focus; the number of copy operations blocked by the Services; the volume of text introduced by paste operation; and the aggregate counts of pointer and keyboard events.

6.3. For the avoidance of doubt, mindsparx does not record the content of keystrokes otherwise than as comprised in the Data Subject's submitted responses, and does not access files, clipboard contents, browsing history, or other applications or browser tabs upon the Data Subject's device.

6.4. The legal basis for the Processing described at this Clause 6 is Article 6(1)(f) GDPR. The legitimate interest pursued is the maintenance of the evidential value of credentials issued by mindsparx, in the absence of which the Services could not be provided to the standard represented to Data Subjects and to third parties relying upon such credentials.

6.5. A Data Subject may object to such Processing pursuant to Article 21(1) GDPR by written communication to the address specified at Clause 2.2. mindsparx acknowledges that, where such objection is upheld, it may be unable to issue a certificate in respect of the sitting concerned, being unable to attest to the validity thereof.

7. Result Sharing and Recipient Verification

7.1. A Learner may generate a revocable link permitting a third party to access a single Assessment result, and shall elect whether the Learner's display name is presented or whether the report is presented against the Code alone. Any such link may be revoked by the Learner at any time with immediate effect.

7.2. Access to a shared report is conditional upon verification of the recipient's email address by means of a single-use sign-in link, to the end that reports are not rendered publicly accessible.

7.3. Provisions applicable to recipients. Where a natural person verifies an email address for the purpose of accessing a shared report:

(a) mindsparx records that email address against the share link concerned, together with the date of first access;

(b) the Learner who generated the link is able to view that email address and the fact of access, such disclosure being an essential characteristic of the functionality;

(c) mindsparx shall not add that person to any marketing distribution list, and shall not transmit promotional communications concerning mindsparx products by reason of such verification alone;

(d) that email address shall be erased upon the earliest of: revocation of the share link; deletion of the Learner's Account; or the expiry of twelve (12) months from the date of last access; and

(e) that person shall enjoy the rights set out at Clause 15, including the right to object pursuant to Article 21(1) GDPR and to require the erasure of the email address from the Learner's recipient list.

7.4. The legal bases for the Processing described at Clause 7.3 are Article 6(1)(b) GDPR in respect of the provision of the access requested by the recipient, and Article 6(1)(f) GDPR in respect of the prevention of abuse of share links and the provision to the Learner of transparency as to access to the Learner's own credential.

8. Certificates and Public Verification

8.1. A certificate verification page is accessible only by means of its unique link and displays the Code, the Assessment, the score, the applicable dates and the current status of the certificate. It displays no name and no email address by default.

8.2. A Learner may elect to display his or her name upon a certificate earned by that Learner, and may revoke such election at any time. Deletion of the Account shall cause such name to be removed from every certificate automatically.

8.3. Where a Learner publishes a certificate link, the association of that credential with the Learner's identity is effected by the Learner and not by mindsparx.

8.4. Revocation shall remain displayed upon the verification page, to the end that any person relying upon the credential may ascertain its current status.

9. Recipients and Sub-Processors

9.1. mindsparx engages the Sub-Processors identified below. Each such Sub-Processor Processes Personal Data solely upon the documented instructions of mindsparx pursuant to a written data processing agreement, and is not permitted to Process Personal Data for its own purposes.

9.2. A current list of Sub-Processors is maintained at mindsparx.ai/subprocessors. Clients shall receive advance notification of amendments to that list in accordance with the data processing agreement referred to at Clause 18.

9.3. mindsparx may further disclose Personal Data to its professional advisers, and to competent authorities where required to do so by law. mindsparx shall not disclose Personal Data upon informal request.

10. Transfers to Third Countries

10.1. Personal Data is stored within the European Union. Certain Sub-Processors identified at Clause 9.1 are established outside the European Economic Area, or may access Personal Data from outside the European Economic Area for support purposes. Personal Data may accordingly be transferred to the United States.

10.2. In respect of each such transfer, mindsparx relies upon:

(a) the standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, incorporated into the agreement with the relevant Sub-Processor, together with a transfer impact assessment and technical measures including encryption in transit and at rest; and, where applicable,

(b) an adequacy decision pursuant to Article 45 GDPR, where the Sub-Processor is certified under a framework recognised by the European Commission, including the EU-US Data Privacy Framework.

10.3. A copy of the safeguards applicable to any specified Sub-Processor shall be furnished upon written request to the address specified at Clause 2.2.

11. Retention

11.1. Personal Data shall be retained for the periods, or determined by reference to the criteria, specified below.

12. Deletion of the Account and Effect Thereof

12.1. A Learner may delete the Account by means of the facility provided within the Services. Upon such deletion:

(a) the Account record is erased, comprising the email address, the display name and the link between the Learner and the Code;

(b) records held against the Code alone are retained, comprising results, certificates (displayed against the Code alone), attempt records and records of items previously presented, and no longer identify a named person to mindsparx;

(c) recipient email addresses associated with the Learner's share links are erased and such links cease to operate;

(d) practice records are erased; and

(e) prior to erasure, the Learner's results are incorporated into Aggregate Data in accordance with Clause 13.

12.2. Characterisation of surviving records. For so long as any person may by reasonable means re-associate a Code with a natural person, including by reason of a Client's retention of a code-to-identity mapping, the records described at Clause 12.1(b) constitute pseudonymised Personal Data within the meaning of Article 4(5) GDPR and are not represented by mindsparx as anonymous data. mindsparx retains no such mapping following deletion of the Account.

12.3. Erasure of surviving records. A Data Subject may require the erasure of the records described at Clause 12.1(b) by written communication to the address specified at Clause 2.2. mindsparx shall effect such erasure save in respect of any record which it is required to retain for compliance with a legal obligation or for the establishment, exercise or defence of legal claims, in which case mindsparx shall identify the record and the ground of retention. Erasure of results invalidates any certificate founded thereupon, and mindsparx shall obtain the Data Subject's confirmation prior to effecting such erasure.

12.4. Aggregate Data to which the Data Subject's results have contributed shall be unaffected, such data containing no information relating to the Data Subject.

13. Aggregate Data

13.1. mindsparx derives Aggregate Data from Assessment outcomes for the purpose stated at Clause 4.1.

13.2. Aggregate Data is computed only across a minimum group size, such that no individual record may be inferred therefrom, and contains no Code, name or email address.

13.3. Aggregate Data is retained indefinitely and is not subject to the rights conferred by Clause 15, such data relating to no identified or identifiable natural person.

14. Security

14.1. mindsparx implements appropriate technical and organisational measures pursuant to Article 32 GDPR, including: storage within a European Union region with row-level security enabled and no public read access; encryption in transit and at rest; restriction of access to production data to those persons requiring such access; passwordless authentication, no password being stored; segregation of answer keys from all candidate-facing and third-party interfaces; and access to Assessments by means of cryptographically generated single-use tokens.

14.2. In the event of a Personal Data Breach likely to result in a risk to the rights and freedoms of natural persons, mindsparx shall notify the supervisory authority identified at Clause 2.4 within seventy-two (72) hours of becoming aware thereof, in accordance with Article 33 GDPR, and shall notify affected Data Subjects without undue delay where the risk is high, in accordance with Article 34 GDPR.

15. Rights of Data Subjects

15.1. A Data Subject has the right, subject to the conditions and exceptions provided by the GDPR:

(a) to obtain access to his or her Personal Data pursuant to Article 15 GDPR, which right may be exercised directly by means of the export facility provided within the Services, producing a machine-readable file;

(b) to obtain the rectification of inaccurate Personal Data pursuant to Article 16 GDPR;

(c) to obtain erasure pursuant to Article 17 GDPR, as further provided at Clause 12;

(d) to obtain restriction of Processing pursuant to Article 18 GDPR;

(e) to object to Processing founded upon Article 6(1)(f) GDPR pursuant to Article 21 GDPR, including the Processing described at Clauses 4.1 and 6;

(f) to data portability pursuant to Article 20 GDPR, which right is satisfied by the export facility referred to at sub-clause (a) above;

(g) to withdraw consent at any time pursuant to Article 7(3) GDPR where Processing is founded upon consent, including the election referred to at Clause 4.1, the withdrawal of which may be effected within the Services and shall not affect Assessments or certificates;

(h) not to be subject to a decision based solely on automated processing pursuant to Article 22 GDPR, as further provided at Clause 5; and

(i) to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, being the authority identified at Clause 2.4 or the supervisory authority of the Member State of the Data Subject's residence, place of work or place of the alleged infringement, and to an effective judicial remedy.

15.2. Requests shall be addressed to alex@mindsparx.ai. mindsparx shall respond within one (1) month of receipt, which period may be extended by two (2) further months where necessary by reason of the complexity or number of the requests, in which event mindsparx shall inform the Data Subject within one (1) month of receipt together with the reasons for the delay, in accordance with Article 12(3) GDPR. No fee shall be charged save as permitted by Article 12(5) GDPR.

15.3. Where mindsparx is unable to identify the Data Subject from the information supplied, it may request the provision of such additional information as is necessary to confirm identity, in accordance with Article 12(6) GDPR.

16. Cookies and Similar Technologies

16.1. mindsparx employs strictly necessary cookies only, being those required for authentication and for the security of the authentication process. Such cookies fall within the exemption provided by Article 5(3) of Directive 2002/58/EC and no consent is solicited in respect thereof.

16.2. mindsparx employs no analytics cookies, no advertising cookies and no third-party tracking technologies, and does not undertake device fingerprinting.

16.3. The Integrity Signals described at Clause 6.2 are measured by scripts executing upon the Assessment page during an Assessment which the Data Subject has elected to undertake, and are limited to the counts and durations there specified.

16.4. Should mindsparx introduce analytics or similar technologies, it shall solicit consent prior to the deployment thereof and shall amend this Privacy Policy accordingly.

17. Age Restriction

17.1. The Services are directed exclusively to natural persons who have attained the age of eighteen (18) years, the Services constituting a route to remunerated professional engagement.

17.2. mindsparx does not knowingly establish an Account for any person below that age. Upon being informed that an Account has been established by such a person, mindsparx shall delete the same.

18. Clients

18.1. In respect of a Client's own Account data, mindsparx acts as Controller and this Privacy Policy applies.

18.2. In respect of Candidate data Processed on behalf of a Client, the obligations of mindsparx are set out in the data processing agreement available at mindsparx.ai/dpa, which forms part of the Client's commercial agreement with mindsparx and which gives effect to the requirements of Article 28(3) GDPR, including: Processing solely upon documented instructions; confidentiality; security measures; the authorisation of and notification in respect of Sub-Processors; assistance in respect of the rights of Data Subjects; notification of Personal Data Breaches; and the deletion or return of Personal Data upon termination.

18.3. The Client shall be responsible for informing its Candidates of the Processing, for establishing its own lawful basis, and for the security of the code-to-identity mapping retained by it.

19. Amendments

19.1. The version identifier of this Privacy Policy is recorded upon this page, and the version accepted by each Learner is recorded against the Account and displayed within the Services.

19.2. Where mindsparx effects a material amendment hereto, being an amendment which introduces a purpose, a category of Personal Data, a category of recipient or a retention period of which a Data Subject would reasonably wish to be informed, mindsparx shall increment the version identifier and shall require the Learner to review the amended Privacy Policy upon next authentication. Amendments which do not alter the substance of the Processing, including the correction of typographical errors, shall be effected with a revised date and shall not give rise to the said requirement.

19.3. The version immediately preceding this one, being version 2026-07-24, is published at mindsparx.ai/privacy/2026-07-24. Any earlier version shall be furnished upon request to the address specified at Clause 2.2.

20. Contact

S.C. Transdesk Communications S.R.L., Str. Valea Alba 8, Bl. 8, Sc. A, Ap. 4, 600004 Bacau, Romania. All communications: alex@mindsparx.ai.