Privacy Notice
How PanelPrep · IO collects, uses, shares and protects personal data, the legal bases we rely on, and the rights you have under the GDPR.
Last updated: 7 September 2026
1. Who we are (data controller)
PanelPrep · IO is an online preparation tool for competency-based interviews. The controller responsible for the personal data described in this notice is:
- Legal name: TO BE COMPLETED
- Registered address: TO BE COMPLETED
- Contact email: TO BE COMPLETED
- Data protection officer: TO BE COMPLETED — whether a DPO must be appointed has not yet been assessed, so no statement is made here either way.
This notice explains what personal data we process, why, on what legal basis, who receives it, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR).
2. What personal data we collect
We only process the data the service actually needs.
- Account data: your email address, your display name, the authentication method you use (email and password, or Google sign-in) and the confirmation status of your email address. Passwords are handled by our authentication provider and are never visible to us in readable form.
- Profile data: the profile record linked to your account, including your plan status.
- Scenario Bank content: the STAR scenarios, keywords and personal notes you write and save.
- Interview content: the interview sessions you create, the vacancy or job description text you paste, the questions generated for you, the answers you write, the evaluations produced for those answers and the reports generated from them.
- Application Tracker data: the vacancies, employers, reference numbers, statuses, dates and notes you record, including vacancy details imported from a public vacancy identifier you enter.
- Usage and technical data: basic technical information required to operate and secure the service, such as request logs, error reports and the approximate country signalled by the network for currency display.
- AI usage data: counters recording how many AI-assisted questions your account has used, so that free allowances and limits can be enforced.
- Language preference: stored in a cookie so the site loads in the language you chose.
- Subscription data: not collected today. Paid subscriptions are not active. When they are enabled, billing identifiers and payment status will be processed by our payment provider; we will not store full card details.
We do not ask for special categories of data (such as health, religion, ethnic origin or political opinions). Please do not include such information in the free-text fields.
3. Why we process personal data, and on what legal basis
| Purpose | What it covers | Legal basis |
|---|---|---|
| Account creation and authentication | Registering you, verifying your email, signing you in, password resets | Performance of a contract (Art. 6(1)(b)) |
| Providing the application | Running the dashboard, Scenario Bank, Application Tracker and interview interface | Performance of a contract (Art. 6(1)(b)) |
| Storing your content | Keeping your scenarios, answers, notes, applications and reports available to you | Performance of a contract (Art. 6(1)(b)) |
| AI interview functionality | Sending your vacancy text and answers to an AI provider to generate questions, follow-ups, evaluations and reports | Performance of a contract (Art. 6(1)(b)) |
| Security and abuse prevention | Access controls, rate and usage limits, detecting misuse | Legitimate interests (Art. 6(1)(f)) — keeping the service secure and available |
| Service reliability and improvement | Diagnosing errors, understanding failures, improving features | Legitimate interests (Art. 6(1)(f)) |
| Language preference cookie | Remembering the language you selected | Legitimate interests (Art. 6(1)(f)) — strictly functional |
| Analytics | Not used at present. No third-party analytics or tracking product is integrated. | Not applicable |
| Advertising | Not used at present. The interface reserves space for future advertising, but no ad network is loaded and no advertising identifiers are collected. | Not applicable |
| Subscriptions and billing | Not active today. Once paid plans are enabled, processing payments, invoicing and tax records | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered the impact on you and limited the processing to what is necessary. You may object at any time (see section 9).
If we later introduce analytics, advertising or any other non-essential tracking, we will ask for your consent (Art. 6(1)(a)) before it is activated. We do not claim consent for anything we do not actually ask you to agree to.
4. AI processing
When you use the AI-assisted interview functionality, relevant information is sent to an external AI service provider so that questions, follow-up questions, evaluations and reports can be generated. Depending on the action, this can include the vacancy or job description text you paste, the competency being assessed, the question shown and the answer you wrote.
Please keep in mind:
- Do not enter unnecessary personal or sensitive information in vacancy text, scenarios, answers or notes. Use initials or general descriptions instead of naming other individuals.
- AI-generated content is produced automatically and can be inaccurate or incomplete. It is preparation material, not professional, legal or employment advice.
- We do not state that your content is or is not used to train the AI provider's models: the applicable provider terms and configuration have not yet been verified and published here. This point is marked [TO BE CONFIRMED] and will be updated once verified.
5. Who receives your data
We do not sell personal data. We share it only with service providers ("processors") that operate parts of the service on our behalf, under contract and on our instructions:
- Hosting, database and file storage: HOSTING / DATABASE PROVIDER — TO BE CONFIRMED
- Authentication (including Google sign-in when you choose it): AUTHENTICATION PROVIDER — TO BE CONFIRMED; if you sign in with Google, Google acts as an independent controller for its own account services
- AI processing: AI PROVIDER — TO BE CONFIRMED
- Public vacancy lookup: when you import a vacancy by identifier, a request is sent to the relevant organisation's public vacancy service; the vacancy identifier you enter is transmitted for that purpose
- Payments: not active today. When subscriptions launch, a payment provider will process payment data as an independent controller for its own compliance duties
- Analytics / advertising providers: none at present
We may also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.
6. International data transfers
Some of our providers may process personal data outside the European Economic Area (EEA). We have not yet completed and published the verification of each provider's hosting locations and transfer safeguards, so we do not claim that your data stays in the EU.
- Transfer status per provider: TO BE CONFIRMED
- Where a transfer outside the EEA takes place, it must be covered by a GDPR transfer mechanism — an adequacy decision under Art. 45, or Standard Contractual Clauses under Art. 46 together with any additional measures required.
This section will be updated with provider-specific detail once each arrangement is confirmed.
7. How long we keep data
- Account and profile data: kept while your account exists, and deleted when your account is deleted.
- Scenario Bank, interview content, evaluations and reports: kept until you delete the item or your account. Deleting your account removes the associated content.
- Application Tracker entries: kept until you delete them or your account.
- AI usage counters: kept while your account exists, because they enforce lifetime and periodic allowances.
- Technical logs and error reports: RETENTION PERIOD TO BE CONFIRMED — retained only as long as needed for security and reliability.
- Billing and tax records (once subscriptions are active): retained for the period required by applicable accounting and tax law.
We do not keep personal data indefinitely where the GDPR requires erasure. Where a retention period has not yet been fixed, it is marked [RETENTION PERIOD TO BE CONFIRMED] rather than invented.
8. Security
We apply appropriate technical and organisational measures to protect personal data, including authenticated access, row-level access controls so that your content is only reachable by your account, server-side enforcement of permissions and limits, encrypted connections, and restricted administrative access.
No online service can be completely secure, and we do not claim absolute security. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you.
9. Your rights
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data and a copy of it.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted where the conditions of Art. 17 apply.
- Restriction — ask us to limit processing in the cases set out in Art. 18.
- Portability — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
- Object — object to processing based on our legitimate interests, on grounds relating to your particular situation.
- Withdraw consent — where processing is based on consent, withdraw it at any time, without affecting processing carried out before withdrawal.
- Automated decision-making — not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (see section 11).
To exercise any of these rights, contact us at the address in section 13. You can also delete individual scenarios, answers, applications and interviews directly in the application. We respond within one month, extendable by two further months for complex requests, and we may ask for information needed to verify your identity.
10. Complaints
If you believe we have not handled your personal data properly, you can lodge a complaint with a supervisory authority.
In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl.
You may instead contact the supervisory authority of the EU or EEA country where you live, where you work, or where the alleged infringement took place.
11. Automated decision-making and AI
The interview functionality uses AI to generate practice questions, follow-up questions, written feedback and indicative scores on the answers you write. This is a preparation and self-assessment tool.
- These outputs are not recruitment, employment, eligibility or suitability decisions, and they are not shared with employers, recruiters or interview panels by us.
- No decision producing legal effects concerning you or similarly significantly affecting you is made about you by automated means within the meaning of Art. 22 GDPR.
- Scores and feedback are indicative only and should be treated as practice guidance.
12. Children
The service is designed for adults preparing for professional interviews. A minimum age has not been formally set in our terms, so we state it here as [MINIMUM AGE TO BE COMPLETED] rather than implying a threshold that is not established. If you believe a child has provided us with personal data, contact us and we will review and, where appropriate, delete it.
13. Contact
For any question about this notice or about your personal data, including to exercise your rights, contact:
[PRIVACY EMAIL TO BE COMPLETED]
14. Changes to this Privacy Notice
We may update this notice as the service evolves — for example when subscriptions, analytics or advertising are activated, or when provider and retention details are confirmed. The date at the top shows when it was last changed. Where a change is material, we will inform you by an appropriate means, such as a notice in the application or an email to the address on your account, before it takes effect where required.