Version of August 26, 2026
1. Data controller and roles
Vik Consulting SRL, 112 rue Sans Souci, 1050 Brussels, operating the Thalionis brand, is responsible for the processing necessary for the management of the site, prospects, accounts, security, invoicing and its own assessments. Contact: assessment@thalionis.com · VAT BE 0693.674.615.
When a company uses Studio Thalionis to evaluate its candidates or employees, this company generally determines the purposes of the evaluation and acts as the data controller. Vik Consulting SRL then acts as a subcontractor for the hosting, administration and technical production of the course, except for its own obligations. These roles are specified in the contract and data processing agreement.
2. Data subjects
This policy concerns site visitors, prospects, customers, company managers, recruiters, consultants, external candidates, evaluated employees and users of Studio or Expert Thalionis spaces.
3. Data processed
- identity, contact details, company, function and language;
- account data, access rights, connection logs, IP address, tokens and usage history;
- CV, photography, career path, diplomas, experience and professional information;
- answers to questionnaires, including 120 analysis questions, results, scores and analyzes of behavioral profiles;
- observations from interviews and scenarios, consultant notes and recommendations;
- communications, support requests, orders, credits, invoices and payments;
- technical data necessary for the security and proper functioning of the service.
Thalionis does not request sensitive data without demonstrated legal and operational necessity. Customers and users can only enter information relevant to the function and intended purpose.
4. Origin of data
The data comes from the data subject, the client company, an authorized recruiter or consultant, the answers provided during the assessment and the technical systems used to secure the course. When the data is not obtained directly from the person, the person receives the required information within the legal deadlines.
5. Purposes and legal bases
- provide the site, Studio and the assessments: execution of the contract or pre-contractual measures;
- gérer les candidatures et produire les rapports : contrat, intérêt légitime documenté du responsable du traitement ou autre base déterminée par le client ;
- manage accounts, orders, credits and invoices: contract and legal obligations;
- secure access, prevent abuse and ensure traceability: legitimate interest and security obligations;
- respond to requests: pre-contractual measures or legitimate interest;
- send a commercial communication: consent when required or legitimate interest within the permitted limits;
- comply with tax, social, judicial and regulatory obligations: legal obligation.
Consent is only used when it constitutes a valid basis and can be withdrawn at any time without affecting previous processing.
6. Mandatory nature
The data marked as mandatory are necessary for the creation of the account, the identification of the candidate, security or the completion of the assessment. Their absence may prevent access to the service or the production of a report. Other data is optional.
7. Artificial intelligence and human control
Certain steps can be assisted by an artificial intelligence system to structure, reconcile and synthesize the information collected. The system never decides on the recruitment, promotion or development of a person. The results are checked, contextualized and validated by a competent person who can modify or reject them.
Before the assessment, the candidate receives appropriate information on the purpose of the processing, the data used, the contribution of AI, human control and their rights. He can ask for an understandable explanation, point out an error, present his point of view and request a human review. Thalionis is also preparing its documentation, governance and controls for the obligations applicable to high-risk AI systems from December 2, 2027.
8. Recipients and subcontractors
The data is accessible only to authorized persons of Vik Consulting, to the client concerned, to the consultants assigned to the mission and to the service providers essential for hosting, messaging, security, payment, support, documentary production and technological assistance. Each access is limited to the need to know and contractually regulated.
9. International transfers
Where data is to be processed outside the European Economic Area, the transfer is based on an adequacy decision or appropriate safeguards, including the standard contractual clauses of the European Commission, supplemented where necessary by additional measures. Information on these guarantees can be requested from assessment@thalionis.com.
10. Shelf life
- dossiers candidats et rapports : au maximum 24 mois après la fin du parcours ou le dernier contact, sauf instruction plus courte du client, obligation légale ou litige ;
- accounts and usage data: during the contractual relationship then the duration necessary for closure and defense of rights;
- accounting data and invoices: for the applicable legal period;
- security logs: for a period proportionate to security and proof needs;
- prospects: up to three years after the last relevant contact, unless previously opposed;
- trial data: deleted or anonymized after account closure and necessary technical deadlines.
11. Security
Thalionis applies appropriate technical and organizational measures: access control, separation of roles, encryption where relevant, backups, logging, incident management, contractual confidentiality and regular review of authorizations. However, no system can guarantee zero risk.
12. Your rights
Under the conditions provided for by the GDPR, you have the rights of access, rectification, erasure, limitation, opposition and portability. You can withdraw your consent and request not to be subject to a decision based exclusively on automated processing producing a significant legal or similar effect.
Send your request to assessment@thalionis.com, specifying your identity and the subject of the request. A response is generally provided within one month. When Thalionis acts as a subcontractor, the request may be transmitted to the company responsible for processing.
13. Complaint
You can submit a complaint to the Data Protection Authority: Rue de la Presse 35, 1000 Brussels · contact@apd-gba.be · autoriteprotectiondonnees.be.
14. Cookies and updates
Information relating to trackers is included in the Cookie Policy. This policy may be adapted when services or regulations evolve. The applicable version and its date are published on this page.