Version dated 24 October 2026
1. Data controller and roles
Vik Consulting SRL, 112 rue Sans Souci, 1050 Brussels, operating the Thalionis brand, is responsible for the processing necessary for the management of the site, prospects, accounts, security, invoicing and its own assessments. Contact: assessment@thalionis.com · VAT BE 0693.674.615.
When a company uses Studio Thalionis to evaluate its candidates or employees, this company generally determines the purposes of the evaluation and acts as the data controller. Vik Consulting SRL then acts as a subcontractor for the hosting, administration and technical production of the course, except for its own obligations. These roles are specified in the contract and data processing agreement.
2. Data subjects
This policy concerns site visitors, prospects, customers, company managers, recruiters, consultants, external candidates, evaluated employees and users of Studio or Expert Thalionis spaces.
3. Data processed
- identity, contact details, company, function and language;
- account data, access rights, connection logs, IP address, tokens and usage history;
- CV, photograph where collected in the assessment, qualifications, experience, professional information and external test reports supplied for the stated purpose;
- responses to the questionnaires selected for the assessment, results, scores and behavioural profile analyses;
- observations from interviews and scenarios, consultant notes and recommendations;
- communications, support requests, orders, credits, invoices and payments;
- technical data necessary for the security and proper functioning of the service.
Thalionis does not request sensitive data without demonstrated legal and operational necessity. Customers and users can only enter information relevant to the function and intended purpose.
4. Origin of data
The data comes from the data subject, the client company, an authorized recruiter or consultant, the answers provided during the assessment and the technical systems used to secure the course. When the data is not obtained directly from the person, the person receives the required information within the legal deadlines.
5. Purposes and legal bases
- provide the site, Studio and the assessments: execution of the contract or pre-contractual measures;
- managing applications and producing reports: a valid basis determined by the controller for the context, including a documented legitimate interest or pre-contractual steps where their conditions are met; the commercial contract between Thalionis and its client does not by itself justify processing the candidate’s data;
- manage accounts, orders, credits and invoices: contract and legal obligations;
- secure access, prevent abuse and ensure traceability: legitimate interest and security obligations;
- respond to requests: pre-contractual measures or legitimate interest;
- send a commercial communication: consent when required or legitimate interest within the permitted limits;
- comply with tax, social, judicial and regulatory obligations: legal obligation.
Consent is only used when it constitutes a valid basis and can be withdrawn at any time without affecting previous processing.
6. Mandatory information
The data marked as mandatory are necessary for the creation of the account, the identification of the candidate, security or the completion of the assessment. Their absence may prevent access to the service or the production of a report. Other data is optional.
7. Artificial intelligence and human control
Certain steps can be assisted by an artificial intelligence system to structure, reconcile and synthesize the information collected. The system never decides on the recruitment, promotion or development of a person. The results are checked, contextualized and validated by a competent person who can modify or reject them.
Before the assessment, the candidate receives appropriate information on the purpose of the processing, the data used, the contribution of AI, human control and their rights. He can ask for an understandable explanation, point out an error, present his point of view and request a human review. Thalionis is also preparing its documentation, governance and controls for the obligations applicable to high-risk AI systems from December 2, 2027.
8. Recipients and subcontractors
The data is accessible only to authorized persons of Vik Consulting, to the client concerned, to the consultants assigned to the mission and to the service providers essential for hosting, messaging, security, payment, support, documentary production and technological assistance. Each access is limited to the need to know and contractually regulated.
9. International transfers
Vik Consulting SRL is established in Belgium. The public website and the operational Cockpit Thalionis VPS are hosted by OVHcloud in Gravelines, France. The infrastructure’s automated OVHcloud backups are also hosted in France. The VPS location does not determine where other providers process data.
AI assistance uses the OpenAI API with a project configured as “Global” and standard retention. Voluntary sharing for model training or improvement is disabled. This configuration does not guarantee exclusively European processing and does not constitute Zero Data Retention approval. OpenAI’s public agreement designates OpenAI Ireland Ltd. for EEA-based customers and provides for international transfer safeguards; processing outside the EEA or Switzerland, including in the United States, remains possible. Confirmation of the destinations and safeguards applicable to our organisation, including Swiss data, has been requested from OpenAI. No exclusively European residency is claimed.
Professional email uses Google Workspace, with a Business Starter subscription purchased through Wix. Thalionis automated messages use Google’s SMTP server smtp.gmail.com and the address assessment@thalionis.com. Google processes the data needed for communications, including addresses, message content, any attachments and technical delivery data. Purchasing through Wix does not mean that Wix hosts the mailbox or processes every message. Exclusively European residency has not been established for this configuration; processing outside the EEA or Switzerland, including in the United States, is possible depending on the services and subprocessors involved.
Google’s public documents provide for a data processing agreement, provisions concerning the Swiss FADP and transfer mechanisms, including standard contractual clauses where applicable. Their application depends on the relevant contracts and services; referring to these documents is not a certification of compliance. Provider lists describe possible destinations and sometimes conditional involvement, without proving the route taken by a particular file. Before an assessment, the case-specific information must identify the destination countries and the safeguards actually applicable.
10. Retention periods
- candidate files and reports: the period necessary for the purpose, defined and justified by the controller and communicated before assessment with a precise starting point; using Thalionis does not in itself justify a blanket 24-month retention period;
- accounts and usage data: during the contractual relationship then the duration necessary for closure and defense of rights;
- accounting data and invoices: for the applicable legal period;
- security logs: for a period proportionate to security and proof needs;
- prospects: up to three years after the last relevant contact, unless previously opposed;
- trial data: deleted or anonymized after account closure and necessary technical deadlines.
Technical retention at OpenAI: application calls request that responses are not stored as application state (store=false). Abuse-prevention logs may nevertheless contain content and are retained for up to 30 days by default, with legal or safety exceptions; some technical caches may persist for up to 24 hours. Uploaded files follow separate rules: the application requests deletion after analysis, but currently does not guarantee retrying failed deletions. Without effective deletion or expiry, these files may remain stored by the service. These periods do not replace the retention period for the assessment file held in Thalionis.
Email communications and any attachments follow a separate lifecycle from the assessment file and must be deleted when no longer needed, subject to legal obligations and the defence of legal claims. Deleting a Thalionis file does not automatically delete messages or copies held by recipients. Google’s public document provides for a technical period of up to 180 days following a deletion instruction that has become irreversible for the customer, except where retention is required by law; this is not permission to retain messages for 180 days by default.
11. Security
Thalionis applies appropriate technical and organizational measures: access control, separation of roles, encryption where relevant, backups, logging, incident management, contractual confidentiality and regular review of authorizations. However, no system can guarantee zero risk.
12. Your rights
Where the GDPR applies, you have rights of access, rectification, erasure, restriction, objection and portability subject to its conditions. You may withdraw consent for future processing and benefit from the safeguards applicable to solely automated decisions with legal or similarly significant effects.
In Switzerland, Article 25 FADP provides access to data and information about its processing. Rectification and other personality protection remedies, including destruction where applicable, may be requested. Article 28 provides for delivery or transfer of data disclosed by the person, subject to its conditions; it does not automatically cover all AI-derived inferences. Article 21 provides safeguards for certain solely automated individual decisions, including human review, subject to statutory exceptions.
13. Complaints
You may lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels · contact@apd-gba.be · autoriteprotectiondonnees.be.
14. Cookies and updates
After your consent, the site enables Google Analytics 4 and an internal counter connected to Cockpit Thalionis. Browser and session identifiers and navigation events are used for audience measurement. Hashed or pseudonymised data must not automatically be considered anonymous. Network communications require technical processing of an IP address; infrastructure logs and Google processing are separate from the internal counter. The cookie policy details the tools and withdrawal of consent. This policy’s date is updated when it changes.
15. Applicable framework in Switzerland
For processing subject to Swiss law, this policy applies together with the FADP and its ordinance. References to GDPR legal bases describe the European framework; they do not replace Swiss requirements of lawfulness, transparency, purpose limitation and proportionality. In recruitment and private employment relationships, information must be relevant to professional suitability or necessary for the employment contract, notably under Article 328b of the Swiss Code of Obligations.
16. Profiling and separate consent
Combining data to evaluate aspects of professional functioning may constitute profiling. The controller must assess whether it qualifies as high-risk profiling under the FADP and perform the required impact assessment where processing is likely to entail a high risk. Where consent is relied upon for high-risk profiling or sensitive data, it must be express under the applicable requirements. General consent does not permit excessive data collection or override employment protections.
Retention for future opportunities and use for a separate purpose must be assessed separately. Assessment data may not be freely reused to train a model or enrich a memory used for other cases. Such use requires a separate framework, appropriate information and the required safeguards and consent.
17. Transfer information before an assessment
For a person in Switzerland, case-specific information must identify destination countries, including transfers to Belgium or France, and the relevant safeguards or exceptions under Articles 16 to 19 FADP. For processing subject to the GDPR, European transfer rules also apply. An adequacy decision does not remove the duty to inform or other data protection obligations.
Before any real assessment, the company and Thalionis must specify the providers, processing countries and safeguards actually applicable to the case, including AI and backups. If you have not received this information, request it from the company or assessment@thalionis.com before submitting your file or starting the assessment. This general policy does not replace that specific information.
18. End of recruitment and backups
In Switzerland, files of unsuccessful applicants are in principle deleted at the end of the process unless there is a legitimate retention reason. A client-requested period of 12 months must also be justified; it is not a general statutory period. Retention in a separate talent pool must be disclosed and, where required, covered by separate consent. Merely viewing a file for technical purposes does not by itself extend its retention period.
The automated OVHcloud backup currently identified is the Standard plan: a VPS backup is created daily, with 24-hour retention. Seven-day retention belongs to the Premium option and is not the plan observed. This 24-hour period applies only to this OVHcloud backup; it does not guarantee that all deleted data disappears within 24 hours and does not cover any local copies, exports, other backups or copies held by providers. Their inventory and lifecycle must be specified in the service arrangements. Restoration procedures must prevent previously deleted files from being reintroduced.
19. Exercising rights and contacting authorities
Write to assessment@thalionis.com stating your request and the information needed to identify you, without sending excessive documents. Where Thalionis is a processor, the request is directed to the responsible company and Thalionis assists it. Access requests are normally answered within 30 days under the FADP and one month under the GDPR, subject to legally justified extensions or restrictions. Other requests follow the time limits applicable to their nature.
For processing subject to Swiss federal law, you may report a matter to the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch. The FDPIC is a supervisory authority, not a court awarding damages. A cantonal authority may be competent for cantonal or municipal bodies. Judicial remedies remain available.
Provider documents: