Introduction

At HAPTAI, we help you unlock your cyber security potential by analysing information about how you play, build and think. We treat your personal information with respect and transparency.

For 16–17 Year Olds: We have designed this Privacy Notice to be clear and easy to understand. HAPTAI does not have social or user-to-user messaging features, so other candidates cannot see or contact you through the platform. We also provide short privacy explanations at relevant points in HAPTAI, for example when you add information, connect another service or use an AI-supported assessment feature.

1. Who We Are & How to Contact Us

THG Ventures Limited (trading as The Hacking Games) (“we”, “us”, “our”, “THG”) is the Data Controller and owns the HAPTAI platform at https://haptai.thehackinggames.com/ (“HAPTAI”).

Email: haptai.support@thg-v.com

Address: 298a Gray's Inn Road, London, England, WC1X 8DX

If you use HAPTAI as part of a programme, workshop, recruitment process or other assessment run with another organisation, we will give you additional privacy information where relevant explaining how your information will be used for that particular activity and the role of the organisation involved.

2. Where We Get Your Data

We collect most of your information directly from you when you create your account, complete onboarding questions, answer assessment questions, take part in an AI-supported interview, add projects or challenges, upload documents or otherwise add information to your HAPTAI profile.

If you choose to connect another account or provide an account username, we may also obtain information from that service. Depending on the service you use, this can include:

Steam: your Steam ID, games and play hours. We import this information when you connect your account; we do not continuously monitor your Steam account;

Xbox: basic Xbox profile information and game history. We import this information when you connect your account; we do not continuously monitor your Xbox account;

TryHackMe: the public challenge history associated with the username you provide. This is a public username lookup rather than an authenticated account connection;

GitHub: when you connect your GitHub account, HAPTAI receives basic information about the repositories your account can access, including private and organisation repositories. This includes the repository name, description, language and whether the repository is public or private. For the project repository you link, we use its language information to add detected programming languages to your HAPTAI profile. We do not retrieve or store repository file contents, source code or commit history from public or private repositories; and

Hugging Face: account, organisation and model information, including information about private models where your connection gives HAPTAI access to them. This information can be used as evidence when assessing your skills.

We give you more information about what we access and how we use it when you connect or use the relevant service. You do not have to connect these services to create a HAPTAI account.

If you use HAPTAI as part of a specific recruitment or assessment process, the organisation running that process may give us information such as your name, email address and information needed to associate you with the relevant vacancy or assessment.

In other cases, an organisation may give you a programme-specific or assessment-specific HAPTAI link rather than providing your details directly to us. When you register through that link, it can associate your account with the relevant programme, assessment or cohort so that we can administer the activity, apply the appropriate settings and produce the relevant reporting.

3. What We Collect, Why, and Our Lawful Basis

Under UK data protection law and, where applicable, EU data protection law, we must have a valid legal reason (a “lawful basis”) to process your personal information.

Account administration

The data we use: Email address, username, password and other account information.

Our lawful basis: Contractual necessity

What this means in plain English: We need this information to create and manage your HAPTAI account and let you log in.

HAPTAI assessment, profile and report

The data we use: Information you add to your profile, including game information and answers, AI interview responses, project information and files, CV/documents, challenge information and information from connected sources. We also use the skills, aptitudes, confidence values, scores and other assessment information generated from those inputs.

Our lawful basis: Contractual necessity

What this means in plain English: This is the core HAPTAI service you ask us to provide. We analyse the evidence in your profile to generate your skills, aptitudes, scores, career insights and HAPTAI report. Some inputs and connected sources are optional.

AI-supported analysis and scoring

The data we use: Relevant assessment inputs and information generated from those inputs.

Our lawful basis: Contractual necessity

What this means in plain English: AI analyses some of the information in your profile. Depending on the source, AI can sort or categorise information you submit, identify and assess skills and aptitudes, and contribute directly to values used in your scores and report. See section 6 for more information.

Support and review requests

The data we use: Your contact details, support messages and relevant account, source or assessment information.

Our lawful basis: Contractual necessity

What this means in plain English: We use this information to answer questions, resolve technical issues and review your assessment if you tell us that something looks wrong.

Essential service communications

The data we use: Your email address and relevant account, programme or assessment information.

Our lawful basis: Contractual necessity and, where appropriate, legitimate interests

What this means in plain English: We send messages needed to provide or administer HAPTAI, such as account verification, password resets, report-ready notifications and standard reminders for an activity you have joined.

Technical maintenance and security

The data we use: IP address, device/browser information, security information and technical/usage logs.

Our lawful basis: Legitimate interests

What this means in plain English: We need this information to keep HAPTAI secure, investigate technical problems, maintain the service and protect the platform from misuse.

Recruitment and candidate assessment

The data we use: Depending on the process: your contact details, participation/completion status, HAPTAI profile information, skills, aptitudes, scores, role-match information and relevant assessment reports.

Our lawful basis: The lawful basis depends on the particular recruitment or assessment arrangement. We will explain the applicable basis in the privacy information provided for that process.

What this means in plain English: HAPTAI may be used to compare candidates against particular roles or opportunities and provide relevant assessment information to the organisation running the process.

Product testing, calibration and quality assurance

The data we use: Selected assessment inputs, transcripts, scores, AI outputs and other relevant assessment information.

Our lawful basis: Legitimate interests

What this means in plain English: We use selected information to test and improve how HAPTAI, its scoring processes, AI prompts and product features work. Access is restricted to people who need the information for this purpose. Where information from a particular programme is excluded from testing or calibration, we do not use that programme's information for this purpose.

Optional career opportunities

The data we use: Your contact details and relevant information from your HAPTAI profile, including skills, aptitudes and role-related information.

Our lawful basis: Consent

What this means in plain English: If you choose this option, THG may use your HAPTAI profile to identify relevant cyber career opportunities and contact you if there may be a match. You can change this choice at any time in Privacy Settings. This choice does not by itself allow us to give your identifiable HAPTAI profile or report to another organisation.

Programme and workshop administration and group-level reporting

The data we use: Your programme/cohort association, participation information and relevant HAPTAI assessment results.

Our lawful basis: Legitimate interests

What this means in plain English: If you join HAPTAI through a programme or workshop, we may use your information to administer the activity and create agreed group-level insights. Our interests are in operating and evaluating the programme and understanding participation and outcomes. We use aggregation, suppression and other controls where appropriate to reduce the risk of individuals being identified.

Fairness and bias monitoring

The data we use: Optional demographic information you choose to provide, which may include age, gender and, where collected, information such as ethnicity or neurodivergence.

Our lawful basis: Consent. Where the information is special category data, we also rely on your explicit consent.

What this means in plain English: Providing this information is optional. We use it separately from your individual assessment to compare outcomes between groups and help us check whether HAPTAI operates fairly. It is not used to calculate your individual scores.

In some programmes, optional demographic information may also be used to produce group-level insights about the cohort. Where this applies, we will explain this before you provide the information and apply the relevant programme reporting and aggregation controls.

Analytics and platform improvement

The data we use: Information about how HAPTAI is accessed and used, including online identifiers and usage information collected through analytics technologies.

Our lawful basis: Consent where required

What this means in plain English: We use this information to understand how HAPTAI is used and identify usability or technical improvements. See section 10.

Defending legal claims and complying with legal requirements

The data we use: Relevant account, communications and activity records.

Our lawful basis: Legitimate interests and/or legal obligation, depending on the circumstances

What this means in plain English: We may need information to establish, exercise or defend our legal rights, or where the law requires us to use or disclose it.

Keeping your account available during periods of inactivity

The data we use: Account history and HAPTAI profile/assessment information.

Our lawful basis: Legitimate interests

What this means in plain English: We keep your account available for a limited period so that you can return to your profile and report without starting again. See section 7.

What happens if you don't provide your data?

You are not under a legal obligation to provide us with personal information. However, we need some information to provide HAPTAI:

Account information: Without an email address and the information needed to create your account, we cannot provide you with a HAPTAI account or send your report.

Assessment information: We need enough evidence in your profile to generate a meaningful HAPTAI assessment and report. You do not have to use every profile section, connect every external service or answer every optional question.

Optional information: Connected accounts, optional questions, demographic information and the career-opportunity preference are optional. Choosing not to provide them will not prevent you from keeping your HAPTAI account, although it may mean that particular information cannot contribute to your assessment.

4. Who We Share Your Information With

We do not sell your personal information.

A. Programme, Workshop and Outreach Partners

If you join HAPTAI through a programme, workshop or similar activity run with another organisation, we will explain separately how your information will be used for that activity.

Different programmes can operate in different ways.

Some programmes receive group-level information only. Where that applies, the partner does not receive access to your individual HAPTAI account, assessment inputs, interview transcript, uploaded files, individual scores or report.

We use aggregation and, where needed, suppression or other controls to reduce the risk of individuals being identified from group-level reporting.

Where programme-specific rules prohibit particular information or uses, we apply those restrictions to that programme.

Other programmes or assessments may involve individual-level results. Where that applies, we will explain what the relevant organisation receives before or when you take part.

Your separate choice to hear from THG about career opportunities does not by itself authorise us to give an identifiable copy of your HAPTAI profile or report to a programme partner or employer.

B. Recruitment and Assessment Partners

HAPTAI may be used as part of a recruitment, internship, talent-assessment or other candidate-assessment process.

Depending on the process, we may use your HAPTAI profile and assessment results to assess how your skills and aptitudes compare with particular roles or opportunities.

We may also provide the organisation running that process with relevant information.

Depending on the arrangement, this can include:

- your name, username or email address;
- whether you have created or completed your HAPTAI profile or report;
- relevant HAPTAI scores, skills and aptitudes;
- persona, role-match, vacancy match or Team Assessment information; and
- a relevant HAPTAI, Vacancy Match or Team Assessment report.

We will explain the relevant purpose and information sharing in the invitation or other privacy information provided for the particular recruitment or assessment process.

We do not share your raw AI interview transcript or original uploaded project or CV files with a recruitment or assessment partner unless we have separately explained that sharing to you.

Where another organisation receives information for its own recruitment or assessment purposes, it has its own responsibilities under data protection law for how it uses and retains that information.

Changing your HAPTAI career-opportunity preference or closing your HAPTAI account does not automatically delete information that has already been provided to another organisation for a separate recruitment or assessment process.

C. Our Service Providers

We use trusted service providers to help us operate HAPTAI.

These include providers of:

- cloud hosting and infrastructure;
- AI processing;
- email and communications services;
- analytics and technical monitoring; and
- other technology and support services needed to operate the platform.
- Our service providers process personal information for the services they provide to us and subject to appropriate contractual and security requirements.

D. Professional Advisers, Legal Authorities and Business Changes

We may also disclose personal information where reasonably necessary:

Professional advisers: such as our lawyers, auditors or insurers, where needed for legal or professional advice;

Legal and regulatory requirements: where we are required to disclose information to a court, regulator, law-enforcement body or other competent authority, or where disclosure is otherwise lawful and necessary to protect our legal rights; and

Business changes: if we sell, transfer or reorganise all or part of our business, subject to appropriate safeguards for your information.

5. International Data Transfers

We use technology providers in the UK, the EEA and the United States to operate HAPTAI.

Our production platform is hosted using cloud infrastructure in the EEA. Some of the services we use to process HAPTAI information, including AI services, may process personal information in other countries. In particular, some HAPTAI AI processing may take place in the United States using Microsoft Azure.

Where personal information is transferred outside the UK or EEA, we use the transfer mechanism required by the applicable data protection law. For transfers to US organisations covered by the relevant Data Privacy Framework, this can include the UK Extension to the EU-US Data Privacy Framework for UK transfers and the EU-US Data Privacy Framework for EEA transfers. Where an adequacy arrangement does not apply, we use approved contractual safeguards, such as the UK International Data Transfer Agreement or Addendum and/or EU Standard Contractual Clauses, together with any required assessment of the protections available for the information.

You can contact us at haptai.support@thg-v.com if you would like further information about the safeguards we use for international transfers.

Our AI service providers do not use candidate information to train their underlying provider models.

6. How HAPTAI Uses AI and Automated Scoring

HAPTAI uses AI to analyse some of the information you provide and help build your HAPTAI profile, scores and report.

How AI contributes

Depending on the type of information, AI may:

- sort or categorise information you submit so that it can be used in the relevant parts of your HAPTAI profile and assessment;
- interpret open-ended answers;
- identify skills and aptitudes;
- analyse project information, documents or other assessment material;
- assign or contribute to weights used for aptitude evidence;
- identify skill levels; and
- in some cases contribute to confidence values used when combining assessment evidence.

Those AI outputs are combined with other information and scoring rules used by HAPTAI.

This means AI does not simply summarise your answers. For some parts of the assessment it can contribute directly to the assessment result you see.

For example, some open-ended game answers and project information are evaluated using AI. Other information may be extracted by AI and then scored using separate HAPTAI rules.

Your report and role assessments

Automated processing is used to generate HAPTAI scores, insights, personas and role-related information for your report.

Those scores can also contribute to vacancy matching, role matching and Team Assessment outputs where HAPTAI is being used for a recruitment or assessment process.

In some recruitment or assessment processes, HAPTAI scores may be used to compare, rank or filter candidates before the organisation running the process decides who to consider further.

HAPTAI does not itself make an employer's final hiring decision, but its scores and reports can influence which candidates are considered further.

If you use HAPTAI as part of a partner programme or specific recruitment or assessment process, we will explain separately how your results are used for that activity.

Where a programme partner receives group-level results only, your individual assessment outputs are not provided to that partner for individual recruitment or assessment decisions.

Human review

If you think something in your HAPTAI assessment has been interpreted incorrectly, you can ask us to review it by emailing haptai.support@thg-v.com.

We may need to look at relevant information in your profile, the AI output and the resulting assessment in order to investigate your request.

We also carry out manual testing and quality checks to help assess whether HAPTAI and its AI-supported assessment processes are working as intended. This does not mean that every AI-generated output is reviewed by a person before it is used.

7. How Long We Keep Your Data

Active accounts

We keep your HAPTAI account, profile and assessment information while you are actively using the platform.

Inactive accounts

Our current HAPTAI retention approach is based on a 24-month inactivity period.

If you have not used HAPTAI for 12 months, we may contact you to remind you that your account remains open and give you an opportunity to return to it or close it.

Unless we need to retain particular information for another lawful reason, we delete or anonymise relevant personal information at the end of the applicable retention period.

AI processing records

Our AI routing provider retains prompts and outputs for up to 14 days before they are deleted. Some of our technology providers may also retain limited information for security and abuse-monitoring purposes in accordance with their applicable service and retention arrangements.

Closing your account

You can use Delete My Account in Privacy Settings to close your HAPTAI account.

Closing your account stops you from using that account and starts our account-closure process. It should not be understood as meaning that every record connected with your use of HAPTAI is immediately erased.

If you want us to erase personal information that we hold about you, you can also contact haptai.support@thg-v.com. We will deal with your request in accordance with your rights under data protection law.

Closing your HAPTAI account does not automatically delete information that has already been provided to another organisation for a separate recruitment or assessment process. That organisation is responsible for dealing with its own copy in accordance with data protection law.

Anonymous information

We may retain information that has been irreversibly anonymised so that it no longer identifies you. Truly anonymous information is no longer personal information under data protection law.

8. Your Online Safety

We have designed HAPTAI as a private assessment environment.

No Social Interaction: Other HAPTAI candidates cannot see your profile, message you or comment on the information you provide.

Limited Access: Access to candidate information within THG is limited to authorised people who need it to operate, support, secure, test or appropriately review HAPTAI.

Assessment Information: We do not share your raw AI interview transcript or original uploaded project or CV files with a programme, recruitment or assessment partner unless we have separately explained that sharing to you. Partners may receive relevant HAPTAI scores and reports where the relevant programme or assessment involves individual-level reporting.

Data Minimisation: We ask you not to include contact details or unnecessary personal information in interview answers, projects or documents. HAPTAI also provides reminders at relevant points in the assessment.

Support and Review: If something about the assessment concerns you, or you believe information has been interpreted incorrectly, contact us at haptai.support@thg-v.com.

9. Security: Protecting Your Information

We use technical and organisational measures designed to protect your personal information against unauthorised access, loss, alteration or disclosure.

These measures include:

- encryption of personal information in transit and at rest;
- access controls designed to restrict access to people who have an appropriate business need;
- security, logging and monitoring measures;
- controls over connected services and credentials; and
- due diligence and contractual requirements for service providers that process personal information on our behalf.

HAPTAI does not allow other candidates to view your profile or contact you through the platform.

We keep our security measures under review as the platform and the technology we use develops.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to make HAPTAI work and to understand how the platform is being used.

Strictly Necessary Technologies

Some cookies and similar technologies are required for HAPTAI to operate, for example to let you sign in securely and maintain your session.

We do not need your consent to use technologies that are strictly necessary to provide the service you request.

Analytics

With your permission where required, we may use Google Analytics 4 (“GA4”) to understand website and platform usage, completion and usability.

We do not use GA4 to analyse your HAPTAI assessment answers, scores or report content, and we do not send your email address or other directly identifying information to GA4.

Programme and Registration Links

We may use programme-specific or segmented HAPTAI links so that people who register through a particular link can be associated with the correct programme, assessment or cohort.

We may also use a link-management service to provide branded links and understand overall link use.

Link or click information is not used to analyse your HAPTAI assessment answers, scores or report.

Your Choices

Where we rely on your consent for cookies or similar technologies, you can change your choices through the relevant cookie controls.

You can also configure your browser to block or delete cookies, although some HAPTAI functionality may not work properly if you block technologies that are necessary for the service.

11. Service Messages and Career Opportunities

We distinguish between messages needed to operate or administer HAPTAI and optional communications about career opportunities.

Service Messages

We may send you emails needed to provide or administer your HAPTAI account or an assessment, programme or other activity you have joined.

These can include:

- account verification and security messages;
- password resets;
- report-ready notifications; and
- standard reminders to complete your profile or generate your report where this is relevant to an assessment or programme you have joined.
- These messages are not marketing where they are limited to providing or administering the relevant service or activity.

Career Opportunities

At sign-up, you can choose whether you are happy for THG to use your HAPTAI profile to identify relevant cyber career opportunities and contact you if there may be a match.

This choice is optional and is off by default.

If you opt in, we may use relevant skills, aptitudes and other information in your HAPTAI profile to identify opportunities that may be relevant to you and contact you about them.

If you do not opt in, we will not use your HAPTAI profile in THG talent or opportunity searches carried out for the purpose of identifying you for placements, and we will not contact you about those opportunities on the basis of that preference.

Your career-opportunity preference does not itself authorise THG to give your identifiable HAPTAI profile or report to an employer, recruiter or programme partner.

Changing Your Choice

You can switch off the career-opportunity preference at any time through Privacy Settings.

This will stop future THG opportunity matching and contact based on that preference without deleting your HAPTAI account.

Third-Party Marketing

We do not give your contact details to third-party organisations so that they can send you their own marketing.

12. Your Legal Rights

Data protection law gives you a number of rights. The rights that apply can depend on the circumstances and the reason why we are using your information.

You may have the right to ask us to:

Access your personal information and receive a copy of it;

Rectify personal information that is inaccurate or incomplete;

Erase your personal information where the right to erasure applies;

Restrict how we use your personal information in certain circumstances;

Object to particular processing, including processing based on our legitimate interests;

Port certain personal information to you or another organisation where the portability right applies; and

Withdraw consent at any time where we rely on your consent. Withdrawing consent does not affect processing that took place before you withdrew it.

Where data protection law applies additional safeguards to a significant decision made solely by automated processing, these can include rights to receive information about the decision, make representations, obtain human intervention and contest the decision.

Exercising your rights

To exercise your rights, contact us at haptai.support@thg-v.com and give us enough information to identify you and understand your request.

We may need to ask you for additional information to confirm your identity or clarify what you are asking us to do.

We will respond within the time required by data protection law. In most cases this is within one month, although the law allows additional time in certain circumstances.

Making a data protection complaint

If you think we have not handled your personal information properly, you can make a data protection complaint to us at haptai.support@thg-v.com.

We will acknowledge a data protection complaint within 30 days of receiving it and will take appropriate steps to investigate and respond without undue delay. We will keep you informed about the progress of the complaint where appropriate.

You also have the right to complain to the Information Commissioner’s Office (“ICO”). If EU data protection law applies to you, you may also have the right to make a complaint to the data protection supervisory authority in the EU country where you live, work or consider that an infringement has taken place.

13. Your Duty to Inform Us of Changes

It is important that the personal information we hold about you is accurate and current.

Please keep us informed if your personal information, such as your email address, changes during your relationship with us.

You can update your details through your Profile Settings where that functionality is available.

14. Changes to this Privacy Notice

We keep this Privacy Notice under regular review.

If we make a significant change to how we use your personal information, or introduce a new use that is relevant to you, we will bring that change to your attention where appropriate. Depending on the change, we may do this by:

sending an email to the address associated with your account; and/or

placing a prominent notice on HAPTAI.

This version was last updated on 28 September 2026.

Historical versions can be obtained by contacting us.

‍