Candidate Terms, Privacy Notice & Consent

Version 2026-11-01 · Data controller: Virtusa · Contact: deliyot@virtusa.com

Summary: we collect your ID, a selfie, screen and webcam recordings, and your workshop activity only to verify your identity and assess this interview. Your data is never sold, never used to train AI models, and never used for any other purpose. It is deleted after 180 days, or sooner if you ask.

1. Purpose of processing

Your personal data is processed solely to (a) verify that you are the person invited to interview, (b) ensure the fairness and integrity of the assessment, and (c) evaluate your technical performance and share the results with the interview panel for this recruitment process only.

2. Data we collect

Identity data: your name, email address, an image of your government-issued ID and the details printed on it (name, date of birth, document type, issuing country, expiry date). The document number is stored only as a one-way keyed hash, used to prevent repeat attempts.
Biometric data: a live selfie and periodic webcam snapshots, and face templates derived from them, used only to match you to your ID photo and confirm the same person stays present during the workshop.
Recordings: a recording of your entire screen and your webcam video (no audio) for the duration of the workshop.
Activity data: code you write, files, terminal commands and output, prompts to and replies from the AI assistant, deployments, API requests, and browser integrity signals (for example leaving the tab, leaving full screen, multiple displays, external pastes).
Technical data: IP address, browser/user-agent and timestamps, including a record of this consent.

3. Legal basis

We rely on your explicit consent, given below, and on our legitimate interest in running a fair recruitment process. Biometric data is processed only with your explicit consent. You may withdraw consent at any time (see section 8). Withdrawing consent before you finish means we cannot complete your assessment.

4. What we will never do

We will never sell, rent or trade your personal data.
We will never use your data for any purpose other than this recruitment assessment. That includes marketing, profiling for other purposes, or training artificial-intelligence or machine-learning models.
We will not share your data with anyone outside the hiring panel for this role, except the processors listed below who act only on our instructions, or where the law requires it.

5. Automated processing

AI agents help with identity checks, proctoring and scoring. These outputs are advisory. A human interviewer reviews your scorecard and recordings before any hiring decision is made. You may ask for a human review of any automated outcome.

6. Processors & storage

Data is stored encrypted at rest on Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) and processed with Google Cloud Document AI and Gemini under enterprise terms that prohibit using customer data for model training. Recordings are reachable only through expiring, access-controlled links shared with the interview panel.

7. Retention

ID images, selfies, biometric templates and recordings are deleted 180 days after your workshop, or as soon as the recruitment process for this role closes, whichever comes first, unless the law requires us to keep them longer. Face templates used for matching are not stored permanently.

8. Your rights

Depending on where you live (for example under GDPR, UK GDPR, CCPA/CPRA, BIPA or India's DPDP Act), you may access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Email deliyot@virtusa.com. We respond within 30 days. You may also complain to your local data-protection authority.

9. Workshop rules

Complete the workshop alone, on one monitor, with your entire screen shared and your camera on.
You may use the built-in Gemini assistant. You may not use other people, other devices, or other websites or tools.
Each person may take the workshop once. Using another person's identity is prohibited and will be reported.
Do not attempt to attack, escape or misuse the sandbox. Your code runs in an isolated container.