Privacy Policy

Effective Date: 30.10.26

This Privacy Policy explains how SAMMI-Select Ltd (“we”, “us”, “our”) processes personal data when you use:

  • The SAMMI® live interview platform
  • SAMMI-3®, the universal design version of SAMMI®
  • The MySammi™ practice interview platform
  • Our website (www.sammi-select.co.uk)

PLEASE ONLY REFER TO THE PRODUCT SECTION RELEVANT TO YOU

1. Who We Are

SAMMI-Select Ltd is a company registered in England and Wales.
Registered office: Ashcombe Court, Woolsack Way, Godalming, Surrey GU7 1LQ
Company number: 12028269
Email: info@sammi-select.co.uk

For data protection purposes, our role differs depending on which service you are using (see below).

2. SAMMI® Live Interview Platform (Assessed Interviews)

Data Controller

If you are invited to complete an interview using SAMMI® for a job, apprenticeship, or education programme:

  • The employer, university, or recruiting organisation that invited you is the Data Controller.
  • SAMMI-Select Ltd acts as a Data Processor, providing the technical interview platform.

The recruiting organisation determines:

  • The purpose of the interview
  • The scoring criteria
  • The assessment process
  • The hiring or admissions decision

Please refer to the privacy notice of the recruiting organisation for full details of how your data is used.

What Data We Process (as Processor)

On behalf of the recruiting organisation, we may process:

  • Video and audio recordings of interview responses
  • Unique candidate identifier or access code
  • Technical data (IP address, browser type, device type, system logs)
  • Interview scores and assessor feedback, where recorded.
  • Automatically generated interview transcripts, where transcription is enabled.

We process this data solely to provide the interview platform service. Where transcription is used, audio from interview responses is processed using OpenAI Whisper (whisper-1) through an external API to generate text transcripts. The recruiting organisation remains the Data Controller.

Transcription and Candidate Privacy

SAMMI® uses unique candidate access codes rather than names or other directly identifying information. Candidate names and other directly identifying account information are not transmitted to OpenAI for transcription.

Where transcription is enabled, interview audio is processed using OpenAI Whisper (whisper-1). Transcripts are generated without candidate names or other identifying account information being supplied to OpenAI. Sammi-Select applies data minimisation measures to reduce the risk of candidate identification.

Although candidate account identifiers are not shared, interview audio may constitute personal data and is therefore processed in accordance with applicable data protection requirements and the contractual safeguards described in Section 6.

Lawful Basis

The lawful basis for processing interview data is determined by the recruiting organisation (Data Controller).
We process data under a contractual agreement with that organisation.

Data Retention

Interview recordings are retained according to the instructions of the recruiting organisation and deleted securely after the agreed retention period.

3. SAMMI-3® (Universal Design Version of SAMMI®)

SAMMI-3® is a universal design version of the SAMMI live interview platform. It provides all applicants with access to built-in personalisation and accessibility features as standard, rather than requiring individual adjustments to be requested.

These features may include adjustable interface settings, display preferences, and other user-controlled accessibility tools designed to improve usability and reduce barriers during interviews.

The same categories of personal data described above (including video and audio recordings, candidate identifiers, and technical data) are processed when SAMMI-3® is used. The recruiting organisation remains the Data Controller and determines the purpose of the interview, scoring criteria, and selection decisions. Where transcription is used, SAMMI-3® also uses OpenAI Whisper (whisper-1) through an external API, as described for SAMMI® above.

SAMMI-Select does not use accessibility or personalisation settings to profile candidates or make automated decisions.

4. MySammi™ Practice Interview Platform

Data Controller and Data Processor

MySammi™ is provided through organisations that purchase licences and make the platform available to individuals accessing their employment, education or support services.

For routine interview-practice activities, the organisation providing access will generally act as the Data Controller, determining the purpose for which MySammi™ is used.

Sammi-Select Ltd acts as the Data Processor, providing the platform and processing personal data on behalf of the organisation in accordance with its documented instructions and applicable data protection agreements.

Practice Recordings – Privacy by Design

MySammi™ is designed to protect user privacy and maintain control over personal information.

  • Practice video recordings are generated locally and remain under the user's control.
  • Users can download their recordings directly to their own devices.
  • Sammi-Select does not access, download, store or retain practice video recordings.
  • Video recordings are not sent to the AI model.

AI-Generated Feedback

MySammi™ uses OpenAI Whisper (whisper-1) to generate transcripts of practice interview responses. Audio is securely transmitted to the transcription service through an external API. Video recordings remain under the user's control and are not stored by Sammi-Select or transmitted to the large language model.

The resulting transcripts are processed using Llama 4 Maverick, hosted through AWS Bedrock in the US East (us-east-1) region by default, with IBM watsonx available as an alternative, to generate personalised interview feedback.

Zero data retention is not currently configured for these external AI services. Processing and any retention by these providers are governed by their applicable contractual and data protection arrangements.

What Data We Process

To provide MySammi™, we may process:

  • Audio from practice interview responses, transmitted to an external transcription service to generate text transcripts.
  • Automatically generated transcripts of practice interview responses.
  • AI-generated feedback based on those transcripts.
  • Unique user access codes.
  • Limited technical information, including IP addresses, browser and device information, and system logs.

Users are not required to provide their names or email addresses to access MySammi™, unless these are collected separately for an agreed purpose.

Practice video recordings remain under the user's control and are not stored by Sammi-Select.

Interview responses may contain personal information voluntarily disclosed by users, including information about their health, disability or other personal circumstances. Such information is processed only as necessary to provide the relevant service and in accordance with applicable data protection requirements.

Research and Evaluation

Sammi-Select may undertake research and evaluation to assess MySammi™'s accessibility, usability, effectiveness and impact on interview preparation and employment readiness.

All research involving human participants will be submitted to an appropriate Research Ethics Committee for review and approval before commencement.

Where personal data is collected for research or evaluation, participants will receive clear information explaining what data will be collected, how it will be used, the applicable lawful basis, who will have access and how long it will be retained.

Participation in optional research or evaluation activities will be voluntary and will not affect access to MySammi™ or the support provided by the participating organisation.

Depending on the arrangements, Sammi-Select may act as an independent Data Controller or Joint Controller with a research or delivery partner for these activities.

Data Retention and Security

Sammi-Select does not retain MySammi™ practice video recordings. Audio is processed for transcription and transcripts are processed for AI feedback through the external services described above. Candidate data stored by Sammi-Select is retained for a maximum of two years from the date of upload, with deletion managed through AWS lifecycle policies. A different retention period may be agreed on request. External service providers may have separate retention arrangements.

Limited technical information is retained only for as long as necessary for operational and security purposes.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration.

5. Website Data & Cookies

When visiting our website, we may collect:

  • IP address
  • Browser and device information
  • Functional loginTime session cookie

Our website uses only a functional loginTime session cookie to support login and session functionality. We do not use analytics or advertising cookies.

You may manage cookie preferences via your browser settings.

6. International Transfers

Where personal data is processed outside the UK, appropriate safeguards are implemented in accordance with UK data protection law.

MySammi™ uses AWS Bedrock in the United States (us-east-1) by default for Llama 4 Maverick, with IBM watsonx available as an optional alternative. OpenAI Whisper is used for transcription across SAMMI®, SAMMI-3® and MySammi™.

Where transcription is enabled within SAMMI®, interview audio is securely transmitted to OpenAI Whisper (whisper-1) for transcription. Candidate names and other directly identifying account information are not supplied to OpenAI as part of this process. Data minimisation measures are applied to reduce the risk of candidate identification.

Sammi-Select Ltd has entered into a signed Data Processing Addendum (DPA) with OpenAI, dated 28 October 2026, which incorporates the European Commission's Standard Contractual Clauses (SCCs), together with the UK International Data Transfer Addendum.

These contractual safeguards govern international transfers of personal data and include requirements relating to:

  • Processing personal data only in accordance with documented instructions.
  • Maintaining appropriate confidentiality and data security measures.
  • Applying contractual obligations to authorised subprocessors.
  • Protecting personal data transferred outside the UK in accordance with applicable data protection legislation.

The relevant provisions are contained in Sections 2.1, 2.3, 2.5 and 4.2, and Schedule 1, Section 8, of the signed OpenAI DPA.

Further information about these safeguards is available on request by contacting support@sammi-select.co.uk.

7. Data Security and your Data Protection Rights

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration.

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights, where applicable:

  • Right of access: To request a copy of the personal data held about you.
  • Right to rectification: To request correction of inaccurate or incomplete personal data.
  • Right to erasure: To request deletion of your personal data in certain circumstances.
  • Right to restrict processing: To request that the use of your personal data is limited in certain circumstances.
  • Right to object: To object to certain types of personal data processing.
  • Right to data portability: To request that certain personal data is provided to you or transferred to another organisation.
  • Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.
  • Right to complain: To raise concerns with the Information Commissioner's Office (ICO).

‍

8. Exercising Your Rights

For SAMMI® and SAMMI-3®, requests relating to personal data, interview assessments or recruitment decisions should be directed to the recruiting organisation acting as Data Controller.

For MySammi™, requests relating to routine interview-practice activities should generally be directed to the organisation that provided access to the platform. Sammi-Select will assist that organisation in responding to requests in accordance with applicable data protection requirements.

Where Sammi-Select acts as an independent Data Controller, including for certain research, evaluation or website activities, please contact:

Email: support@sammi-select.co.uk

We will respond to requests for which we are responsible within one month, subject to any applicable extensions permitted under UK GDPR.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO):

Website: www.ico.org.uk

We encourage you to contact us first so that we have an opportunity to address your concerns.

9. Age Restriction

Our services are intended for individuals aged 14 years or older. We do not knowingly provide access to individuals under the age of 14.

Where users are under 18, we take appropriate measures to protect their personal data in accordance with applicable data protection legislation, including additional safeguards where required.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on our website.