Last updated October 8, 2026․
1. Scope
1.1 Oiketos Oy provides B2B tools for executive selection and assessment․ Companies use them for their own leadership appointments, and executive search firms use them in client assignments․ The organization conducting the selection manages the search and appointment decision․
1.2 This document describes personal data Oiketos processes on a customer’s behalf․ The applicable data processing agreement defines the processing instructions and contractual duties․
1.3 Oiketos’s own website, business contact, account administration, billing and marketing data are covered by the Oiketos Privacy Policy․
2. Controller and processor responsibilities
2.1 The customer determines the purpose of its executive selection or assessment and the personal data it provides․ Oiketos processes that data on the customer’s behalf under its instructions and the applicable data processing agreement․
2.2 When the customer is the controller, Oiketos acts as its processor․ When an executive search firm acts as a processor for its client, Oiketos acts as a subprocessor․ These roles depend on the actual responsibilities for the processing․
2.3 The controller is responsible for the lawful basis, information given to participants and candidates, and decisions about their personal data․ The agreement defines Oiketos’s processing responsibilities and assistance to the customer․
3. Data and processing purposes
3.1 Depending on the product and the information supplied, customer data may include participant identities, role requirements, responses, candidate information and assessment results․
3.2 Processing serves the customer’s requested product functions, such as developing leadership requirements or evaluating relevant capabilities․
3.3 The customer is responsible for providing information that is relevant to the assignment and that its organization is entitled to share․
4. Access and retention
4.1 The customer’s instructions and applicable agreement govern access, retention, return and deletion of personal data․
5. AI services and subprocessors
5.1 Oiketos uses OpenAI for AI-supported product functions․ Where submitted content contains personal data processed on the customer’s behalf, OpenAI acts as a subprocessor for that processing․
5.2 Under OpenAI’s API data controls, API inputs and outputs are excluded from model training by default․ Training use requires an explicit opt-in by the API account holder․ Data retention and processing locations depend on the service and its configuration․
5.3 The applicable data processing agreement identifies authorized subprocessors and the conditions for their use, including processing locations and safeguards for transfers outside the European Economic Area․ Changes follow the agreement’s notification and authorization arrangements․
6. Requests and contact
6.1 Participants and candidates should direct requests about their selection or assessment data to the organization identified as the controller in the privacy information provided to them․
6.2 Oiketos assists its customer with requests concerning data processed on the customer’s behalf․
6.3 Contact Oiketos Oy at privacy [at] oiketos [dot] com for questions about this document or personal data processed through the products․