Scholars Privacy Notice
Last Updated: 06.08.2026
Version: 2.3
1. Introduction – Who We Are
Scholars (“Scholars”, “we”, “our”, or “us”) is a workforce management and contractor onboarding platform operated by iMerit Inc. For purposes of applicable data protection laws including the EU General Data Protection Regulation (GDPR) and UK GDPR, iMerit Inc., 160 West Santa Clara St., Suite 600, San Jose, CA 95113, United States acts as the Data Controller for personal data processed through the Scholars platform. This Privacy Notice explains how we collect, use, disclose, store, and protect personal data when individuals create an account, participate in assessments, or interact with the Scholars platform.
Data Protection Officer (DPO)
iMerit Inc. has appointed a Data Protection Officer.
DPO Contact: dpo@imerit.net
You may contact the DPO for any data protection concerns or regulatory inquiries.
2. Scope
This Privacy Notice applies to:
- Individuals who create a Scholars account
- Contractors participating in projects
- Assessment participants
- Visitors to Scholars websites or services
- Individuals interacting with Scholars support systems
3. Minimum Age & Children's Privacy
Scholars is intended only for adults.
Users must be at least 18 years old or the legal age of majority in their jurisdiction, whichever is higher.
To enforce this requirement:
- Users must confirm their age during account registration.
- Age verification may be conducted through identity verification providers where required.
Scholars does not knowingly collect personal data from individuals under 18.
If we become aware that a minor has submitted personal data:
- the account will be terminated
- associated personal data will be deleted promptly.
Parents or guardians who believe a minor has submitted information may contact: dpo@imerit.net
4. Categories of Personal Data We Collect
We collect only the personal data necessary to operate Scholars and support onboarding, compliance, and participation.
A. Identity and Account Information
- First and last name
- Email address
- Phone number
- Country of residence
- Date of birth
- Account identifiers
- Username and authentication credentials
Purpose: account creation, platform access, security. Name, email address, and phone number may also be used by internal Operations teams to coordinate scholar outreach and onboarding-status tracking, subject to the safeguards described in Sections 7, 9, and 12.
B. Professional and Qualification Information
- Education history
- Work history
- Professional skills
- Portfolio links (GitHub, LinkedIn, etc.)
- Resume / CV uploads
Purpose: eligibility evaluation for projects and assessments.
C. Assessment and Media Data
Where assessments require monitoring or verification:
- Profile photograph (optional)
- Proctoring video recordings
- Proctoring audio recordings
- Screen recordings during assessments
- Session activity logs
- Behavioral integrity signals
Purpose: assessment integrity, fraud prevention.
D. Technical and Platform Usage Data
- IP address
- Device identifiers
- Browser metadata
- Session logs
- Platform activity logs
- Security event logs
Purpose: platform operation, security monitoring, fraud detection.
E. Compliance Status Metadata
Scholars receives status indicators only from third-party providers. Examples include:
- Identity verification status (verified / failed)
- Background check completion status
- Payment onboarding status
- Tax form completion status
Scholars does not store underlying sensitive documents.
5. Sensitive Data We Do NOT Store
Scholars does not store or directly process:
- Government ID numbers
- Passport images
- Full background check reports
- Tax forms
- Bank account numbers
- Payment card information
These are processed directly by trusted third-party service providers.
Scholars receives only verification results or workflow status.
6. Cookies and Tracking Technologies
We use cookies and similar technologies to support platform functionality and security.
Types of cookies used:
Strictly Necessary Cookies
Required for:
- authentication
- session management
- security
Functional Cookies
Used to:
- remember user preferences
- maintain platform usability.
Analytics Cookies
Used to:
- analyze performance
- improve platform experience.
Where required by law (including EU and UK GDPR / ePrivacy rules), non-essential cookies are deployed only after consent.
Users may manage cookies through browser settings or platform controls.
7. How We Use Personal Data & Legal Bases (EEA / UK)
Under GDPR we rely on the following legal bases:
| Processing Purpose | Legal Basis |
|---|---|
| Account creation and participation | Contractual necessity (Art. 6(1)(b)) |
| Eligibility evaluation | Contractual necessity |
| Identity verification and background screening | Legal obligation / contractual necessity |
| Payment and tax coordination | Legal obligation |
| Fraud prevention and platform security | Legitimate interest (Art. 6(1)(f)) |
| Assessment proctoring and integrity | Legitimate interest and/or consent |
| Platform analytics and improvement | Legitimate interest |
| Regulatory compliance | Legal obligation |
| Operational outreach and onboarding-status coordination (internal Ops dashboard) | Legitimate interest (Art. 6(1)(f)) for email-based outreach; explicit consent required for phone-based outreach |
Where legitimate interest is relied upon, we perform a balancing test to ensure user rights are not overridden.
8. Proctoring & Biometric Processing
Scholars does not intentionally conduct biometric identification for the purpose of uniquely identifying individuals.
However, certain identity verification providers may perform facial comparison or biometric verification during identity checks.
Where this occurs:
- processing is limited to identity verification or fraud prevention
- explicit consent may be requested where legally required
- biometric data is retained only by the verification provider
- Scholars receives verification status only
Scholars does not maintain biometric databases.
9. Third-Party Service Providers
Certain platform functions rely on independent providers:
| Provider | Function |
|---|---|
| Trolley | Payment onboarding and tax processing |
| Veriff | Identity verification |
| Certn | Background screening |
| HubSpot | Support communications and service desk |
| Google Workspace (BigQuery, Sheets, Apps Script) | Internal, access-restricted operational dashboard for scholar outreach and onboarding-status tracking |
These providers process certain personal data directly under their own privacy obligations.
Scholars maintains data processing agreements and contractual safeguards with these providers.
10. Automated Decision-Making
Scholars does not make solely automated decisions that produce legal or similarly significant effects.
Automated systems may be used to:
- flag suspicious platform activity
- generate compliance status indicators
- identify potential fraud patterns.
Final decisions affecting participation or eligibility involve human review.
Where automated tools materially impact users, individuals may request human intervention or explanation.
11. International Data Transfers
Scholars operates globally.
Personal data may be processed in:
- United States
- European Union
- Other jurisdictions where our service providers operate.
Where international transfers occur we implement safeguards such as:
- Standard Contractual Clauses (SCCs)
- contractual data protection commitments
- transfer impact assessments where required.
12. Data Retention
We retain personal data only for the period necessary to fulfill the purposes described in this Privacy Notice, including operational, contractual, legal, and regulatory requirements.
Retention periods depend on the type of data and the legal obligations associated with it.
| Data Category | Storage Location | Retention Period |
|---|---|---|
| User profile data (name, contact details, professional information) | GCP AlloyDB | Retained while the account remains active. Deleted or anonymized upon account deletion. |
| Resume / CV files | GCP Object Storage | Retained while the account remains active. Deleted upon account deletion. |
| Proctoring recordings | GCP Object Storage | Retained while the account remains active. Deleted upon account deletion. |
| Assessment related files | GCP Object Storage | Retained while the account remains active. Deleted upon account deletion. |
| Payment records | Trolley | Retained for up to 7 years to comply with financial and tax regulations. |
| Tax records | Trolley | Retained for up to 7 years to comply with financial and tax regulations. |
| Identity verification data | Veriff | Retained according to Veriff's retention policies. Scholars retains only verification status metadata. |
| Background check records | Certn | Retained according to Certn's retention policies. Scholars retains only completion status metadata. |
| Audit and security logs | Internal logging systems | Retained for up to 7 years for security monitoring, fraud prevention, and compliance audits. |
Operational outreach data (name, email, phone) used for internal scholar reach-out tracking Google Workspace (Sheets / Apps Script), access-restricted to Operations team Data refreshed from source and purged on a rolling basis on Scholar Data Deletion Request or termination of contract.
Inactive accounts may be deleted or anonymized after prolonged inactivity where legally permissible.
Where a user requests deletion of their personal data, Scholars will delete or anonymize personal data under its control unless retention is required to:
- comply with legal obligations
- maintain financial or tax records
- resolve disputes
- enforce contractual agreements
- detect or prevent fraud or abuse
This includes personal data copied into internal operational tools such as the outreach dashboard described in Section 4A.
Where deletion occurs, certain platform activity metadata may be anonymized rather than fully deleted to maintain system integrity and auditability.
Third-party providers (such as Trolley, Veriff, and Certn) maintain their own legally required retention schedules.
13. Data Security
We implement technical and organizational safeguards designed to protect personal data.
These include:
- Role-based access controls
- Multi-factor authentication
- Encryption in transit and at rest
- Secure storage of proctoring recordings
- Centralized security logging
- Infrastructure monitoring
- Regular access reviews
- Vendor security assessments
- SOC-aligned security practices
14. Data Breach Notification
In the event of a personal data breach, Scholars will:
- investigate and contain the incident
- notify relevant supervisory authorities where legally required
- notify affected individuals where the breach presents a risk to their rights and freedoms.
Notifications will occur within legally required timeframes (e.g., 72 hours under GDPR where applicable) through emails.
15. Your Data Protection Rights
Depending on your jurisdiction you may have the right to:
- Access your personal data
- Request correction
- Request deletion
- Restrict processing
- Object to processing
- Request data portability
- Withdraw consent
- Request human review of automated decisions
- Lodge a complaint with a supervisory authority.
We respond to verified requests within one month, extendable where legally permitted.
16. California Privacy Rights (CCPA / CPRA)
California residents may exercise the following rights:
- Right to know what personal information is collected
- Right to access collected personal information
- Right to request deletion
- Right to request correction
- Right to limit use of sensitive personal information
- Right to opt-out of sale or sharing of personal data
Scholars does not sell personal data.
Users exercising their privacy rights will not be discriminated against.
Authorized agents may submit requests on behalf of California residents.
17. Other International Rights
We also respect rights provided under other laws including:
- Brazil LGPD
- Canada PIPEDA / CPPA
- UK GDPR
- EU GDPR
These rights may include access, correction, deletion, and withdrawal of consent.
18. How to Exercise Your Rights
To submit a data request:
Email: dpo@imerit.net
Subject line: “Scholars Data Request”
Please include:
- Full name
- Account email
- Country of residence
- Description of your request
We may verify identity before fulfilling requests.
19. Changes to This Privacy Notice
We may update this Privacy Notice periodically.
Where material changes occur we will:
- notify users within the platform
- update the “Last Updated” date
- request acknowledgment where legally required.
20. Contact Information
Privacy Team iMerit Inc. 160 West Santa Clara St., Suite 600 San Jose, CA 95113
Email: dpo@imerit.net