Data processing agreement

Between you, the professional holding an account (the controller), and the operator of ProIQTest (the processor), under Article 28 of the GDPR. Accepted with the terms for professionals. Last changed 12 September 2026.

1. Subject and duration

The processor runs the ProIQTest on behalf of the controller for the people the controller tests, stores the results, and shows them back to the controller, for as long as the account exists.

2. Nature and purpose

Presenting the test, scoring it, storing the result, computing the analysis when the controller unlocks it, and displaying all of this to the controller. Nothing else. The data is not used for advertising, is not sold, and is not shared with third parties except the sub-processors below.

3. Data and data subjects

Data subjects are the people the controller tests. The data is: a label chosen by the controller, the age, the language, the sixty answers with the time spent on each, the score and its derived statistics, the date, and the IP address the test was taken from. The controller undertakes not to enter names, contact details or health information; the label field is limited to 32 characters to that end.

4. Instructions

The processor acts only on the controller's documented instructions, which are the functions of the service as offered. If the processor believes an instruction infringes the GDPR, it will say so.

5. Confidentiality and security

Access to the data is limited to the operator. The data is held on servers in the European Union, transported over TLS, and protected by the access controls of the account (password, signed links). Test links are single-use and expire after seven days.

6. Sub-processors

Hosting: StableHost (server in Amsterdam, Netherlands). The controller will be told of any change to this list and may object.

7. Assistance

The processor helps the controller answer requests from data subjects — access, correction, erasure — through the functions of the account, and by email where those do not suffice. Removing a person from the account detaches the label from their results at once.

8. Breach

The processor tells the controller of a personal data breach without undue delay after becoming aware of it, with what is known at the time.

9. End of processing

When the account is closed, the labels are removed from all results within 30 days. The results remain as an age and an answer sheet with nothing attached to a person.

10. Audit

The processor makes available the information needed to show compliance with this agreement and allows for audits, on reasonable notice, conducted by the controller or an auditor the controller mandates.