Privacy Policy
Last updated: October 15, 2026
This is an English translation of the original German privacy policy. The German version is available here and serves as the authoritative reference in case of any discrepancies.
1. Key Points at a Glance
- The party responsible for processing your data is the organization that provided you with the access link — not us as the technical service provider.
- We process your data on behalf of and on the instructions of this organization. Only pseudonymized test data — without your name — is used under our own responsibility for quality assurance and the further development of our assessments.
- No tracking or marketing cookies are used.
- Your data is stored on servers in Germany and is not shared for advertising purposes.
- Your report includes an AI-assisted interpretation. For this purpose, your test responses and scores — without your name and without any other identifying information — are transmitted to a provider based in the USA.
- For access, deletion, or other requests, please contact the organization that provided you with the access link directly. Please address any objection to the use for further development of our assessments to us.
Detailed information can be found in the sections below.
2. Data Controller and Our Role
Data Controller
The controller responsible for processing your personal data within the meaning of the GDPR is the organization from which you received the access link to this assessment (hereinafter: the "client"). This organization determines the purposes and means of the data processing and is your point of contact for all data protection matters relating to your participation.
Our Role: Processor
We, Dr. Nick Stratemeyer (Psychometric Services), provide the technical platform for conducting the psychometric assessments and process your data on behalf of and on the documented instructions of the client. Our activities are carried out on the basis of a data processing agreement (Article 28 GDPR).
The one exception is the use of pseudonymized test data described in Section 5 under "Further Development of the Assessments". For this processing, we ourselves are the controller within the meaning of the GDPR:
Dr. Nick Stratemeyer – Psychometric Services
Rotdornweg 9
58093 Hagen
Germany
mail@psychometric-services.de
For technical questions about the platform, you can reach us at the same address.
For requests concerning your data (access, deletion, withdrawal), please contact your client directly — not us. The exception is an objection to the use for the further development of the assessments (see Section 9).
3. Technical Infrastructure and Hosting
Server Location
The platform is operated on servers provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. All servers are located in Germany. When you visit the website, server log files are automatically recorded (browser type, operating system, referrer URL, IP address, timestamp). This processing is carried out on the basis of Article 6(1)(f) GDPR (legitimate interest in the technically secure provision of the platform). A data processing agreement is in place with IONOS.
For email operations, we use webgo GmbH, Heidenkampsweg 81, 20097 Hamburg, Germany. A data processing agreement is in place with webgo.
AI Service
For the AI-assisted interpretation in the report, we use an AI language model provided by Anthropic PBC, San Francisco, USA. Details can be found in Section 6.
4. General Information
TLS Encryption
All data transmission is encrypted via HTTPS (TLS). This means that your entries cannot be read by third parties.
No Tracking Cookies
This platform does not use any tracking or marketing cookies. No analysis of your user behavior for advertising purposes takes place.
Technically Necessary Session Storage
To technically conduct the assessments, an entry is created in your browser's session storage. This is automatically deleted as soon as you close your browser.
5. Conducting the Online Assessments
Purpose of Processing
Your data is processed in order to conduct the psychometric assessment and to provide the client with a results report. The specific purpose arises from the context in which the access link was provided to you.
Note: The assessments are designed for work-related questions and are not suitable for clinical diagnosis or the determination of health data.
Data Processed
The following data is processed as part of the assessment:
Provided by you:
- Your name
- Voluntary demographic and job-related information (e.g., gender, age, span of control)
- Your answers to the assessment questions
Recorded automatically:
- Timestamp of participation
- Internal participation ID (technical identifier)
Of your personal details, only your name is required so that the client can match the report to your participation. The demographic and job-related information is voluntary; you may leave it out. It is used exclusively for research on and norming of the assessment (see "Further Development of the Assessments"), is not part of the results report, and is not transmitted to the client.
Results Report and Storage
Based on your responses, an individual results report is created and made available to the client. Your name and the report file are stored in encrypted form on our servers for 90 days after completion of the assessment. After this period, your name is automatically removed from our database and the report file is automatically deleted. The remaining data — test responses, demographic and job-related information, calculated scores, and the contents of the report including the AI-assisted interpretation — remains stored in pseudonymized form, that is, linked only to a technical identifier. Only the client can link this identifier to you personally; we are then no longer able to do so.
Please note: The client receives the results report and is responsible for its further processing and retention. If you wish to access your report, please contact the organization that provided you with the access link.
Further Development of the Assessments
We use test data in pseudonymized form — that is, without your name — for quality assurance, research, norming, and the further development of our assessments. This includes your test responses, your demographic and job-related information, and your answers to individual questions that serve to trial new questions and are not included in your results report.
We ourselves are the controller for this use (contact details in Section 2). The legal basis is Article 6(1)(f) GDPR (legitimate interest in the quality, norming, and further development of psychometric assessments). It takes place on the basis of a separate agreement with the client. We retain the pseudonymized data for as long as it is needed for these purposes. You may object to this use (see Section 9).
6. AI-Assisted Interpretation in the Report
The results report includes an automatically generated, narrative interpretation of your test scores, which is produced using an AI language model (provider: Anthropic PBC, San Francisco, USA). It is part of the report commissioned by the client; the legal basis is determined by the client as the controller. The parts of the report that were generated with the help of artificial intelligence are marked accordingly in the report.
Data minimization: Only your test responses and the scores calculated from them are transmitted to the AI service — without your name, without your demographic and job-related information, and without any other information that identifies you. The provider is unable to link these values to your person.
Transfer to a third country: The provider is a company based in the USA. Processing takes place outside the European Union, in particular in the USA. As a US company, the provider is subject to US law, which may under certain conditions allow US authorities to access data. A data processing agreement based on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) is in place with the provider.
Storage by the provider: The provider processes the transmitted values to generate the narrative feedback and automatically deletes them within 30 days. Longer storage occurs only where required by law or where a request is classified by the provider's safety systems as violating its usage policy. The provider does not use the data to train its AI models.
Please note: The AI-assisted interpretation is an automatically generated, descriptive summary of your test scores. It does not make any decision about you; decisions in connection with the assessment are made solely by the client.
7. Consent and Its Documentation
Your Consent
At the beginning of the assessment, you will be asked to agree to a checkbox. With this confirmation, you consent vis-à-vis the client to your data being processed to the extent described and to the results report being made available to the client. The legal basis for the processing is determined by the client as the controller.
Documentation of Consent
To fulfill the client's accountability obligations (Article 7(1) GDPR), we document on behalf of the client:
- Time of confirmation
- Text of the consent declaration displayed
- Version of the privacy policy at the time of consent
- Internal participation ID
- The client's project reference
- Anonymized IP address (last octet truncated)
- Browser type (user agent)
The IP address is processed only briefly to generate the anonymized entry and is not stored thereafter. The consent records are retained for three years in order to fulfill accountability obligations.
Withdrawal
You may withdraw your consent at any time with effect for the future. To do so, please contact the organization from which you received the access link. Alternatively, you can contact us at mail@psychometric-services.de; we will forward your request to the client.
8. Retention Period
- Name: 90 days after completion of the assessment, then automatic deletion.
- Report file: 90 days after completion of the assessment, then automatic deletion.
- Test responses, demographic and job-related information, calculated scores, and report contents (including the AI-assisted interpretation): after deletion of your name, in pseudonymized form for as long as needed for quality assurance and the further development of the assessments.
- Consent records: three years.
Any retention periods beyond this are governed by the instructions of the client as well as any statutory obligations.
Deletion requests and objections: If you request the deletion of your data or object to the use for the further development of the assessments, we delete your participation in full — including test responses, other information, calculated scores, and report contents — provided the data can still be linked to you personally.
Our database is backed up daily in encrypted form. In these backups, a deletion takes effect no later than when their retention period of 30 days expires.
9. Your Rights
As a data subject, you have the following rights vis-à-vis the controller — that is, vis-à-vis the organization from which you received the access link:
- Right of access to the data processed (Article 15 GDPR)
- Right to rectification of inaccurate data (Article 16 GDPR)
- Right to erasure of your data (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object to processing (Article 21 GDPR)
- Right to withdraw consent given (Article 7(3) GDPR)
To exercise these rights, please contact the organization from which you received the access link directly. As a processor, we are obliged to support the client in handling such requests.
Objection to the use for the further development of the assessments: We ourselves are the controller for this processing. An objection (Article 21 GDPR) is therefore to be addressed to us, not to the client: mail@psychometric-services.de. We will then delete your participation in full, provided the data can still be linked to you personally. Once your name has been removed (90 days after completion of the assessment), we ourselves are no longer able to establish such a link (Article 11 GDPR).
If you contact us directly about other matters, we will forward your request to the client.
10. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority — in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
For services offered in Germany, the supervisory authority of the relevant federal state is often responsible.