Privacy policy

This policy explains what Assessmentcloud collects, why, how long we keep it, and the rights you have over it. It is written to be read, not skimmed past.

Who we are

Assessmentcloud ("we", "us") operates assessmentcloud.com, an organizational assessment platform. For data protection purposes we act as the controller for account and website data, and as a processor for assessment responses submitted by a customer's respondents. You can reach us at [email protected].

What we collect

• Account data. Your email address when you sign up, confirm it, or contact us, plus the source of the signup and standard technical logs (IP address, browser type).
• Assessment responses. Answers submitted by respondents to a customer's assessment: ratings, selections, and any free-text comments.
• Usage data. Aggregate analytics about how pages are used, collected with minimal identifiers.

How respondent data is handled

Respondent protection is structural, not a setting:

• Responses are anonymized in reports. Managers and administrators see scores and aggregates, never who answered what.
• Small groups are suppressed. Where a breakdown would cover fewer than five respondents, we do not show it, so nobody can be identified by elimination.
• Free-text comments are shown without names and shuffled so order does not identify the writer.
• Respondents do not need accounts, and we do not build advertising or cross-customer profiles from responses.

Why we process data (legal bases)

• Contract: operating your account and delivering assessments and reports.
• Legitimate interest: keeping the service secure, preventing abuse, and improving benchmarks with aggregated, de-identified scores.
• Consent: product emails you can withdraw from at any time.
• Legal obligation: records we must keep, such as invoices.

Benchmarks

Industry benchmarks are computed from aggregated, de-identified dimension scores grouped by sector and company size band. Individual companies and individual respondents are never identifiable in benchmark data.

Retention

Data	Kept for
Account email and signup record	Until you ask us to delete it
Assessment responses	For the life of the customer account, or until the customer deletes the assessment
Server logs	90 days
Contact messages	24 months

Sharing

We do not sell personal data. We share it only with processors needed to run the service (hosting, email delivery), each bound by a data processing agreement, and where the law requires it. A current list of subprocessors is available on request.

Your rights

Under the GDPR and similar laws you can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Email [email protected] and we will respond within 30 days. If a request concerns responses you submitted to a customer's assessment, we will route it with the customer, who controls that assessment. You can also complain to your supervisory authority.

Security

Data is encrypted in transit, access is role-restricted and logged, and production access requires multi-factor authentication. No system is perfectly secure; if an incident affects your data we will notify you as the law requires.

Changes

If this policy changes materially we will note it here with a new date, and for significant changes we will email account holders.