About us and the PersonalityWise platform (including, but not limited to ask-Olivia)

The PersonalityWise platform available at https://ask-olivia.io/ and/or the related AI (workplace) communications coach currently known as "Olivia" and provided through and available at https://www.ask-olivia.com (and also through .ai and .io extensions) (hereafter all jointly referred to as the “Platform”) is provided by PersonalityWise Limited, a private limited company incorporated and registered in England (company number 14128948) whose registered office is at The Old Police Station, Church St, Ambleside LA22 0BT (referred to as “PersonalityWise”, “us”, “we” and “our” in this privacy notice).

PersonalityWise is the controller of personal data collected through the Platform, which means we determine why and how we process the personal data.

If you have any questions about this privacy notice or our processing of your personal data, including any requests to exercise your legal rights in connection with your personal data, please contact us by email to privacy@personalitywise.ai or write to us at the address above.

Purpose of this privacy notice

This privacy notice is addressed to users of the Platform, which includes managers, employees, customer administrators and candidates of our employer clients and individual users (referred to as “users”, “you” and “your” in this notice).

The Platform is not intended to be used by children and we do not knowingly collect data relating to children.

This privacy notice aims to give you information about how PersonalityWise processes the personal data of users collected by the Platform.

Please read this privacy notice to understand how and why we use your personal data.

‍

1. Key terms used in this privacy notice‍

“Personal data” means any information about an individual person from which that individual person can be identified.  It does not include data that cannot be used to identify an individual person (i.e. data that has been effectively anonymised).

“Processing” means any operation carried out on personal data, including collection, use, storage, structuring, alteration, retrieval, consultation, combination, transmission, erasure or destruction.

“Special category personal data” means data that is deemed to be particularly sensitive or high-risk under data protection law, including data relating to health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, and genetic and biometric data.

2. Personal data processed by the Platform‍

The Platform processes the following types of data about users:

• Login Data:

This includes your email address and a password.

• Pre-questionnaire Data:

This may include your first name, last name, login name, age, email address, gender, ethnicity, English language level, employment type, job role, Industry, years of work experience, years with your current manager and confirmation of whether or not you have taken the PersonalityWise test before.

• Assessment Data:

Information relating to your personality, collected via the PersonalityWise psychometric assessment questionnaire.

• Survey Data:

Additional Background data separate to the pre-questionnaire and Assessment Data.

• Usage Data:

This includes the following information obtained from the device you use to access the Platform:

• Internet protocol (IP) address
• browser type, version and user agent
• operating system
• time zone setting, timestamp and location
• browser plug-in types and versions
• the pages you view and your page path
• page response times
• download errors
• length of visits to certain pages and page interaction information (such as scrolling, clicks, mouse-overs, and methods used to browse away from the page)
• the operating system and platform and other technology on the device you use to access the Platform

We collect this personal data using cookies, server logs and other similar technologies.  See section on ‘Cookies’ below for further information about our use of cookies and similar technologies on the Platform.

• Payment Data

Only in the exceptional event we request payment from you as an individual consumer user, subject to a specific corresponding agreement with you, we may need to collect your payment (card) details.

• Transaction Data

Only in the exceptional event we request payment from you as an individual consumer user, subject to a specific corresponding agreement with you, we may have to create and store records about your payments to us.

• Marketing and communications Data

This includes your preferences in receiving marketing from us and your communication and cookie preferences.  You can indicate your marketing and communication preferences using the ‘My Account’ section of your account on the Platform.  We will automatically collect your cookie preferences using a cookie preference tool when you access the Platform (see section on ‘Cookies’ below for further information about our use of cookies on the Platform).

• Support Data

If you contact us to request support in using the Platform, we will obtain information about you depending on what method you use to contact us:

• For requests by email, we will obtain the email address you use to contact us, any name you provide, any personal data you include in your message and the time and date the email was sent.

• For requests by phone, we will obtain your phone number, any name you provide, any personal data you mention in the conversation and the time and date of the call.

• For live chat, we will obtain any name you provide and certain technical data about your device, any personal data you mention in the conversation and the time and date of the chat.

‍

3.1 Special category personal data

We may collect special category personal data from users as Pre-Questionnaire Data.  Provision of such special category personal data is optional and is only provided by the user (as the data subject) themselves.  We collect special category personal data on ethnicity and other demographic information in order to produce statistics.  Such statistics assist in ensuring our assessments remain ethical and neutral, and are fair in terms of differing nationalities, race and cultures, supporting diversity and equity.  We only use such data in aggregated and anonymised form for our research and product development purposes.

3.2 If you fail to provide personal data

If you don’t provide your Login Data, you won’t be able to use the Platform.

If you don’t provide your Pre-Questionnaire Data, or do not provide accurate Pre-Questionnaire Data, we will not be able to carry out our product evaluation, research and development purposes effectively or accurately and may not be able to send you important service-related messages.

If you don’t provide your Assessment Data by answering all the questions, the Platform will not be able to generate a personality profile for you.  If you answer the questions inaccurately, this is likely to result in the Platform creating an inaccurate and unhelpful personality profile.

3.3 Our purposes for processing personal data

We have set out our purposes for processing personal data via the Platform, the data we use for those processing purposes and our legal bases for carrying out those processing purposes below.

Test

‍

4. Our marketing practices

We may use your Pre-Questionnaire Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if youhave not opted out of receiving that marketing via the “My Account” page ofyour account on the Platform.

You can ask us [or third parties if and when applicable] to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

If you opt out of receiving marketing messages, please note that this will not stop you receiving our service-related messages, which do not include marketing content.

‍

5.1 Other purposes for processing

In addition to the purposes set out above, we may alsoprocess personal data if and to the extent necessary for the followingpurposes:

• Establishing,  exercising or defending legal claims.

Our  legitimate interests in defending legal claims brought against us, enforcing  claims against others and protecting and asserting our legal rights and the  legal rights of others.

• Obtaining  or maintaining insurance cover, managing risks or obtaining professional  advice.

Our  legitimate interests in protecting our business against risks.

• Compliance  with a legal obligation such as a statutory or regulatory obligation or an  order of a court, government body or regulator.

Compliance  with a legal obligation.

• Protecting  a person’s vital interests (e.g. in response to serious injury or illness or  threat to life).

Protection  of vital interests.

• Sale or  merger of our business.

Our  legitimate interests in growing, securing and increasing the value of our  business.

‍

5.2 Change of purpose

We will only use your personal data for the purposes forwhich we collected it, unless we reasonably consider that we need to use it foranother reason that is compatible with the original purpose in compliance withdata protection laws.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

6. Profiling

The Platform uses Assessment Data to generate a psychological profile for each user who undertakes the psychometric assessment.  It then compares the profiles of two users to produce “Intersights”.

7. Recipients  of personal data

Platform users

Different categories of users have access to data stored onthe Platform as set out below:

Basic  users

Basic  users can access:

 
• their own “My Account” Data and resulting personal psychological profile (“My Profile”)
 
• any Intersights generated by the Platform involving themselves and another user
 

Extended  Users

Extended  Users can access: 

 
• their own “My Account” Data
 
• their personal psychological profile (“My Profile”) if they have undertaken the       assessment
 
• Intersights generated by the Platform involving any candidates, employees or managers of or       related to their department, division, team or group within the organisation
 
• Directory of profiles generated by the Platform involving any employees or managers of their       department, division, team or group within the organisation
 

Admin  users

Admin  users can access:

 
• their own “My Account” Data
 
• their personal psychological profile (“My Profile”) if they have undertaken the       assessment
 
• any Intersights generated by the Platform involving themselves and another user if they have       undertaken the assessment
 
• Intersights generated by the Platform involving any candidates, employees or managers of their       organisation
 
• Directory of all users in the organisation and their ‘My Profile’ output
 

PersonalityWise support staff

Our support staff will have access to all data collected,stored and processed by the Platform, to the extent required in connection withproviding support to users.

Service providers

We use various service providers in connection with ourprocessing of personal data for the purposes set out in this privacy notice,and those service providers receive, have access to or otherwise processpersonal data about users as a result.

We have contracts with our service providers to ensure thatthey process user personal data in accordance with applicable data protectionlaw, including providing appropriate security measures.  If theirprocessing involves a transfer of personal data outside the UK or EU, we alsoensure there is an appropriate safeguard in place to protect the personal datatransferred to them in compliance with applicable data protection laws.

Below we have set out the service providers we use, theservices they provide, the countries in which they process personal data and,if personal data is transferred outside the UK or EU, the safeguard in place toprotect the transferred personal data.

‍

‍

‍

If you would like to see a copy of any of the safeguardsreferred to above, please contact privacy@personalitywise.ai.

Other organisations

Additionally, we may disclose personal data to otherorganisations or individuals where disclosure is necessary for any of thepurposes set out above, for example:

• If we are under a duty to disclose or share personal data in order to comply     with any legal obligation.
• In order to enforce or apply the terms of any agreement to which we are a     party.
• In connection with a merger or sale of our business or our acquisition of     another business, in which case the new owners may use your personal data     in the same way as set out in this privacy notice.
• To protect the rights, property, or safety of PersonalityWise, our customers,     Platform users or others.

In all cases, we will only share personal data with suchrecipients where and to the extent necessary for the relevant processingpurpose and in accordance with applicable data protection law.

We require all third parties to whom we disclose personaldata to respect the security of your personal data and to treat it inaccordance with applicable law.

8. Transfers of personal data outside the UK and EU

The Platform and the data processed by the Platform iscurrently stored and hosted in an Amazon AWS datacentre in the UK.  The UKis deemed to provide adequate protection for personal data by the EuropeanCommission pursuant to its Decisionon the adequate protection of personal data by the United Kingdom - GeneralData Protection Regulation | European Commission (europa.eu).

We have explained in the ‘Recipients of personal data’section above when we transfer this data to our service providers and whatsafeguards are in place to ensure that the transferred data is protected inaccordance with applicable data protection laws.  If you would like to seea copy of any of these safeguards, please contact privacy@personalitywise.ai.

If we have to transfer personal data to other third partiesoutside the UK or EEA, we will ensure that that the data is protected to anequivalent standard as under UK and EU data protection law and complies withthe rules relating to international transfers under those laws.  This mayinclude:

• Only     transferring personal data to countries or organisations that have been     deemed to provide an adequate level of protection for personal data by the     European Commission (under an Adequacy Decision) or the UK government (under an Adequacy Regulation).
• For     recipients not covered by an Adequacy Decision or Adequacy Regulation,     using the Standard Contractual Clauses approved by the European Commission     or the International Data Transfer Agreement or UK Addendum approved by the UK government.

9. Data security

We use appropriate technical and organisational security measures to prevent your personal data from being accidentally or unlawfully destroyed, lost, altered, or accessed or disclosed in an unauthorised way.

We have put in place procedures to deal with any personaldata breach and will notify you and any applicable regulator of a breach wherewe are legally required to do so.

The overview of measures and procedures are available onrequest from privacy@personalitywise.ai.

10. Data retention

Our retention periods

We will only retain your personal data for as long asnecessary to fulfil our legitimate purposes, including for the purposes ofsatisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personaldata, we consider the amount, nature and sensitivity of the personal data, thepotential risk of harm from unauthorised use or disclosure of the personaldata, the purposes for which we process the personal data and whether we canachieve those purposes through other means, and the applicable legalrequirements.

The retention periods we apply to the different types ofdata described in this privacy notice are set out below.

 
• Login Data: 
 

We keep  this for as long as you have an account on the Platform.

 
• Pre-questionnaire Data:
 

We keep  this for as long as you have an account on the Platform.

 
• Assessment Data:
 

We keep  this for as long as you have an account on the Platform.

 
• Survey Data
 

We keep  this for as long as you have an account on the Platform.

 
• Usage Data:
 

We keep  this data for as long as you have an account on the Platform, although we  keep usage reports derived from Usage Data, which do not enable us to  identify individual users for an indefinite period of time.

 
• Payment Data
 

To the  extent applicable, we keep this as long as there are outstanding payment  obligations and for financial and tax record keeping purposes as dictated by  applicable law.

 
• Transaction Data
 

To the  extent applicable, we keep this as long as there are outstanding transactions  and/or payment obligations and for financial and tax record keeping purposes  as dictated by applicable law.

 
• Marketing and       Communications Data
 

We keep  this for as long as you have an account on the Platform.

 
• Support Data
 

We only  keep emails, phone records and live chat records relating to support requests  to the extent required by law or proper functioning of the platform.

Retention of anonymous data

We may keep the data and statistics that we derive fromAssessment Data for our research, evaluation and development purposes describedabove in an anonymous format that does not enable us or any third party toidentify individual users, for an indefinite period.

Deleting your personal data

In some circumstances you can ask us to delete personal datarelating to you that we hold as an erasure request.  See the ‘Your legalrights’ section below for further information.

11. Your legal rights

Your rights

You have various rights as a “data subject” under dataprotection laws in relation to your personal data.  You have the right to:

• Request access to your personal data (commonly known as a "data subject access request").  This enables you to receive a copy of the personal data we hold about you along with     information about our processing of it.
• Request rectification of your personal data.  This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data.  This enables you to ask us to delete or remove personal data relating to you in the following scenarios: (a) if we no longer need them for our processing purposes; (b) if our processing is based on your consent and you withdraw consent; (c) if you have successfully exercised your right to object to processing (see below); (d) if we have processed your information unlawfully or if we are required to erase your personal data to comply with a legal     obligation.  Please note that we may not always be able to comply with your request of erasure for specific legal reasons which we will notify to you, if applicable, at the time of your request.
• Object to processing of your personal data.  This enables you to object to our processing of your personal data that we carry out on the legal basis of a legitimate interest on grounds relating to your     particular situation, in which case we must stop processing your personal data unless we can demonstrate that we have compelling legitimate grounds to process your information that override your interests, rights and freedoms or we need to process the data for the establishment, exercise or defence of legal claims.  You also have the right to object where we are processing your personal data for direct marketing purposes, in which case we must stop using your personal data for those purposes.
• Request restriction of processing of your personal data.  This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) you have contested the accuracy of personal data and we need time to verify its accuracy; (b) if our use of the data is unlawful but you do not want us to erase it; (c) if we no longer require it for our processing purposes but you need us to hold the data to enable you to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request transmission of your personal data to you or to a third party     (known as “data portability”).  This enables you, or a third party     you have chosen, to receive your personal data in a structured, commonly     used, machine-readable format.  However, this right only applies     where the controller’s processing is based on the legal basis of consent     or performance of a contract.  We do not use consent or performance     of contract as the legal basis for any of our processing via the Platform     except for obtaining user consent for the use of non-essential cookies,     which does not produce data in a format that we can transmit.  
• Withdraw consent to the processing of your personal data.  This enables you to withdraw your consent at any time if we are relying on your consent as the legal basis to process your personal data.  However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.  We do not use consent as the legal basis for any of our processing via the Platform except for the use of non-essential cookies.  If you withdraw your consent to that processing, this will not affect your use of the Platform.
• Complain to a supervisory authority - you can complain about our processing of your personal data to a data protection authority.  The UK supervisory authority responsible for regulating our processing of personal data is the Information Commissioner's Office ("ICO") – see Data protection complaints | ICO for details of how to complain to the ICO.

How to exercise your rights

If you wish to exercise any of your rights, please contactus by email to privacy@personalitywise.ai.

If you wish to complain to the ICO or another supervisoryauthority, we have provided the ICO’s contact details above or you can visitthe websites of another relevant supervisory authority to obtain their contactdetails.  We would, however, appreciate the chance to deal with yourconcerns before you approach the supervisory authority, so please considercontacting us in the first instance.

No fee usually required

You will not usually have to pay a fee to access yourpersonal data or exercise any of your other rights.  However, we maycharge a reasonable fee or refuse to comply with your request if it clearlyunfounded, repetitive or excessive.

What we may need from you

We may need to request specific information from you to helpus confirm your identity.  This is a security measure to ensure thatpersonal data is not disclosed to any person who has no right to receiveit.  We may also contact you to ask you for further information inrelation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within onemonth of our receipt of the request.  Occasionally it may take us longerthan a month if your request is particularly complex or you have made a numberof requests.  In this case, we will notify you and keep you updated.

12. Cookies

What are cookies?

Cookies are small text files containing an identifier (astring of letters and numbers) that are sent by a website server to yourbrowser when you visit a website and is stored in your browser.  Theidentifier is then sent back to the website each time your browser requests apage from the website server.  When you return to the website, the websitecan access its previously placed cookie to uniquely identify your browser.

Cookies do several different things such as recall yourpreferences on a website, help you view content more efficiently and improvethe overall user experience on a website.

Cookies may be either “persistent” cookies or “session”cookies: a persistent cookie will be stored by a web browser and will remainvalid until its set expiry date unless deleted by the user before the expirydate; a session cookie, will expire at the end of the user session, when theweb browser is closed.

Cookies can be set by the website operator (known as 1stparty cookies) or third parties such as analytics service providers (known as3rd party cookies).

Cookies may not contain any information that directlypersonally identifies a user, but personal data that we store about you may belinked to the information stored in and obtained from cookies.

For further information about cookies, including how to seewhat cookies have been set on your device and how to manage and delete them,visit https://www.allaboutcookies.org/.

How we use cookies on the Platform

We use cookies on the Platform for a number of differentpurposes:

• To recognise you whenever you visit the Platform (this speeds up your access to the Platform as you do not have to log in each time).
• To enable you to carry out basic functions on the Platform such as view content, interact with the content, take the psychometric assessment and send communications.
• To collect information about your device, including your IP address, operating system and browser type and obtain statistical data about users’ browsing actions and patterns, which we use to help us improve the Platform and deliver a better and more personalised experience to users.

Further detail about the cookies we use on the Platform andthe purposes of those cookies is provided below:

Cookies we may use on the Platform

Strictly necessary cookies: These cookies are necessary for the Platform to function and cannot be switched off. They are usually only set in response to actions made by you which amount to a request for services, such as setting your cookie preferences, logging in to your account, moving around the Platform or completing data fields. These cookies do not store any personally identifiable information. You can set your browser to block or alert you about this type of cookies, but some parts of the Platform will not then work.

Google Analytics

Performance cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of the Platform. They help us to know which pages are the most and least popular and see how users move around the Platform. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not be able to monitor the performance of the Platform.

Functionalcookies: These cookies enable the Platform to provide enhanced functionality and personalisation and to recognise you when you return to the Platform. This enables us to personalise the Platform for you and remember your preferences (for example, your choice of language or region). They may beset by us or by third party providers whose services we have added to the Platform. If you do not allow these cookies, then some or all of these services may not function properly. We currently do not use Functional cookies.

Cookies used by our service providers

We use Google and Hubspot to provide web analytics services.  These services use cookies to show us how visitors found and explored the Platform and how we can enhance their experience.  It provides us with information about the behaviour of our visitors (e.g. how long they stayed on the Platform, the average number of pages viewed) and also tells us how many visitors we have had.

Consent to use cookies

We will tell you about the cookies used on the Platform when you first log in to the Platform. Alternatively, cookies being used may be found in the “My Account” page of the Platform.   

You can also manage and delete cookies using your browser settings.  The methods for doing so vary from browser to browser, and from version to version.  You can obtain information about blocking and deleting cookies at All AboutCookies.

For further information about cookies and how to disable them you can also view the ICO’s webpage on cookies: https://ico.org.uk/for-the-public/online/cookies/.

13. How to contact us

If you have any questions or comments about this privacy notice, our processing of personal data or use of cookies or wish to exercise any of your rights, please contact us by email to privacy@personalitywise.ai orwrite to us at 55 Woodhill Avenue, Gerrards Cross, SL9 8DR.

14. Do you need extra help?

If you would like this notice in another format (forexample: audio, large print, braille) please contact us (see ‘How to contactus’ above).

15. Our registration as a controller

We are registered as a fee-paying controller with the UK Information Commissioner’s Office.  Our registration number is ZB523445

16. Changes to this policy

This notice was last updated on May 31 2023.  We may change this notice from time to time to reflect any changes in our processing practices or purposes.  Any changes we make to this privacy notice in the future will be posted on the Platform and, where appropriate, notified to users by e-mail or other suitable method.

‍