Privacy & data processing policy - assessments

Last updated: 4 April 2025

 

Our site outlines the services we provide. As part of delivering those services, we process personal data. We attach great importance to your privacy and are committed to protecting your personal data in line with the General Data Protection Regulation (GDPR). This policy explains what data we collect, how we use it, how long we retain it, and your rights under GDPR. We recommend that you read it carefully.

 

1. Introduction

Predictively provides AVA® behavioral assessments using the AVA® online platform. We are committed to protecting the privacy and security of personal data in compliance with the General Data Protection Regulation (GDPR). This policy explains how we collect, use and protect personal data when conducting the assessments.

This policy applies to individuals taking the AVA® assessment via Predictively, including employees and candidates of our clients and direct assessment participants.

 

2. Our role under GDPR

Predictively acts as a Data Controller when conducting the AVA® assessments. We determine the purpose and means of data processing and ensure compliance with GDPR (EU) 2016/679 and applicable EU data protection laws.

 

3. What personal data do we collect?

When you take the AVA® assessment via Predictively, we process the following data:

  • Identification data: name, email address, phone number, job title, and gender (optional).

  • Assessment data: responses to assessment questions, resulting behavioral analysis.

  • IP address region flag: when you access the AVA® assessment platform, your IP address is briefly checked by a third-party service to determine whether you are located in the EU. This process does not store your full IP address and is used only to apply the correct privacy safeguards based on your location. This service is provided by IPStack, a company based in Austria, selected specifically for its alignment with EU data protection standards. This is done in line with the principles of data minimization and transparency, as set out in Articles 5 and 13 of the GDPR.

We do not collect sensitive personal data (e.g., health, political beliefs, race, religion) as part of the AVA® assessment process.

 

4. How we use personal data

Your assessment data is processed for the following purposes:

  • To generate behavioral insights based on the AVA® methodology.

  • To provide results to you and, if applicable, to your employer, the company requesting your assessment, or our client.

  • To improve our services by analyzing aggregated, anonymized data.

Predictively does not use your assessment results for automated decision-making or profiling without human involvement. The results are used as part of our professional services and are always interpreted in context.

 

5. Legal basis for processing

We process your personal data based on one or more of the legal bases listed in Article 6 of the General Data Protection Regulation (GDPR):

Consent (Article 6(1)(a)) – when you explicitly agree to participate in the assessment.
Legitimate interest (Article 6(1)(f)) – when we provide behavioral insights to our clients as part of our services.

 

6. Who has access to your data?

  • If your employer, client, or hiring company has an AVA® license and requests your assessment
    In this case, the company or organization that requested the assessment is the Data Controller and holds its own license agreement with AVA Assessment Associates, Inc. Predictively acts as a Sub-processor and performs the assessment via the AVA® platform under their folder and instructions. The organization is responsible for informing you of the purpose and legal basis for processing your data.
    If a coach or trainer is involved as part of their program, this still falls under the responsibility of the licensed organization.

  • If a client of Predictively requests your assessment but does not hold an AVA® license
    In this case, Predictively is the Data Controller and provides the assessment service directly to the organization. Your data is processed based on Predictively’s Privacy & Data Processing Policy and in compliance with GDPR.

    Both you and the client that requested the assessment will receive your results, provided there is a written agreement or confirmation between Predictively and that party and a clear purpose for processing.

  • Third-party service providers
    Predictively processes assessments through the AVA® platform, which uses trusted third-party service providers in compliance with GDPR. These providers act only on documented instruction and do not use your data for any other purpose.

 

7. How long do we store personal data?

We retain personal data for the following periods:

  • Contact data: 2 (two) years after last interaction for potential future collaboration or business opportunities. You can request deletion at any time.

  • Assessment results: 2 (two) years after completion (unless otherwise agreed).

After these periods, personal data is securely deleted or anonymized, in accordance with the GDPR.

 

8. Security measures

Predictively implements appropriate technical and organizational security measures to protect personal data in compliance with GDPR, including:

  • Secure access controls and authentication – ensuring that only authorized individuals can access assessment data.

  • Regular data security reviews and audits – reviewing systems, processes, and tools regularly to ensure compliance and security.

  • Internal security policies – defining and maintaining internal procedures to safeguard data.

Predictively processes data solely within its role as defined under GDPR law.

 

9. Your rights under GDPR

You have the following rights regarding your personal data and assessment results processed by Predictively:

  • Right to Access – you can request a copy of the personal data and assessment results Predictively has processed about you.

  • Right to Rectification – you can ask us to correct inaccurate or incomplete personal data.

  • Right to Erasure – you can request deletion of your personal data and assessment results. In some cases, deletion may be delayed or declined if the data is still required for contractual, legal, or legitimate business reasons. For example, if the assessment was requested by your employer or another client of Predictively, we may retain the data for a limited period to fulfill our agreement with them.

To exercise these rights, contact us at our email address:
privacy [at] predictively [dot] io

 

10. International data transfers

International data transfers Predictively operates in the EU and ensures that any international data transfers comply with GDPR regulations. Assessments are processed using the AVA® platform provided by AVA Assessment Associates, Inc., located in the United States. Data transfers to the U.S. are protected by Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46.

 

11. Changes to this policy

We may update this Privacy & Data Processing policy from time to time. We recommend reviewing it periodically for updates.

 

12. Children’s Privacy

Our services are not intended for children under the age of 16. We do not knowingly collect or process personal data from children.

 

13. Questions & Complaints

If you have any questions about how we process your personal data or wish to exercise your GDPR rights, you can contact us at:
Email: privacy [at] predictively [dot] io

 

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) via https://www.autoriteitpersoonsgegevens.nl.