1. Data Controller
Controller of the personal data:
Alexey Morozov (OSVČ: self-employed sole trader)
Na Folimance 2155/15, 120 00 Praha 2 – Vinohrady
Czech Republic
Company ID (IČO): 21955409 · VAT ID (DIČ): CZ8405282292 (VAT-identified person; not a VAT payer)
Registered with the Municipal Authority of Prague 2 (Úřad městské části Praha 2)
Email: support@iqtest.quest
2. Personal Data Processed
The data processed depends on how the Platform is used:
Test Session Data
| Data | Purpose | Retention |
|---|---|---|
| Session identifier (UUID) | Saving the progress of the test | 12 months |
| Test responses and response times | Calculating the scores | 12 months |
| Age group | Selecting the test version and the norms | 12 months |
| Language | Displaying content in the selected language | Session |
Purchase Data
| Data | Purpose | Retention |
|---|---|---|
| Email address | Delivering the report, the PDF and the receipt | 24 months |
| Payment transaction identifier | Order processing and refunds | As required by law |
| Country and region of the billing address (provided by the payment provider) | Determining the tax due on the sale (the country where the buyer resides) and whether the report may be sold in that country | As required by law |
| Country that issued the payment card (only for a billing address in a country where paid reports are not sold) | Confirming the country of such a sale before it is refunded | As required by law |
| Consent to reminder emails (optional box at checkout) | At most two emails about an unpaid report, 7 and 25 days after the checkout | 3 years |
| Name on the certificate (Premium, optional) | Printing on the certificate. While the public check page is switched on, the name is displayed with the certificate number, date, score and profile to persons who open the page by the certificate number; the page is not indexed by search engines and can be switched off on the report page. | 24 months |
Technical and Security Data
To protect the test against fraud and automated abuse, the following data is collected automatically:
| Data | Purpose | Retention |
|---|---|---|
| IP address | Security, fraud prevention, approximate region | 12 months |
| Browser type (user agent) | Detecting automated test attempts | 12 months |
| Answer times and completion time | Flagging invalid or assisted attempts | 12 months |
Visit Statistics
When a page of the website is opened, the server records visit statistics without cookies and without running scripts in the browser: the page address (with test, result, payment and certificate identifiers removed), the address of the page the visitor came from without its query string (for pages of this website only the website itself), the campaign tags of the link (utm_*), the site language, the primary language of the browser, the device class, the browser type (user agent), the time and whether a test was started or completed or a purchase made during the visit. The IP address is not stored: together with the browser type it is turned into a visitor code with a key that exists only for the current day and is then deleted. Codes of different days cannot be linked, and once the key is deleted a code cannot be traced back to an IP address. The statistics contain no names, email addresses, session, result or order identifiers, are not used to identify visitors and are not disclosed to third parties.
Not collected: names (except a name entered voluntarily for the certificate or in a contact message), postal addresses, telephone numbers and identity document numbers. Payment card data is processed exclusively by Stripe and is not received by the Service Provider.
3. Purposes and Legal Bases
Personal data is processed for the following purposes on the following legal bases:
- Test delivery and scoring: legitimate interest in providing the requested service (Art. 6(1)(f) GDPR)
- Report delivery: performance of the contract (Art. 6(1)(b) GDPR)
- Personal analysis and recommendations (Premium): performance of the contract; the analysis is generated by the Claude model in Amazon Bedrock (EU region) from depersonalised scores only (Section 5)
- Analytics: consent (Art. 6(1)(a) GDPR); Google Analytics (GA4) is loaded only after consent is given in the cookie banner; consent may be withdrawn at any time
- Fraud prevention: legitimate interest in protecting the integrity of the test (Art. 6(1)(f) GDPR)
- Visit statistics (Section 2): legitimate interest in understanding which pages and sources bring visitors to the website and in improving it (Art. 6(1)(f) GDPR). The interests and rights of visitors do not override this interest, because no cookies or scripts are used for this purpose, the IP address is never stored, the daily key behind the visitor code is deleted at the end of each day and the statistics are not used to identify visitors. Consent is not required, as no information is stored on or read from the visitor's device (Art. 5(3) of Directive 2002/58/EC). The visitor may object to this processing at any time (Section 6).
- Reminder emails about an unpaid report: consent given with the optional box at checkout (Art. 6(1)(a) GDPR); at most two emails are sent, 7 and 25 days after the checkout, and none once the report is paid; consent can be withdrawn at any time with the unsubscribe link in each email, which takes effect at once
- Testing versions of the website: a new test may be shown one of several versions of a price or a text, chosen at random when the test starts and stored with the test session; no cookie is set for this and no profile of the visitor is built: legitimate interest in improving the service (Art. 6(1)(f) GDPR)
- Taxes and accounting: the country determined from the IP address, the billing address and, where needed, the payment card is used to determine the tax due on a sale and whether the report may be sold in that country: legal obligation (Art. 6(1)(c) GDPR)
- Answering enquiries sent through the contact form (name if given, email address, topic, order reference if given, message): legitimate interest in answering enquiries (Art. 6(1)(f) GDPR) and, where an order is concerned, performance of the contract
4. Cookies & Local Storage
The Platform uses the following cookies and local storage entries:
| Cookie / Key | Type | Purpose |
|---|---|---|
| PHPSESSID | Essential | Session cookie: protection of forms against cross-site request forgery; deleted when the browser is closed |
| _locale | Essential | Language chosen on the site (12 months) |
| iq_test | Essential | Identifier of an unfinished test for resuming it in this browser (30 days from the last answer; deleted when the test is finished or started over) |
| iq_reports | Essential | Results opened in this browser, listed on the My reports page (12 months; can be cleared on that page) |
| iq_repeat | Essential | Discount on the report of a later test, set when the link from the purchase email is opened: a signed reference to the purchase (12 months) |
| cookie_consent | Essential | Local storage entry: the choice made in the cookie banner (180 days) |
| _ga, _ga_<id> | Optional | Google Analytics: usage analytics; set only after consent |
Essential cookies are required for the operation of the Platform. Analytics cookies are set only with explicit consent, which can be changed in the cookie banner at any time.
The visit statistics described in Section 2 use no cookies or local storage and do not depend on the choice made in the cookie banner.
5. Recipients
Personal data is disclosed to the following processors under data processing agreements:
- Stripe (payment processing): processes payment card data under Stripe's Privacy Policy and provides the Service Provider with the country and region of the billing address and, where needed, the country that issued the card.
- Google Analytics (GA4) (usage analytics, only with consent): Google Ireland Ltd.; Google's Privacy Policy.
- Amazon Web Services EMEA SARL, Luxembourg (Amazon Bedrock in an EU region with the Claude model by Anthropic; generation of the personal analysis, Premium only): receives the overall score, percentile, cognitive title, area scores, the bounds of the age group and the language of the report, without names, email addresses, IP addresses, session or order identifiers, exact age or answers. This data does not identify the test-taker. The data is processed in the EU and is not passed to Anthropic.
- Hosting provider: provides the servers on which the Platform runs and the data described in this Policy is stored.
- Sentry (Functional Software, Inc.; error monitoring, where enabled): receives technical error reports; email addresses are removed and IP addresses truncated before sending.
Personal data is not sold, rented or disclosed to third parties for marketing purposes.
Transfers Outside the EEA
Some processors may process data outside the European Economic Area (EEA):
- Google, Stripe and Sentry may process data in the United States. Such transfers are based on the EU–U.S. Data Privacy Framework or the Standard Contractual Clauses of the European Commission.
6. Rights of the Data Subject
The data subject has the following rights:
- Right of access: to obtain a copy of the personal data processed
- Right to rectification: to have inaccurate data corrected
- Right to erasure: to have personal data deleted
- Right to restriction of processing
- Right to data portability: to receive the data in a structured, machine-readable format
- Right to object to processing based on legitimate interests
- Right to withdraw consent at any time, without affecting the lawfulness of prior processing
Requests are sent to support@iqtest.quest and are answered within one month (Art. 12(3) GDPR).
7. Security
The Service Provider applies technical and organisational measures, including:
- encrypted (TLS) connections for all data in transit
- access-restricted databases and encrypted storage of service credentials
- payment processing exclusively by the PCI DSS Level 1 certified provider Stripe
- random session identifiers instead of user accounts
- logging of administrator actions
8. Retention
Personal data is retained for the following periods and deleted automatically every day:
- Tests without a payment: deleted 12 months after the last activity; an unfinished test is closed 30 days after the last answer
- Paid reports: available for 24 months after the last payment; then the answers, the IP address and browser data, the personal analysis and the certificate are deleted and the report is closed; the scores are kept with the payment records
- Payment records: 10 years from the last payment, as required by Czech tax law; then deleted together with the test scores
- Analytics data: Google Analytics data is retained for up to 14 months
- Visit statistics: 24 months; the browser type and the address of the page the visitor came from: 90 days
- Contact messages and the email delivery log: 12 months
- Consent records (including consent to reminder emails and its withdrawal): 3 years
- Log of administrator actions: 3 years; the IP address and browser data stored with an entry: 90 days
- Backups: deleted data remains in backups until the backup expires, at most 12 months; backups are used only for restoration
9. Children
The test is intended for test-takers aged 4 and older; test-takers aged 4–8 take it together with a parent or legal guardian. For a test-taker under 16, a parent or legal guardian reviews this Policy and consents to the processing on the test-taker's behalf before the test starts; the confirmation is recorded with the test session.
Only the data required to deliver and score the test is collected. No advertising is shown and no marketing profiles of children are created. A parent or legal guardian may exercise the rights under Section 6 on the child's behalf, including the right to erasure. Data of a child processed without the required consent is deleted upon notification to support@iqtest.quest.
10. Changes
This Policy may be amended to reflect changes in the processing or in applicable law. Material changes are announced on the website. The effective date at the top of the page indicates the current version.
11. Contact
Questions concerning this Policy and requests regarding personal data:
Email: support@iqtest.quest
Address: Na Folimance 2155/15, 120 00 Praha 2 – Vinohrady, Czech Republic
The data subject may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or with the supervisory authority of the Member State of residence.