Privacy Policy (GDPR)

Controller and contact

The service is provided under the IQLabTest brand at iqlabtest.com. The controller’s full legal name, registered address, registration number, and applicable supervisory authority must be inserted here before commercial launch. Privacy requests can be sent to privacy@iqlabtest.com and general support requests to support@iqlabtest.com.

When an organization invites a candidate, that organization may be an independent controller for its recruitment purpose while IQLabTest processes data under its instructions. The organization must provide its own notice and lawful basis.

Data we process

Depending on the service used, we process account and contact data, first and last name, date of birth, language, assessment responses, timing and progress, calculated estimates and confidence ranges, certificate and verification identifiers, consent records, organization membership, support and privacy requests, security logs, and transaction records.

Payment details are handled through the configured hosted payment provider, currently Mollie when enabled. IQLabTest should receive payment status and identifiers rather than complete card or bank credentials.

Purposes and legal grounds

We use data only for specified purposes and apply the legal ground appropriate to each activity.

• Contract: deliver assessments, reports, certificates, account functions, and purchases.
• Consent: record candidate disclosures or optional processing where consent is genuinely required and can be withdrawn.
• Legitimate interests: secure the service, prevent abuse, keep proportionate audit records, resolve disputes, and improve reliability after balancing user rights.
• Legal obligation: retain or disclose records required by tax, accounting, consumer, or regulatory law.

Sharing and international transfers

Data may be shared with hosting, email, monitoring, payment, professional-adviser, and support providers only as needed and under appropriate contracts. Candidate result summaries may be shared with the inviting organization as disclosed before the assessment; individual answers are not intended to be shared.

The production operator must maintain an up-to-date processor list and document any transfer outside the EEA, including the relevant adequacy decision or safeguards such as Standard Contractual Clauses.

Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent without affecting earlier lawful processing and request human review of a disputed result. Contact privacy@iqlabtest.com; identity verification may be required.

You may complain to the supervisory authority in your habitual residence, workplace, or the place of an alleged infringement. The controller’s lead authority must be inserted before launch.