PeakPersonality is dedicated to protecting your privacy and personal information. This Privacy Notice explains how we collect, use, store, and protect your personal data in compliance with the General Data Protection Regulation (GDPR).

Who is the Controller and Who is the Processor?

PeakPersonality is located in the Netherlands, Van Hogenhoucklaan 62, 2596 TG The Hague, and provides strengths profiles and coaching services aimed at professional athletes, teams, and organisations.

Depending on how you interact with us, roles are allocated as follows:

For Website Visitors & Contact Forms: PeakPersonality acts as the independent Data Controller for personal data collected through our website's contact features ("Let's Connect"), our cookies, and our marketing communications.

For Customer Relationships: PeakPersonality acts as the independent Data Controller for personal data of our customers' representatives that we process to administer our relationship with the customer.

For Services Provided to Organisations: The organisation acts as the Data Controller, as they determine the purposes and means of the processing. PeakPersonality acts as the Data Processor and processes your personal data strictly on behalf of and in accordance with the instructions of your organisation, under the Data Processing Agreement concluded with your organisation (the "DPA").

For PeakPersonality as Processor

On behalf of your organisation, personal data is processed for:

  • Producing strengths profiles to provide personalised individual and team insights.
  • Offering detailed feedback through coaching services to enhance personal and team performance.
  • Facilitating communication and providing customer support.

Additionally, data that has been fully and irreversibly anonymised may be processed by PeakPersonality for conducting statistical analysis and research to identify performance trends, validate our models, and continuously improve the quality and accuracy of our services. Anonymised data does not constitute personal data, and the GDPR no longer applies to it.

The legal basis for processing your personal data is determined by your organisation as the Data Controller. Your organisation is responsible for informing you of that legal basis and, where it relies on your consent, for obtaining it.

For PeakPersonality as Controller

Contact form: We process identification data (name, email, phone number, and message content) to respond to enquiries submitted through our website.

  • Legal Basis: This processing is based on our Legitimate Interest to respond to your business enquiries.
  • Retention: This data is kept for up to 1 year after our last communication, unless a commercial agreement follows.

Customer relationship: We process the contact details of our customers' representatives, contract documentation, correspondence, and invoicing and payment details to administer our agreements with our customers.

  • Legal Basis: This processing is based on our Legitimate Interest in administering our agreements with our customers and, for contract and invoicing records, on our legal obligations under Dutch tax and record-keeping law.
  • Retention: Contract-related data, such as invoices and agreements, may be retained for up to 7 years in accordance with Dutch tax and legal record-keeping obligations. Correspondence that forms part of these records is retained for the same period. Other correspondence and the contact details of our customers' representatives are retained for up to two years after the end of the customer relationship.

Non-essential cookies (e.g., analytics): Where you accept non-essential cookies via our cookie banner, this processing is based on your Consent. See "Do we Use Cookies?" below for further details.

Marketing outreach: Where we send you promotional communications, this processing is based on your Consent or, if you are a contact person of an existing customer and the communication concerns services similar to those your organisation has purchased, on our Legitimate Interest. You can opt out at any time, including through the link in each message.

Service providers: For the processing described in this section, we use Scaleway for hosting our website and delivering messages sent through our contact form, Google Workspace for email and document management, Google Analytics for website analytics, and Moneybird and Mailgun for issuing and sending invoices, and WhatsApp Business for messages you send us through the WhatsApp link on our website. Google Analytics is provided by Google Ireland Limited; transfers to Google LLC in the United States are covered by the Standard Contractual Clauses, and Google LLC is certified under the EU-U.S. Data Privacy Framework. WhatsApp Business is provided by WhatsApp Ireland Limited; transfers to WhatsApp LLC and Meta Platforms, Inc. in the United States rely on the EU-U.S. Data Privacy Framework.

Profiling & AI

Evaluating personal characteristics, as we do when producing strengths profiles, constitutes profiling under the GDPR.

For information on how we use automated models and artificial intelligence (AI) in our services, the logic involved, its significance and the envisaged consequences for you, and your right to human intervention, please refer to our separate AI & Profiling Privacy Policy.

Minor Athletes (Under 16)

Given our involvement in professional sports, athletes under the age of sixteen (16) may take part in our services. Where they do, the contracting organisation (such as the sports club) is responsible for ensuring that valid consent has been given or authorised by the holder of parental responsibility, as agreed in the DPA.

Who are the Sub-processors?

We engage the following sub-processors. Each sub-processor is bound by a written agreement imposing data protection obligations substantially equivalent to those in the DPA, save for the deviations stated in Annex 2 of the DPA. The sub-processors are also listed, with further detail, in Annex 2 of the DPA.

  • Scaleway: hosting and storage of our platform and its database, and sending invitations and system emails.
  • Google Workspace: company email and document management, including notes of coaching sessions.
  • Google Cloud (Vertex AI): generation of report text, podcast audio and the responses of our AI coach, within the EU.
  • Expo (United States): delivering push notifications and app updates to our app. Expo also uses technical information about your device, such as its IP address, for its own aggregate analysis, as an independent controller.

Your questionnaire responses are also sent for scoring to an external scoring provider outside the European Economic Area. This provider is not a sub-processor: it holds no means of linking the responses to you. How this works is explained in our AI & Profiling Privacy Policy.

International Data Transfers: Where personal data is transferred outside the European Economic Area (EEA), for example where a sub-processor is located there or provides support from there, PeakPersonality ensures that an appropriate transfer mechanism under the GDPR is in place, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCCs). The processing location of each sub-processor is set out in Annex 2 of the DPA.

What Data do we Process?

We process the following categories of personal data on behalf of your organisation, as set out in full in Annex 1 of the DPA:

  • Identification data: your name, contact details, and profile details such as gender and age group.
  • Professional and group affiliation data: your organisation or team, and your role or function level.
  • Questionnaire data: your responses to the questionnaire, the results, rankings and reports based on them (including generated text and audio), and the time at which you completed the questionnaire.
  • Coaching data: notes of coaching sessions in which you take part, and your conversations, goals and action items with our AI coach.
  • Account data: if you use your organisation's dashboard, for example as a coach or administrator, your name and email address; the device identifier used to send push notifications to you; and records of the emails we send you.

Special categories of personal data, such as health information, ethnic origin, or religious beliefs, are not intended to be processed.

How Long do we Keep Your Data?

We retain your personal data in an identifiable form for as long as we provide your organisation with our services, and for a subsequent period of two years, as agreed with your organisation in the DPA. Following this period, all personal data is either permanently deleted from our systems or irreversibly converted into anonymised data sets, which can no longer be associated with you.

This retention period applies to personal data we process on behalf of your organisation. It does not apply to personal data we process as Data Controller, which is described above, or to data we are legally required to retain for other purposes.

Notwithstanding the above, your organisation may at any earlier time, including on termination of its agreement with us, instruct us to delete or return your personal data, in accordance with Clause 13 of the DPA.

What are Your Rights?

Under GDPR, you have the right to Access, Rectification, Deletion, Restriction of Processing, Data Portability, Objection, and Withdrawal of Consent.

  • For Data Processed on Behalf of Your Organisation (including your questionnaire data): Because your organisation is the Data Controller, you must direct your privacy requests to your organisation. PeakPersonality will assist your organisation in responding to your request, as agreed in the DPA. If you contact us at info@peakpersonality.com, we will forward your request to the responsible contact person at your organisation.
  • For Data Processed by PeakPersonality as Controller (e.g., data submitted via our "Let's Connect" contact form, data relating to our customer relationships, cookies, or marketing communications): You may exercise the rights listed above directly with us by contacting info@peakpersonality.com. Unlike requests concerning data processed on behalf of your organisation, these requests will be handled by PeakPersonality directly and will not be forwarded to a third party.
  • Complaints: You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

Do we Use Cookies?

Yes, our website uses a limited number of cookies to ensure functionality and improve your user experience. A cookie is a small text file stored on your device. We categorise our cookies as follows:

  • Strictly Necessary Cookies: These cookies are essential for the website to function correctly and cannot be switched off. They are used to remember your cookie consent preferences and do not require your prior consent.
  • Analytics Cookies: These cookies help us understand how visitors interact with our website by collecting information about visits and reporting it to us through services like Google Analytics. We will only use these analytics cookies if you provide your consent by clicking "Accept all". If you choose to reject them, they will not be activated. Google Analytics retains this information for up to 14 months.

Changes to this Privacy Notice

This Privacy Notice may be updated periodically and communicated on our website.

Thank you for your trust in PeakPersonality.