PRIVACY POLICY

Original effective date: 5 July 2019
Last updated: 21 August 2026

1. Scope and roles

This Privacy Policy explains how personal data are processed in connection with Quintaum assessments, diagnostic services, reports, related applications and service communications.

Quintaum d.o.o., Trnovski pristan 22, 1000 Ljubljana, Slovenia, identification number 8828008000 (“Quintaum”, “we”, “us” or “our”), provides standardised organisational and individual diagnostic services.

Where a Quintaum assessment is conducted for an organisation’s employees or other participants, the organisation for whose purposes the assessment is carried out generally acts as the data controller. Quintaum processes personal data as a processor or sub-processor, depending on the structure of the engagement.

Where a coaching, consulting or other authorised Quintaum partner arranges an assessment for its client, the partner’s data-protection role is determined by its actual processing responsibilities and the applicable contractual arrangements.

The data controller determines the purpose for which the assessment is carried out and the participants invited to take part. Quintaum provides its standardised assessment methodology, analytical processing and reports in accordance with the applicable engagement and documented instructions.

The relevant data controller is identified to participants through the assessment invitation, accompanying communication or information provided by that organisation. The controller is responsible for providing any additional controller-specific information required under applicable data protection law.

Service providers that process personal data on Quintaum’s behalf may act as sub-processors.

Quintaum may act as an independent controller for limited processing carried out for its own purposes, such as business communications, service administration, information security and compliance with legal obligations.

Questions concerning Quintaum’s processing of personal data may be submitted through our contact page at https://www.quintaum.com/contact

2. Personal data we process

Quintaum processes only personal data necessary to provide the relevant assessment and reporting services.

Depending on the assessment and collection method, this may include:

  • questionnaire responses relating to work, organisational experience, relationships, leadership, performance, change, resilience, work-life balance, well-being and other areas covered by the applicable Quintaum diagnostic;

  • limited demographic or contextual information relevant to the assessment;

  • organisational information associated with an access code, such as department, location, or another reporting category;

  • participant email addresses where necessary for invitations, administration or report delivery;

  • limited participation-status information, where personalised access codes are used;

  • access codes and related report information; and

  • limited technical, security and administrative information required to operate and protect Quintaum services.

Participant names and email addresses are not included in questionnaire responses.

Where Quintaum receives participant contact or organisational information before the assessment, it may be provided by the relevant client, partner or end-client organisation solely for purposes connected with assessment administration and communication.

3. Access codes, pseudonymisation and anonymity

Quintaum uses access codes to minimise the connection between participant identity and questionnaire responses.

Where a shared anonymous code is used, participants use the same access code and Quintaum does not maintain a mapping between individual participants and their responses.

Where a group or organisational code is used, responses may be associated with a defined group or reporting category without identifying an individual participant.

Where personalised access codes are used, each participant receives a unique code. Questionnaire responses contain the code but not the participant’s name or email address.

The separate file connecting personalised access codes with participant email addresses is held exclusively by Quintaum. It is stored separately and offline on secured local storage and is not stored in the questionnaire platform or provided to clients, partners or end-client organisations.

Personalised-code responses are treated as pseudonymised personal data while Quintaum retains information that allows the code to be associated with a participant.

Where information is irreversibly anonymised so that an individual can no longer reasonably be identified, it is no longer treated as personal data under the GDPR.

The questionnaire platform is configured so that participant IP addresses are not included in questionnaire responses or diagnostic datasets received and analysed by Quintaum. The platform provider may process limited technical network information for security, operational or service purposes under its own contractual and data-protection obligations.

4. Purposes and legal basis

Personal data may be processed where necessary to:

  • administer and operate the applicable Quintaum assessment;

  • process questionnaire responses and calculate standardised diagnostic indicators and scores;

  • generate commissioned organisational, individual or coaching reports;

  • provide a Personal Report where requested by the participant;

  • provide aggregated organisational insights;

  • administer participation status and participant reminders where personalised access codes are used;

  • administer report access and related service communications;

  • provide technical support and maintain the security and reliability of Quintaum services; and

  • comply with applicable legal obligations.

For assessments carried out on behalf of another organisation, the applicable data controller is responsible for determining and documenting the applicable legal basis under Article 6 GDPR and, where special categories of personal data are processed, the applicable condition under Article 9 GDPR.

Quintaum processes the relevant personal data as a processor or sub-processor, as applicable, in accordance with documented instructions, applicable contractual arrangements and data-protection law.

Where Quintaum processes limited personal data as an independent controller for its own business communications, administration, security or legal obligations, the applicable legal basis may include contractual necessity, legal obligation, consent, or Quintaum’s legitimate interests in operating, securing and administering its services and business relationships, as appropriate.

Quintaum may use irreversibly anonymised data for benchmarking, statistical analysis, methodological validation, development and improvement of Quintaum’s diagnostic methodology and algorithms.

Identifiable or pseudonymised participant assessment data are not used for these purposes.

5. Special categories of personal data and voluntary participation

Some questionnaire responses may reveal or allow conclusions to be drawn about health, psychological well-being, stress or other information that may constitute special categories of personal data under Article 9 GDPR.

Where explicit consent is the applicable condition for processing such data, Quintaum’s standard assessment process requires the participant’s explicit consent before the assessment is continued.

Participation in a Quintaum assessment is voluntary. Participants may decline to participate or stop the assessment at any time.

Where personalised access codes are used, limited participation-status information may be made available to authorised project administrators where necessary for administration of the assessment or participant reminders. This information is limited to whether an invited participant has completed or not completed the assessment.

Participation-status information does not include questionnaire responses, diagnostic scores, individual results or information about how a participant answered.

Where processing is based on consent, consent may be withdrawn without affecting the lawfulness of processing carried out before its withdrawal.

6. Participant choice and sharing of individual results

Participation in a Quintaum assessment does not automatically authorise disclosure of individual diagnostic results.

At the end of the questionnaire, after the participant has seen all questions asked, participants may choose between Full, Limited and Anonymous individual-result sharing options. These are separate and equal choices.

Full may allow coded individual results to be made available to authorised internal recipients within the organisation for which the assessment is conducted, within the scope explained to the participant.

Limited may allow coded individual results to be made available to authorised external professionals, such as coaches or consultants, within the scope explained to the participant.

Anonymous means that individual coded results are not made available to such recipients and only aggregated or otherwise non-identifying organisational results are provided.

Coded individual results are not disclosed together with the participant’s name or email address. Quintaum does not provide its separate code-to-email mapping to clients, partners, coaches or end-client organisations.

A participant’s decision to receive their own Personal Report is separate from their Full, Limited or Anonymous sharing choice.

Personal data may also be disclosed where required by applicable law or a competent authority.

7. Automated processing

Quintaum uses automated processing to calculate standardised diagnostic scores, indicators and reports from questionnaire responses.

Depending on the nature of the assessment and processing, certain automated diagnostic analyses may constitute profiling within the broad meaning of the GDPR.

Quintaum does not make solely automated decisions that produce legal effects concerning participants or similarly significantly affect them.

8. Retention and deletion

Quintaum retains personal data only for as long as necessary for the relevant assessment, reporting, security, legal or administrative purpose.

Unless a different period is required by law or validly agreed for a specific service:

Project-level participant data, including pseudonymised questionnaire responses, the separate personalised code-to-email mapping and participant-level analytical working data, are retained for up to 90 days after completion of the commissioned diagnostic project.

A project is normally considered complete when the reports included in the commissioned project have been delivered.

At the end of the applicable retention period, the separate personalised code-to-email mapping is deleted. Other relevant project-level personal data are deleted or irreversibly anonymised.

Personal Reports are normally available online for up to 60 days from report generation.

Coaching Reports are normally available for up to 365 days, unless a different expiry period applies to the relevant report or engagement.

Temporary delivery files containing participant access information are subject to short retention and are normally removed within 7 days.

The specific retention period applicable to a report or service may therefore extend beyond the general project-level retention period where that report or service remains active for its stated purpose.

Participants may request earlier deletion where applicable. Quintaum may require appropriate verification before acting on a deletion request in order to prevent unauthorised deletion or disclosure.

Limited information may remain for longer where necessary for security, backup, audit, legal or regulatory purposes. Such information is subject to restricted access and applicable internal retention controls.

Only data that have been irreversibly anonymised may be retained for longer-term benchmarking, statistical analysis, methodological development, validation or improvement of Quintaum’s diagnostic methodology and algorithms.

9. Service providers, data location and international transfers

Quintaum uses selected service providers where necessary to deliver, operate and protect its services.

At the date of this Policy, Quintaum uses SurveyMonkey / Research.net for questionnaire administration. Quintaum’s SurveyMonkey account uses SurveyMonkey’s United States data storage environment, where questionnaire data are stored in the United States.

SurveyMonkey and other service providers may also process or access limited information from other locations where necessary for support, security, technical operations or other permitted service purposes under their applicable contractual and data-protection obligations.

Quintaum may also use selected providers for infrastructure, hosting, communications and related technical services.

Where personal data are transferred outside the European Economic Area, an appropriate transfer mechanism or safeguard is used where required under applicable data-protection law.

Sub-processors processing personal data on Quintaum’s behalf are subject to appropriate contractual, confidentiality and data-protection obligations.

Information concerning Quintaum’s relevant sub-processors is available to clients or other authorised organisations as part of an appropriate privacy or security review.

Further information about applicable international-transfer safeguards may be requested through Quintaum’s contact page at https://www.quintaum.com/contact.

10. Security

Quintaum applies technical and organisational measures appropriate to the nature and risk of the processing.

These include, where relevant, access controls, separation and pseudonymisation of data, secure communications, protected administrative access, controlled retention and deletion, security logging, and backup and recovery measures.

Security measures are reviewed and adapted where appropriate to changes in technology, processing activities and risk.

Further information concerning Quintaum’s technical and organisational measures is available to clients or other authorised organisations as part of an appropriate privacy or security review.

11. Data protection rights

Subject to the conditions and limitations of applicable law, individuals may have rights including:

  • access to their personal data;

  • correction of inaccurate personal data;

  • erasure;

  • restriction of processing;

  • data portability where applicable;

  • objection where applicable;

  • withdrawal of consent where processing is based on consent; and

  • the right to lodge a complaint with a competent supervisory authority.

Where another organisation acts as the data controller, these rights are generally exercised in relation to that controller.

Quintaum assists the relevant controller or processor with valid data-subject requests where required.

Participants may also contact Quintaum through our contact page at https://www.quintaum.com/contact. Where a request concerns processing carried out on behalf of another organisation, Quintaum may refer or transmit the request to the appropriate organisation.

Where information was collected without individual identification, or has already been irreversibly anonymised, Quintaum may no longer be able to identify the relevant participant or associate a request with particular data.

12. Complaints

Individuals have the right to lodge a complaint with the data-protection supervisory authority competent for their circumstances.

For Quintaum, the supervisory authority is:

Information Commissioner of the Republic of Slovenia
(Informacijski pooblaščenec Republike Slovenije)

Individuals may also contact the relevant data controller or Quintaum so that a privacy concern can be reviewed directly.

13. Changes to this Privacy Policy

Quintaum may update this Privacy Policy where necessary to reflect changes in its services, processing activities, legal requirements or data-protection practices.

The current version and date of the latest revision will be published on the Quintaum website.

Where a change materially affects the processing of personal data, appropriate information will be provided where required by applicable law.

Quintaum d.o.o.
Contact: https://www.quintaum.com/contact