Privacy Policy

1. Introduction

Aptive Index ("we", "our", or "us") is committed to protecting your privacy and ensuring you have a positive experience when using our assessment platform. This policy outlines our practices for collecting, using, and protecting your personal information.

2. Who We Are

Aptive Index provides psychometric assessments that measure innate drives and attributes to help organizations make better talent decisions. We process personal information as both a data controller (when working directly with organizations) and a data processor (when providing services to our clients).

2.1 Data Controller

When Aptive Index works directly with an organization to deliver assessment services, that organization acts as the data controller. They determine the purposes and means of processing personal data.

2.2 Data Processor

Aptive Index acts as a data processor when processing data on behalf of a client organization. In this role, we follow the instructions provided by the data controller and comply with applicable data protection laws.

3. Information We Collect

3.1 Personal Information

• Name and contact information (email address)
• Employment information (current role, organization)
• Assessment responses and results
• Usage data (how you interact with our platform)

3.2 Assessment Data

Our psychometric assessment collects information about:

• Work style preferences
• Decision-making approaches
• Communication styles
• Leadership tendencies
• Team interaction preferences

3.3 Technical Data

• IP address
• Browser type and version
• Device information
• Usage patterns
• Login information

3.4 Marketing and Analytics Data

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

4. How We Use Your Information

4.1 Primary Uses

• Delivering and analyzing assessment results
• Providing insights to authorized organizational representatives
• Improving our assessment accuracy and effectiveness
• Maintaining and enhancing our platform
• Communicating about your assessment and results
• Marketing and promotional communications (where permitted)

4.2 Legal Basis for Processing

We process your information based on:

• Contract performance (delivering assessment services)
• Legitimate interests (improving our services and marketing)
• Legal obligations (compliance with employment and privacy laws)
• Consent (where required by law)

4.2.1 EMEA (Including EU/UK under GDPR)

We process personal data under the following lawful bases:

• Contract performance: Delivering and managing assessment services
• Legitimate interests: Improving our platform and services
• Legal obligations: Compliance with applicable laws
• Consent: Required for certain marketing or data uses

4.2.2 APAC Regions

For APAC regions, we comply with applicable local privacy laws such as Australia’s Privacy Act and Singapore’s PDPA, applying equivalent safeguards and ensuring proper transfer mechanisms.

5. Data Sharing and Disclosure

5.1 We Share Data With:

• Your employer or potential employer (assessment results)
• Service providers (hosting, security, analytics,marketing)
• Legal authorities (when required by law)

5.2 We Do Not:

• Sell personal information
• Share data with third parties for their independent marketing (except as disclosed in section 3.4)
• Use assessment data for purposes beyond those specified

We maintain a list of our current third-party subprocessors, which may include hosting, analytics, and support providers. Clients may request the most recent list by contacting privacy@aptiveindex.com.

6. Data Protection

We implement appropriate technical and organizational measures to protect your data, including:

• Technical Measures: Encryption at rest and in transit, intrusion detection, and access logging
• Organizational Measures: Role-based access controls, background checks for employees, and regular privacy training
• Procedural Measures: Incident response plans, annual penetration testing, and periodic policy reviews

7. Your Privacy Rights

7.1 All Users Have the Right to:

• Access their personal information
• Correct inaccurate data
• Request data deletion
• Receive a copy of their data
• Object to certain processing
• Withdraw consent (where applicable)
• Opt out of marketing communications

7.2 Marketing Opt-Out Rights

You can opt out of marketing communications by:

• Clicking the unsubscribe link in our emails
• Visiting https://app.retention.com/optout to opt out of partner marketing
• Contacting us directly at privacy@aptiveindex.com

7.3 Additional Rights

California residents have additional rights under CCPA. EU/UK residents have additional rights under GDPR.

7.4 How to Exercise Your Rights

Email: [privacy@aptiveindex.com] Response Time: Within 45 days Verification required to protect your privacy

8. Data Retention

8.1 When we act as a Data Processor (client accounts)

• Retain data for duration of client's subscription
• Upon termination: return or delete per client's choice within 30 days
• Remove residual copies from backups within 90 days
• Retain minimal audit records up to 12 months

8.2 When we act as a Data Controller

• Account/profile data: until deletion or after 24 months of inactivity
• Support communications: 24 months after last interaction
• Application/security logs: up to 12 months; standard system logs 90 days
• Email preferences: retained as needed to honor opt-out

8.3 Assessment data

• Retained for duration of client relationship
• After termination: deleted or anonymized per DPA instructions

8.4 Legal Retention and Disputes

• Up to 7 years for financial records where applicable

8.5 Client-configured Schedules

• Custom retention schedules available per Order Form or DPA

9. International Data Transfers

We process data in the United States. When transferring data internationally, we ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs): Used for transfers from the EU/UK to the United States
• Data Processing Agreements (DPAs): Incorporated into our contracts with clients
• Regional equivalents: For APAC countries with data export restrictions, we use comparable safeguards or local standard clauses as required

A copy of our standard Data Processing Agreement (DPA) is available upon request by emailing privacy@aptiveindex.com

10. Children's Privacy

Our services are not intended for individuals under 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes through:

• Email notification
• Platform announcement
• Website notice

To exercise these rights, contact privacy@aptiveindex.com

12. Contact Us

Privacy Questions: Email: privacy@aptiveindex.com

Phone: 512-850-5533

Address: 5900 Balcones Drive, Suite 100, Austin, TX 78731

13. Specific Regional Rights

13.1 California Residents (CCPA)

You have the right to:

• Know what personal information is collected
• Know if personal information is sold or disclosed
• Say no to the sale of personal information
• Access your personal information
• Request deletion of your information
• Equal service and price (non-discrimination)

13.2 European Union/UK Residents (GDPR)

Residents of the European Union and United Kingdom have additional rights under the General Data Protection Regulation (GDPR), including:

• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision making
• Right to lodge a complaint with a supervisory authority

EU and UK residents have the right to lodge a complaint with their local data protection authority. A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

13.3 APAC Residents Rights

Residents of APAC countries may have additional rights under local privacy laws such as Singapore's PDPA, Australia's Privacy Act, and Japan's APPI.

These rights generally include:

• Accessing personal data we hold about you
• Requesting correction or deletion
• Withdrawing consent to processing
• Requesting information about cross-border transfers

To exercise these rights, please contact us at privacy@aptiveindex.com.

14. Cookie Policy

We use essential cookies to:

• Maintain your session
• Secure your information
• Enable basic platform functionality

We also use marketing and analytics cookies through our partners to:

• Understand website usage
• Provide personalized marketing
• Improve our services

You can control cookies through your browser settings and opt out of marketing cookies at https://app.retention.com/optout.

15. Assessment-Specific Privacy Information

15.1 Purpose of Processing

Assessment data is processed to:

• Generate psychometric profiles
• Provide insights for talent decisions
• Validate and improve our assessment
• Support organizational development

15.2 Scientific Validation

Our assessment methodology:

• Is scientifically validated
• Uses anonymized data for research
• Follows ethical testing standards
• Prevents demographic bias

15.3 Automated Decision-Making

Our platform uses automated tools to generate psychometric insights and recommendations. These outputs do not result in legal or similarly significant effects without human review.

16. Data Protection Impact Assessment

We have conducted a Data Protection Impact Assessment considering:

• Assessment data sensitivity
• Processing purposes
• Technical safeguards
• User rights and controls

17. Data Breach Notification

In the event of a data breach involving personal data, Aptive Index will:

• Notify affected client organizations without undue delay, and within 72 hours where required by law
• Provide details of the breach, including scope, impact, and mitigation steps
• Cooperate fully with the client's obligations to notify affected individuals and regulatory authorities