Privacy Policy

1. Introduction

This Privacy Policy explains how Tema Resources Limited (Company No. 14485918), trading as ProfileTest.ai (“we”, “us”, “our”), collects, processes, stores, and protects personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Other applicable data protection laws

ProfileTest.ai provides personality profiling and behavioural intelligence infrastructure for businesses, coaches, enterprises, and individuals.

This policy applies to:

• Website visitors
• Account holders (Hosts)
• Individuals completing profiling diagnostics (“Test Takers”)
• Licensees
• Enterprise users
• Business contacts
• Users of NextGen Profiling
• People who are the subject of a NextGen read (see section 18)

2. Data Controller and Processor Roles

2.1 Platform-Level Data

For account registration, billing, technical operation, analytics, and platform administration, Tema Resources Limited acts as Data Controller.

2.2 Host-Deployed Systems

Where a Host deploys a profiling System to its own clients, employees, candidates, or customers:

• The Host acts as an independent Data Controller for that processing.
• We act as a Data Processor on behalf of the Host.
• Where acting as Processor, we process data solely on documented instructions from the Host unless required by law.

In such cases:

• The Host is responsible for providing privacy notices to Test Takers.
• The Host must establish a lawful basis for processing.
• The Host must respond to data subject rights requests relating to their deployment.

Where profiling diagnostics are presented to Test Takers, appropriate transparency information is provided at or before the point of data collection.

We process data only in accordance with the Host’s documented instructions and our contractual arrangements, unless otherwise required by law.

3. Categories of Personal Data

We may process the following categories:

Identity Data:Name, date of birth, username.

Contact Data:Email address, phone number, address.

Account Data:Login credentials, account preferences.

Billing and Transaction Data:Payment details (processed via third-party providers), subscription history.

Technical Data:IP address, device identifiers, browser type, usage logs, cookies.

Behavioural Profiling Data:Responses to diagnostic questions, scoring outputs, behavioural insights, generated reports, dashboard metrics.

Publicly Available and Inferred Profile Data (NextGen):information gathered from public sources about people who are the subject of a read, and the inferred read produced from it (see section 18).

Marketing Data:Communication preferences and subscription settings.

We do not intentionally collect:Special category data (health, race, religion, biometric data, etc.)

Criminal conviction data:We do not intentionally collect such data. If inadvertently provided, it will not be used for profiling and may be deleted.

4. Profiling and Decision Support

The Platform uses profiling within the meaning of UK GDPR.

Profiling is used to:

• Analyse behavioural responses
• Generate structured personality insights
• Produce reports and dashboards
• Support human-led decision making

We do not conduct fully automated decision-making that produces legal or similarly significant effects without meaningful human involvement.

All outputs are advisory and informational in nature.

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning individuals.

5. Lawful Bases for Processing

We rely on:

Contractual Necessity:To provide services under account agreements.

Legitimate Interests:To operate, secure, administer, and improve the Platform, prevent fraud and misuse, and support appropriate service development where our interests are not overridden by the rights and freedoms of individuals.

Where Legitimate Interests are relied upon, we conduct and document balancing assessments to ensure that such interests do not override the rights and freedoms of individuals.

Consent:For marketing communications and optional features where required.

Legal Obligation:Where required to comply with law.

Where we act as Processor for Hosts, the Host determines the lawful basis for their deployment.

Behavioural profiling data:is processed primarily under Contractual Necessity (where the individual or Host has requested the diagnostic) or under the Host’s determined lawful basis where we act as Processor.

6. How We Use Personal Data

We use personal data to:

• Provide Platform access
• Deliver profiling diagnostics and reports
• Process payments
• Maintain security and prevent fraud
• Provide support
• Monitor performance
• Improve platform functionality
• Conduct research using anonymised and aggregated data

Aggregated data does not identify individuals.

We may use anonymised behavioural trend data for product development and analytics. Where data is anonymised, it is processed in a manner that no longer permits identification of individuals. Where data is pseudonymised, additional safeguards are applied.

We process only the minimum personal data necessary to achieve the stated purposes and do not process data for incompatible purposes without notice and lawful basis.

We do not sell personal data, engage in behavioural advertising based on profiling results, or share profiling outputs with third-party advertisers.

Sub-processors are appointed in accordance with Article 28 UK GDPR. A current list of key sub-processors is available upon request.

7. Sub-Processors and Third Parties

We may engage sub-processors for:

• Cloud hosting
• Payment processing
• Email communications
• Infrastructure support
• Security monitoring

All sub-processors are contractually required to implement appropriate security measures.

We may also disclose personal data:

• To regulatory authorities if legally required
• In connection with business restructuring or sale
• To enforce our contractual rights

We do not sell personal data.

8. International Transfers

Personal data may be processed outside the United Kingdom.

Where personal data is transferred to a country that is not covered by a UK adequacy regulation, we use an appropriate lawful transfer mechanism where required, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another recognised safeguard under applicable data protection law.

9. Data Retention

We retain personal data only as long as necessary to:

• Fulfil contractual obligations
• Meet legal requirements
• Maintain legitimate business records
• Resolve disputes

Test Taker data processed on behalf of a Host is retained in accordance with the Host’s instructions.

We may retain limited technical logs for security purposes.

Account data is typically retained for the duration of the active subscription and for a limited period thereafter for audit and legal compliance purposes. Billing records are retained in accordance with statutory financial record-keeping requirements.

Upon termination of a Host engagement, personal data processed on behalf of the Host will be deleted or returned in accordance with contractual arrangements.

10. Security Measures

We implement appropriate technical and organisational safeguards including:

• Encrypted connections
• Access controls
• Role-based permissions
• Secure hosting environments
• Regular updates and monitoring
• Backup and recovery procedures

While no system is completely secure, we take commercially reasonable steps to protect personal data.

We implement data protection by design and by default principles in the development and deployment of our systems.

11. Data Breaches

In the event of a personal data breach:

• We will investigate promptly.
• Where required, we will notify the relevant supervisory authority.
• Where acting as Processor, we will notify the Host without undue delay.
• Where required, affected individuals will be notified in accordance with applicable law.

12. Data Subject Rights

Individuals have the right to:

• Access personal data
• Rectify inaccuracies
• Request erasure
• Restrict processing
• Object to processing
• Data portability

Where we act as Processor, requests relating to Host-deployed systems may be referred to the Host as Data Controller.

Complaints may be made to the Information Commissioner’s Office (ICO).

13. Children's Data

The Platform is not designed for use by individuals under 18, and we do not knowingly collect personal data from minors through standard Platform use.

If we become aware that personal data relating to a person under 18 has been processed contrary to the permitted use of the Platform or applicable law, we will take appropriate action, including deletion where required and where we are authorised to do so.

14. Cookies and Tracking Technologies

We use cookies for:

• Authentication
• Analytics
• Performance optimisation

Non-essential cookies require consent where legally required.

Details are available in our Cookie Notice.

15. Business Transfers

If Tema Resources Limited undergoes merger, acquisition, restructuring, or sale, personal data may be transferred as part of that transaction.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be highlighted where appropriate.

The latest version will be published on our website.

Where changes materially affect how we process personal data, we will provide appropriate notice where required by applicable law.

17. Contact

Tema Resources Limited

Unit 1, 307 Garratt Lane

London, SW18 4DX

United Kingdom

Email:support@profiletest.ai

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO). Further information is available at www.ico.org.uk.

18. NextGen Profiling

18.1 What it is and who this section covers

NextGen Profiling prepares a behavioural read of a person a user is about to meet: how they are likely to think, decide and buy. It works from publicly available information and, if the user chooses, LinkedIn content read in the user’s own browser. Unlike our diagnostics, the person read does not complete a test.

This section covers two groups:users(the salespeople and teams who sign in and create reads) andpeople who are the subject of a read. The rest of this policy applies to NextGen as well, except where this section says otherwise.

18.2 Who is responsible

• For reads:the user, or the organisation they work for, decides whom to read and the purpose for doing so and is responsible as data controller for that use. Tema Resources Limited generally acts as data processor when preparing a read on the user’s documented instructions. Where Tema Resources Limited determines the purposes and essential means of any separate processing, it acts as controller for that processing and will meet the corresponding transparency and data protection obligations.
• For user accounts:Tema Resources Limited is the data controller for account, sign-in, billing and platform data, as described in section 2.1.

Users agree to pilot terms that require them to identify and document an appropriate lawful basis for each read, use the service only for permitted business-contact purposes, and provide privacy information to the person concerned where required by applicable law, including the requirements that apply when personal data is obtained from public or third-party sources. A NextGen read must not ordinarily be shown to the person it describes as part of a sales interaction; this restriction does not limit any rights the person may have under applicable data protection law.

Registration and representative:Tema Resources Limited is registered with the Information Commissioner’s Office under registration number ZB616708. Our representative in the European Union for data protection matters is Guillaume Degois, [POSTAL ADDRESS],gd@profiletest.ai. People in the European Union can contact our representative instead of, or as well as, us.

18.3 If you are the subject of a read

We did not collect this information from you directly, so this section tells you what is used and where it comes from.

What is collected, and from where:

What is produced:an estimate of your communication and decision style and your business stage, with a confidence level, suggested conversation guidance and a question for the user to test the estimate. It is an informed guess to support a human conversation. It is never used to make automated decisions about you.

What the system is not designed or permitted to intentionally infer or use:special category data (such as health, religion, political opinions, ethnicity, sexual orientation or trade union membership), stress, wellbeing or mental resilience, criminal records, or information obtained from behind a paywall, through credentials we do not have, or by bypassing a CAPTCHA or other access control. If such information appears incidentally in public source material, it must not be used as a basis for the behavioural read. Reads must not be created about children.

Who can be read:users may only create reads on people already in their world, such as someone they have a meeting with, an existing contact or customer, or someone who has agreed to hear from them. Reads from purchased, rented or scraped lists are prohibited, and reads may not be used for recruitment or HR purposes.

18.3A Why we are allowed to do this (lawful basis)

Reads are prepared under legitimate interests (UK GDPR Article 6(1)(f)). The interest is the user’s, in preparing for a business conversation with someone already in their world: a person they are meeting, an existing contact or customer, or someone who has agreed to hear from them.

We have weighed that interest against your rights. A read uses only professional information that is publicly available or that you have published; it never uses or infers special category data, your age, stress or wellbeing; it is never used to make an automated decision about you; and it is not prepared from bought or scraped lists.

If you object, we will stop: every read about you is deleted, and we add you to our do-not-read list so that no future read about you can be created on NextGen Profiling. We keep that list under legitimate interests too (honouring your objection across all users), holding only the minimum needed to recognise you.

Where we use account, billing and platform data about users, our bases are contract (to provide the service), legal obligation (for example, financial records) and legitimate interests (security and improving the service), as described in section 5.

18.4 If you are a user

Your account:your email address, role, the date you accepted the pilot terms, sign-in times, the reads you create, feedback you send with “Give feedback”, and billing records (card details are held by Stripe, never by us).

Google sign-in and your calendar:when you sign in with Google, we receive your email address and read-only access to the events in your Google Calendar. We read event titles, start times and guest names and email addresses, and use them only to show your meetings with people outside your organisation in the next 14 days on your Agenda; your past meetings, up to 180 days back, in History when you open it; the meeting time on a read you prepared; and your Monday summary and reminder emails 24 hours and 60 minutes before meetings, which you can turn off. We never change your calendar and never read your email. We do not keep a copy of your calendar: we keep only an encrypted connection token, the meetings you choose to hide, and a record of which reminders we have sent. You can disconnect Google at any time from Settings in NextGen Profiling or from your Google account.

NextGen Profiling’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not use it to train AI models.

Deal records:if you record where a conversation stands with someone (for example “Proposal sent”) or what the opportunity is worth, we keep it in your account so it can show on your Agenda and in your history. Only you can see it.

Emails we send you:a Monday summary, a reminder 24 hours and 60 minutes before each meeting with someone outside your organisation, and any read you ask us to email to you. They go only to your own address. You can turn each one off from the link in any of them, or from Your account. We also send your name and email address to our customer system when you subscribe, so we can support you.

Emails you rewrite with Convertare sent to our AI provider to produce the rewrite and are not stored.

18.4A If someone referred you

A user can refer someone they know to NextGen Profiling. To do so, they give us that person’s name and email address, and confirm that they know them and are happy for us to email them once on their behalf. We record who made the referral, add the person’s details to our customer system, and send one introduction. We will not contact you again unless you reply or sign up. To be removed, reply to that email or write tosupport@profiletest.ai.

18.5 The LinkedIn helper (Chrome extension)

The helper is optional. It works only on the NextGen Profiling website and on linkedin.com. When a user creates a read, it opens the subject’s LinkedIn profile in the user’s own browser session and reads the text shown on the page: the profile, the full experience and education lists, and the subject’s recent comments. Comment pages can show other people’s words next to the subject’s; only the subject’s own words are used for the read. The helper does not read posts. It reads one person per read, only when the user asks, then closes the tab it opened and sends that text to NextGen Profiling to prepare the read. It does not track the user’s browsing, read their messages or feed, collect their LinkedIn password, or run on any other website. The text it sends is handled as source material under section 18.7.

18.6 Service providers, including AI

Accounts and reads are stored and processed in Germany (Frankfurt). Transfers outside the UK, including to Anthropic in the United States, are protected as described in section 8.

18.7 How long we keep it

Users can delete any of their reads at any time. Deleting a read removes it and its source material.

18.8 Your rights, and how to object

If you think you have been the subject of a read, emailsupport@profiletest.aiwith your name and, where available, your LinkedIn profile address. You can ask what personal data is held about you, ask for inaccurate data to be corrected, request deletion where applicable, or object to further processing. Where the user or their organisation is the controller for the read, we will refer the request to them and assist them as required. Where Tema Resources Limited is controller for any relevant processing, we will handle the request in accordance with applicable data protection law. If you object to being read, we will also add limited identifying information to a suppression list so that future reads about you are prevented. You can also complain to the Information Commissioner’s Office, as described in section 12.

If you are unhappy with how we handled your request:write to us first atsupport@profiletest.aiand we will reply within one month. You can complain to the Information Commissioner’s Office at any time:ico.org.uk/make-a-complaint, or 0303 123 1113. If you are in the European Union, you can also contact our EU representative named in section 18.2, or your local data protection authority.