Last updated: 15 October 2026
In this information we describe how we process your personal data. It is important to us that you feel confident about how we process your personal data. We take measures to ensure that your personal data is protected and that it is processed in accordance with applicable regulations and laws and our internal guidelines and procedures.
In this policy we explain how we process your personal data when you:
IDI Profiling AB, reg. no. 556988-5196, ("we", "our", "us"), is the data controller when you are a Private User, Customer Contact Person or Facilitator, and for respondents invited by a Private User.
When you use the service through your employer (Organisation User), or have been invited as a respondent by an Organisation User, your employer or the organisation is the data controller. We are then a data processor and process the data according to the customer's instructions. Please direct questions about that processing to your employer first. We help the customer to answer.
Contact details for us:
IDI Profiling AB
Grev Magnigatan 9
114 55 Stockholm
+46 8-756 70 35
We only collect the personal data we need. The personal data we collect depends on how you interact with us. In sections 2.1 to 2.4 below, we explain what personal data we process about you and where we collect this data from depending on the capacity in which you interact with us.
When you interact with us as a Private User, we collect and process the following categories of personal data.
Data that you provide to us:
Data collected through your use of our services:
Data collected from the respondents you invited:
When you interact with us as an Organisation User, we collect and process the following categories of personal data. You are considered an Organisation User regardless of whether your employer is in the private or public sector.
Data that you provide to us:
Data collected from your employer:
Data collected through your use of our services:
When you interact with us as a Respondent, we collect and process the following categories of personal data.
Data that you provide to us:
Data collected from the person who invited you:
Data collected through your use of our services:
When you interact with us as a Customer Contact Person, we collect and process the following categories of personal data.
Data that you provide to us:
When you interact with us as a Facilitator, we collect and process the following categories of personal data.
Data that you provide to us:
Data collected through your use of our services:
We process your personal data in order to provide our services in the best possible way. In this section, we explain the purposes for which we process your personal data.
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Create and provide a user profile to you. | Contact details Identification data Demographic data | The processing is necessary for the performance of the contract with you (Article 6(1)(b) GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or when you ask us to. |
| Offer you storage of your user profile and profile presentation after the end of the contract. | Contact details Identification data Demographic data Profile data | The processing is based on your consent (Article 6(1)(a) of the GDPR). You always have the right to and can withdraw your consent at any time. To withdraw your consent for continued storage, please contact us using the contact details provided in section 1. | Until you withdraw your consent. |
| Analysing and creating the IDI profile based on the self-assessment and respondents' answers. | Profile data | The processing is necessary for the performance of the contract with you (Article 6(1)(b) GDPR). | For the time required to analyse and create the IDI profile. |
| Creation and storage of profile presentation. | Profile data | The processing is necessary for the performance of the contract with you (Article 6(1)(b) GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or when you ask us to. |
| Enable login to the user profile. | Authentication credentials Electronic identifiers Device information | The processing is necessary for the performance of the contract with you (Article 6(1)(b) of the GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or when you ask us to. |
| Communicate and send notifications via email and SMS. | Contact details Identification data | The processing is based on a balancing of interests where our legitimate interest is to be able to notify you of events in the IDI Platform, changes to our general terms and conditions or other important notices related to the service (Article 6(1)(f) GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or when you ask us to. |
| Anonymising data in order to analyse and track when our emails are opened and which links are clicked in the email through web beacons. | Electronic identifiers Device information Contact details | The processing is based on a balancing of interests where our legitimate interest is to be able to evaluate and follow up on our mailings (Article 6(1)(f) of the GDPR). | For the time necessary to anonymise the data. |
| Sending marketing communications by e-mail. | Contact details Identification data | The processing is based on your consent (Article 6(1)(a) of the GDPR). You always have the right to and can withdraw your consent to receive marketing communications at any time by following the instructions in the communication. | During the term of the contract. After that, the data is deleted manually in accordance with the contract or on request. |
| Providing, maintaining, testing and improving the IDI portal. | Electronic identifiers Usage data | The processing is based on a balancing of interests where our legitimate interest is to be able to provide and develop our services (Article 6(1)(f) GDPR). | For the entire time we store your personal data in our systems. |
| Enable the management, development and testing of our IT systems in order to ensure that the IDI platform maintains high quality and to detect and prevent security attacks, e.g. intrusion attempts. | All relevant categories of personal data. | The processing is based on a balancing of interests where our legitimate interest is to ensure necessary technical functionality and security on our website and in our IT systems (Article 6(1)(f) of the GDPR). | Personal data is kept for the same period as stated for each relevant purpose of the processing. Personal data in logs is kept for 30 days. Backups are kept for a limited time and are then overwritten. |
| Anonymising personal data in order to produce statistics and follow up on our business. | Relevant categories of personal data that are necessary to produce the statistics. | The processing is based on a balancing of interests where our legitimate interest is to anonymise your personal data in order to produce statistics on our services and thereby follow up on and evaluate our business (Article 6(1)(f) of the GDPR). | For the time necessary to anonymise the data. |
| Establish, exercise and defend legal claims. | Relevant categories of personal data that are necessary to handle and respond to the legal claim in the individual case. | The processing is based on a balancing of interests where our legitimate interest is to be able to establish, exercise and defend legal claims (Article 6(1)(c) GDPR). | For the period required for us to establish, exercise and defend the legal claim in each individual case. |
| Comply with our legal obligations with reference to e.g. the Swedish Bookkeeping Act and tax legislation, and comply with orders and decisions from courts and authorities. | Relevant categories of personal data that are necessary to comply with each legal obligation. | The processing is necessary to comply with legal obligations that we have (Article 6(1)(c) of the GDPR). | Personal data is kept for the time necessary for us to comply with each legal obligation that we have and for a period of ten (10) years to meet our legitimate interest in handling and responding to legal claims, and for the time thereafter that is necessary to handle the claim. For example, personal data in accounting records is kept for seven (7) years from the end of the calendar year in which the relevant financial year ended, in accordance with the Swedish Bookkeeping Act (1999:1078). |
| Administer the customer relationship with you. | Contact details Identification data Communication | The processing is necessary for the performance of the contract with you (Article 6(1)(b) of the GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or on request. |
| Administer invoicing in our business. | Contact details Identification data Ordering and invoicing data | The processing is based on a balancing of interests where our legitimate interest is to be able to invoice you for the use of our services (Article 6(1)(f) of the GDPR). | For the entire term of the contract. |
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Create and provide a user profile to you. | Contact details Identification data Demographic data | Your employer (the customer) determines the legal basis. | For the entire time you use our services in accordance with the contract we have with your employer. |
| Enable login to the user profile. | Authentication credentials Electronic identifiers Device information | Your employer (the customer) determines the legal basis. | For the entire time you use our services in accordance with the contract we have with your employer. |
| Communicate and send notifications via email and SMS. | Contact details Identification data | Your employer (the customer) determines the legal basis. | For the entire time you use our services in accordance with the contract we have with your employer. |
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Collection and compilation of responses to create the user's IDI profile. | Response data | If you were invited by an Organisation User, the customer determines the legal basis. If you were invited by a Private User, the processing is based on your consent (Article 6(1)(a) of the GDPR). You can withdraw your consent at any time by contacting us using the contact details in section 1. | Until the profile is deleted. Deletion is done manually in accordance with the customer's contract or on request. |
| Track whether you have submitted your feedback and share the result with the user of our services. | Usage data | If you were invited by an Organisation User, the customer determines the legal basis. If you were invited by a Private User, the processing is based on your consent (Article 6(1)(a) of the GDPR). You can withdraw your consent at any time by contacting us using the contact details in section 1. | Until the profile is deleted. |
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Managing the customer relationship. | Contact details Identification data Communication | The processing is necessary for the performance of the contract with you (Article 6(1)(b) of the GDPR). | For the entire time you use our services in accordance with the contract we have with your employer. |
| Manage invoicing in our business. | Contact details Identification data Ordering and invoicing data | The processing is based on a balancing of interests, where our legitimate interest is to be able to invoice the company you are connected to for the use of our services (Article 6(1)(f) GDPR). | For the entire time you use our services in accordance with the contract we have with your employer. |
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Create and provide a user profile to you. | Contact details Identification data Demographic data | The processing is necessary for the performance of the contract with you (Article 6(1)(b) GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or on request. |
| Administer your license. | Contact details Identification data Licensing data | The processing is necessary for the performance of the contract with you (Article 6(1)(b) GDPR). | During the term of the contract. After that, the data is deleted manually in accordance with the contract or on request. |
| Analysing and creating the IDI profile based on the self-assessment and respondents' answers. | Profile data | The processing is necessary for the performance of the contract with you (Article 6(1)(b) GDPR). | For the time required to analyse and create the IDI profile. |
We keep your data only for as long as necessary for the purpose for which it was collected.
There is no automatic deletion in the platform. Data is deleted or anonymised manually following a documented procedure. This happens when the contract with us or with your employer requires it, or when you or the customer ask for it.
When a profile is deleted, the respondents' answers and the coaching AI conversations that belong to the profile are also deleted. Messages in the Teams chat remain in the session until the session is deleted.
Logs are kept for 30 days. Backups are kept for a limited time and are then overwritten.
Data that we are required by law to keep, such as accounting records, is kept for as long as the law requires.
We use sub-processors to deliver the service. They process data on our behalf and according to our instructions. We use the following sub-processors:
We may also share your data with authorities or third parties when we are obliged to do so in the context of legal proceedings or by order of a public authority.
If you want to know more, please contact us or request a copy of your personal data (see section 8 "Right to access your personal data").
The platform has an AI feature for coaching and for the Teams chat. It uses Google Gemini through the paid tier of the Gemini Developer API. Google is our data processor under Google's data processing terms and does not use the data to train its models.
The system's own requests to Gemini contain no personal data, such as names or email addresses. This is checked by automated tests. The text you write yourself in the AI feature is sent to Google as it is. Please do not write names or other details about other people. In the Teams chat, the names of the group members are replaced with codes before the text is sent to Google.
If you are a facilitator, the same applies to the text you write about a participant or a group to tailor the AI coaching.
AI conversations are stored in the platform. Coaching conversations are deleted when the profile they belong to is deleted. Messages in the Teams chat remain in the session until the session is deleted. Conversations are not deleted separately or after a set period.
The AI feature does not make decisions about you.
We store and process your data primarily within the EU. The platform is hosted in Sweden (Glesys), email from the platform is sent from an EU region (Sinch Mailgun) and our office environment (Google Workspace) is set to store data in the EU.
Two providers may process data in the USA:
The transfer is based on the EU-US Data Privacy Framework, under which both providers are certified, and the European Commission's standard contractual clauses.
You have a number of rights in relation to your personal data. You can read more about your rights below. If you wish to exercise any of your rights or have any questions, please contact us using the contact details provided in section 1 of this policy.
In certain cases, you have the right to have your personal data erased. This applies, for example, to data that (a) is no longer necessary to process or keep for the purpose for which it was collected, or (b) if you withdraw your consent for processing. In some cases, we have no possibility to delete your personal data. This may be because the data is either still necessary to process for the purpose for which it was collected, our interest in continuing to process the data outweighs your interest in having it erased, or because we are required by law to retain it.
You have the right to be informed about how we process your personal data. We do this through this privacy notice and by answering your questions.
You have the right to know whether we process your personal data and to receive a copy of your personal data. The copy will tell you what information we have about you and how we process your personal data.
This right, also known as the 'right to data portability', means that you can request a copy of the data we hold about you and which we process to fulfil a contract with you, or based on your consent, in a machine-readable format. This is to allow you to transfer your personal data to another recipient.
You have the right to request that we correct inaccurate or incomplete information about you and that we complete your information.
If you believe that the data we hold about you is inaccurate, that our processing is unlawful or that we do not need the data for a specific purpose, you have the right to request that we restrict our processing of that data. You can also request that we do not process your data while we check this, or while we check whether you have the right to object to certain processing as described below.
You can object to our processing that we base on our legitimate interests (Article 6(1)(f) GDPR). You can also always object to us using your personal data for direct marketing purposes. When you inform us that you no longer wish to receive direct marketing from us, we will switch off the marketing and thus stop sending you marketing.
You have the right to object to an automated decision made by us if the decision produces legal effects or similarly significantly affects you. We do not use automated decisions.
When we process your personal data based on your consent, you have the right to withdraw your consent at any time. When you withdraw your consent, we will stop processing the personal data concerned.
If you wish to make a complaint about our processing of personal data, you can contact the Data Protection Authority. For information on how to lodge a complaint, please refer to IMY's website.
More information about your rights can be found on IMY's website.
We use cookies and other similar tracking technologies in our various interfaces. You can find more information about how we use cookies and similar tracking technologies in our cookie policy.
We are constantly working to improve our services. This may involve changes to existing services. If such a change requires notification or consent under applicable data protection laws, you will be notified and given the opportunity to give your consent.