Privacy notice

01What we collect

• Account details — your email, a securely hashed password, and (optionally) a display name and billing details, so we can run your account and issue invoices.
• Your test result — your DISC answers and scores, stored encrypted and tied to your account, so we can build your report.
• Research data — a separate, name-free record of your result (see the next section).
• Server logs and usage statistics — our web server keeps standard access logs (IP address, time, page requested, browser type) for up to 15 days, for security and troubleshooting. From the same requests we keep usage statistics as daily totals only — page views, visitors, country, referring site, language and device type — with no cookie, no stored identifier and no stored IP address. Neither is linked to your account or your test result.
• Sign-in time — when you sign in, we record the time of that sign-in on your account, so that unused accounts can be recognised.
• A test taken without an account — we work out your result to show it to you, but store nothing. Your answers stay in your browser for up to 7 days and are saved only when you create an account or sign in.

02The research dataset

When you finish the test, we also save your answers and result to a separate research dataset, identified only by a random test code — never your name, email or account. If you fill in the optional post-test survey, your country and a few demographic details (age range, gender, education, occupation, industry) are added to that record.

03If you took the test in a group session

You do not need an account to take the test in a live session, and we never ask for your email. You join with a code from your facilitator, and what follows is everything we hold about you.

• What we keep — your answers, the DISC scores worked out from them, and the name you typed on the join screen if you typed one. That screen says the name is optional and that it appears in the group results; leave it blank and nothing on your record names you. If the host chose to reveal results later, we also keep your email address (encrypted) until 7 days after the results are released or the session is closed, solely to send you the link to your results.
• What your facilitator sees — the group picture: everyone plotted together by style, with your name beside your dot only if you entered one. They do not see your answers, and they cannot open your individual report.
• Your own report — yours to read and download for six hours, which is how long the cookie that remembers your seat lasts. Save the PDF if you want to keep it: after that we have no way to recognise you in order to show it again.
• How long we keep it — your answers are deleted from the session after 180 days (for a session that ends late in that period, 45 days after it ends). The scores stay, so the group results your facilitator produced keep working. As for everyone who finishes the test, a name-free copy of your result also goes to the research dataset above, under its own limits.
• Country — the research record stores the region from your browser's language setting (for example EE from et-EE), never your IP address; in older group sessions, the country the trainer recorded. Your answer in the optional survey replaces it.

You have the same rights as everyone else described here, but no account to exercise them from — so email . The test code printed on the PDF you downloaded is what lets us find your research record, so quote it if you still have it.

04Our legal bases

• Contract — your account, test result and report: to provide the service you signed up for.
• Consent — the optional demographic survey: you choose to share it, and you can withdraw it.
• Legitimate interest — aggregate research to improve the assessment, and server logs and usage statistics for security, troubleshooting and understanding how the site is used.
• Group sessions — if you took the test through a facilitator, our basis is legitimate interest: giving you the assessment they arranged and giving them the group result. You can object at any time.

05Who we share it with

We do not sell your data. A few providers process data on our behalf: Stripe (payments — card details go straight to Stripe; we never see or store them), Resend (the emails we send), Google Firebase (database), DigitalOcean (the server, in Frankfurt, Germany) and Google Fonts (the typefaces your browser fetches from Google, which sees your IP address when it does). Some of them may process data outside the EU under the European Commission's standard contractual clauses.

06How long we keep it

• Account data — for as long as you have an account. Delete your account and it is removed, except what the law makes us keep: invoices and accounting records for 7 years (Estonian Accounting Act), and a note that a promotional invitation link has been used, so that it cannot be used twice.
• Research records — the demographic details from the optional survey (age, gender, education, occupation, industry) are deleted after 3 years. The DISC result, its random code and your country are kept — they carry no name or account, and they let profile comparison and country statistics keep working. You can request full deletion at any time with your test code.
• Live session data — a participant's answers are deleted from the session after 180 days (for a session that ends late in that period, 45 days after it ends). The scores stay with the session so the group results keep working; they carry no name unless the participant entered one.

07If we contacted you by email

We sometimes introduce Discality by email to trainers, coaches, consultants and consulting firms, using business contact details from public sources. If you received such an email, this is what we hold about you and why.

• What we hold — your name, job title, company and work email address, where and when we found them (the web address and the date), and your reply if you send one.
• Where it comes from — public business sources: your company's website, the business register or a professional association's member directory. We record the exact source of each contact and will tell you on request.
• Why, and on what basis — to introduce Discality to professionals whose work it relates to. Our legal basis is legitimate interest (GDPR Article 6(1)(f)). We write only to business contacts, and we will send you a summary of our balancing of interests on request.
• Who processes it for us — Smartlead (sending the emails; 521 Products Pty Ltd, Australia) and Google Workspace (our email and contact list). Data transferred to Australia is protected by the European Commission's standard contractual clauses.
• How long we keep it — if you neither reply nor create an account, we delete your details within 12 months of collecting them. If you object, we keep only your email address on a do-not-contact list, so that we never write to you again.

Your right to object — you can object to direct marketing at any time: reply to our email (for example with “unsubscribe”) or write to , and we will stop at once, from every Discality address. Your other rights, including the right to complain to the Data Protection Inspectorate, are set out below.

08Your rights

You can ask to access, correct, delete or export your data, object to processing, or withdraw consent — at any time, from your account settings or by emailing us. If you believe we have mishandled your data, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

09Cookies

We use one essential cookie to keep you signed in (a secure, http-only session token) and, in a live session, one that remembers your seat for six hours. Your language choice is kept in your browser's local storage. No advertising or third-party tracking cookies.

10Contact

Questions about your data, or want to exercise a right? Email .

Postal address: Kuldala tee 24, 75312 Peetri, Harjumaa, Estonia.