Privacy

1. Data controller

The controller of personal data of Users of TestIQ.world (https://testiq.world) is DBX ADS Sp. z o.o., with its registered office in Kraków, Al. Płk. Beliny-Prażmowskiego 14, 31-514 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków under KRS 0000836648, NIP 6751727817, REGON 385876870.

Data-protection contact: contact@dbx.pl. no-reply@testiq.world is for system mail only and does not accept GDPR requests.

2. Data we process

Depending on use of the Service we may process: name, email, password or other authentication data, Certificate form data, survey answers (e.g. age band, gender, relationship status — including “prefer not to say”), Test attempt data (progress, scored answers, result, pace), payment data passed through Stripe (status, amount, currency, transaction ids, payment-method country — not the full card number on our side), Account and Subscription data, correspondence, and technical data (e.g. IP address, cookie or similar identifiers, user-agent) as needed for operation, security and — where applicable — marketing.

The public ranking may show first name, last-name initial, score and a country mark from payment data.

3. Purposes and legal bases

Performance of the contract for the Service, Test, Account, Certificate, One-time service or Subscription — Article 6(1)(b) GDPR.

Legal obligations (e.g. accounting, lawful requests) — Article 6(1)(c) GDPR.

Legitimate interests: security, abuse prevention, claims, analytics and Service improvement where consent is not required — Article 6(1)(f) GDPR.

Consent — where required, including marketing messages or non-essential advertising cookies / similar tech — Article 6(1)(a) GDPR. Consent may be withdrawn; withdrawal does not affect prior lawful processing.

4. Recipients

Data may be shared with processors or independent controllers as needed, including: Stripe, transactional email (Resend), hosting/application infrastructure (e.g. Vercel, database), and — when enabled — Meta Platforms for Meta Pixel and Conversions API for measurement and ads.

Data may be disclosed to public authorities where the law requires it.

Some providers may process data outside the EEA. Where required, we use GDPR transfer tools (e.g. standard contractual clauses).

5. Retention

Account and Certificate data are kept while the Account exists and as needed to perform the contract and legal duties.

Payment and billing data — for the periods required by tax and accounting rules.

Technical and security logs — for as long as needed for those purposes, usually no longer than security practice requires, unless a longer period is needed to investigate an incident.

Consent-based data — until withdrawal or the purpose ends, then for limitation periods for claims where relevant.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests.

Send requests to contact@dbx.pl. We may verify identity.

You may also complain to your supervisory authority; for Poland, the President of the Personal Data Protection Office (uodo.gov.pl).

7. Cookies and similar technologies

The Service uses cookies and similar technologies. Necessary ones support session, security and Test progress. Disabling them may break the Service.

Analytics or advertising technologies (including Meta Pixel) may run according to Service configuration and — where required — consent. You can manage cookies in the browser; limits may affect site features.

Third-party tools are also described in their own policies (including Stripe, Meta, Vercel).

8. Voluntary provision

Required fields are voluntary but needed to create an Account, issue a Certificate or take payment. Without them that service cannot be performed.

Survey answers that can be skipped are not required for the paid Result to the extent the Service allows skipping.

9. Security

We apply technical and organisational measures appropriate to the risk, including HTTPS and restricted server-side access.

No system is perfectly secure. Please protect access to the email used for sign-in.

10. Changes

This policy may be updated. The new version applies from publication in the Service, with the update date on the page, unless law requires another process.