Privacy policy

C.1. Who is responsible for your data

COREOD LTD, 128 City Road, London EC1V 2NX, United Kingdom, company number 16185144 ("Coreod"), is the controller of the data collected on insight.coreod.ch and in connection with the Coreod Insight service.
For the European Union, Coreod has an establishment in France: Coreod Consulting, Paris (SIREN 750 531 469).
For any question about your data or to exercise your rights: privacy@coreod.ch.

C.2. Who this policy concerns

• The customer, who orders an assessment for themselves or for another person.
• The respondent, who completes the questionnaire and receives the report.
• Visitors to the website.

C.3. Data processed

• Customer: whether ordering as a consumer or a business, first and last name, email address, company and VAT number where applicable, billing address, telephone number if provided, matrix ordered, language, invoice, payment record, correspondence with Coreod, acceptance of the terms and of the request for immediate performance.
• Respondent: email address (entered by the customer or by the respondent), first name and gender if the respondent chooses to provide them, answers to the questionnaire, scores and report, date and version of consent, assessment dates.
• Visitor: technical connection data needed for the website to work securely (IP address, browser type, date and time of the request).

Depending on the matrix, answers and reports cover perceived stress, coping strategies, sleep, daytime sleepiness, personality or leadership style. Some of this information may reveal a person's health and is then health data under data protection law. We treat it as such.

C.4. Purposes and legal bases

Coreod does not sell any data, does not use targeted advertising and does not match your data with third-party databases.

C.5. Artificial intelligence

The report is written by Prometheus, an artificial intelligence, based on the respondent's answers and using a method defined by the Coreod scientific team. It may be reviewed by a qualified member of that team before delivery. The report does not produce any decision about the respondent: there is no automated individual decision-making within the meaning of Article 22 GDPR. Our artificial intelligence providers are not permitted to use your data to train their models.

C.6. Who receives your data

• The respondent receives their report. A customer who is not the respondent does not receive the report, only confirmation that it has been delivered.
• Authorised Coreod staff, to handle orders, invoicing and report quality.
• Our technical providers, acting on our instructions and under contract:
• Vercel Inc. (United States): website hosting;
• Supabase (European Union region): database;
• Anthropic Ireland, Limited: AI generation of the report text;
• Brevo (France): sending service emails;
• Google (Google Workspace): Coreod's business email.
• Authorities, where required by law.

C.7. Transfers outside the European Union and the United Kingdom

Some providers are established in, or process data in, the United States. These transfers are covered by the provider's certification under the EU-U.S. Data Privacy Framework and its UK Extension, or by the European Commission's standard contractual clauses and the UK Addendum. A copy of the safeguards can be requested from privacy@coreod.ch.

C.8. How long we keep data

• Respondent's answers, scores and report: twelve months after the report is delivered, then deleted. The respondent may ask for earlier deletion at any time.
• Order, invoice and related correspondence: six years from the end of the relevant financial year, as required for accounting purposes; ten years for a contract with a consumer whose amount reaches the threshold set out in Article 14 of the terms and conditions.
• Unpaid, cancelled order: one year after cancellation.
• Technical connection data: twelve months at most.

C.9. Cookies

The website only uses cookies that are strictly necessary for it to work (for example remembering your language and securing your session). It uses no advertising cookies and no audience measurement tools. No consent is therefore requested.

C.10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. A respondent who withdraws consent before the report is delivered ends their assessment; their answers are deleted.
To exercise your rights: privacy@coreod.ch. We reply within one month.
You may also lodge a complaint with the data protection authority of your country, including the Information Commissioner's Office in the United Kingdom (ico.org.uk), the CNIL in France (cnil.fr), the Saudi Data and Artificial Intelligence Authority (SDAIA) in Saudi Arabia (sdaia.gov.sa) or the Personal Information Protection Commission in Japan (ppc.go.jp).

C.11. Minors

The service is reserved for people aged 18 or over.

C.12. Security

Data are encrypted in transit, and access to reports is protected and restricted to authorised persons.

C.13. Changes

This policy may change. The version in force is dated at the top of the page.

C.14. Individuals residing in Japan

Where your data fall under Japan's Act on the Protection of Personal Information, the following rules apply in addition to this policy.
Sensitive information. Your answers may contain information relating to your health. We collect it only with your express consent, given on the screen before the questionnaire.
Transfers outside Japan. Your data are processed in the United Kingdom, the European Union and the United States. Japan's Personal Information Protection Commission recognises the United Kingdom and the European Union as providing an equivalent level of protection. In the United States, our providers are contractually bound to take measures equivalent to those required by Japanese law. On request, we will inform you of these measures and of the data protection regime of the United States.
Security. Our security measures take into account the data protection regimes of the countries where your data are stored. Details of these measures are provided on request, except where disclosure would compromise their effectiveness.
Your requests. To request disclosure, correction, suspension of use or deletion of your data, or disclosure of records of their transfer, write to privacy@coreod.ch. We respond without undue delay.
Representative. COREOD LTD is represented by Élise Jabès, director.