1. Introduction

This policy explains how InsideRisk SA ("InsideRisk", "we", "us") collects, uses, and protects personal data across our services:

• insiderisk.com — our website

• platform.insiderisk.com — the assessment Platform, where participants complete immersive assessments

• portal.insiderisk.com — the Reporting Portal, where reports are generated and delivered, and the entry point for our demo and self-serve experiences (such as the AI Integration experience)

The services are not always used together. A commissioning organisation may use the assessment Platform without the Reporting Portal. Where it does, and where it does not give us participant contact details, we do not receive your name, email address or telephone number as participant registration data. We still process the assessment content, a session identifier, and the account, technical and usage data described in section 3, and information you include in your spoken responses may itself identify you.

The Reporting Portal is an optional addition, used where an organisation asks us to manage participants, analyse the results, and produce and deliver a report. Where it is in use we also process participant names and email addresses, as described in section 3. If you are unsure which applies to your assessment, ask the organisation that arranged it, or contact us and we will help identify the configuration.

It also explains our use of cookies. We comply with the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), and the ePrivacy Directive.

2. Who is responsible for your data

InsideRisk SA, Route du Lac 27, 1071 Saint-Saphorin, Switzerland, is the data controller for the processing described here, except where we act as a processor on behalf of a client organisation (see section 9). As we are based outside the EU, our representative in the EU under Article 27 GDPR is Adrian Stobbe, located in Spain. You can contact the representative, or contact us about privacy generally, at contact@insiderisk.com.

3. The data we collect and why

Not every row below applies to every participant. What we process depends on which of our services the organisation that arranged your assessment is using, as explained in section 1.

We do not use your personal data for advertising, profiling for marketing, or cross-site tracking.

4. Cookies and similar technologies

We keep our use of cookies and browser storage to the minimum needed to run our services.

• Website (insiderisk.com): sets no cookies.

• Platform and Portal: set only strictly-necessary cookies and browser storage — required to keep you logged in, to run your assessment reliably, and to keep the service secure — plus one consent-exempt session preference (your microphone choice). Under the ePrivacy Directive all of these are exempt from consent.

We set no analytics, advertising, or tracking cookies or storage anywhere. The only browser storage we use is either strictly necessary or a single consent-exempt session preference (your microphone choice), so we do not display a cookie consent banner — there is nothing requiring your consent.

Cookies and storage by category. We classify into the standard categories below. We use only strictly-necessary storage and one session-scoped functional preference (your microphone selection); we set nothing in the analytics or advertising categories.

What we set:

The Website (insiderisk.com) sets no cookies or browser storage. The Portal sets only the authentication cookie; the local/session-storage items above are used only on the assessment Platform.

Analytics without cookies. Our product analytics (PostHog, hosted in the EU) runs in a cookieless configuration: it stores no analytics cookies or local storage on your device. Any identifiers it uses are held in your browser's memory only, for the duration of your visit, and are discarded when you close the tab.

Session identifier. To run an assessment and to link analytics and error-diagnostic events to a single visit, we assign a randomly generated session identifier and associate events with it. This identifier is held in memory, is not a stored profile, and cannot be used to identify you across other websites.

Your microphone choice. If you select a specific microphone during a voice assessment, that choice is kept in your browser's session storage so a page reload during your visit doesn't lose it. It is discarded when you close the tab, is not stored across visits, and is never shared.

You can block cookies and storage in your browser settings; blocking the authentication cookie may prevent you from logging in, and blocking the progress buffer may make your session less resilient to interruptions.

5. Analytics and AI processing

Analytics: we use PostHog (EU-hosted) for privacy-respectful product analytics and error monitoring. IP addresses are anonymised; the data is not used to identify you personally or track you across other sites. Our assessment videos are hosted and delivered by Mux. We do not enable Mux's viewer-analytics product, so no playback telemetry and no viewer profile are collected. Mux does receive the IP address and browser type of the device requesting a video, as any video host or content delivery network necessarily does, and it is not used to build a profile of you.

AI processing: to deliver assessments and reports, assessment content (such as audio and transcripts) is processed by trusted providers for speech-to-text, voice, and language processing. For some engagements we also run an automated quality-control check on the transcript of a session, to verify transcription accuracy and to flag where a session may not have captured information it should have. The results are stored and used by our team to detect and fix quality issues. They are not shared with the commissioning organisation by default; an organisation can ask us for them. This check does not contribute to your report, and the commissioning organisation can switch it off at any time. All of these providers act as our processors, and our contracts with them prohibit the use of assessment content to train their models.

Review by our team. Where you take part in one of our own (non-commissioned) experiences — for example the free AI Integration experience you sign up for directly — members of the InsideRisk team may review your responses and the resulting report. We do this to operate and support the experience and to analyse and improve our service. We rely on your consent, which you give by ticking the box before you start, and we limit access to staff who need it. You can withdraw this consent at any time (see section 10). Where an organisation has commissioned the assessment, section 9 applies instead.

6. Who we share data with

We share personal data only with service providers ("processors") who help us run our services, under contracts requiring them to protect it. We do not sell personal data. The categories of recipients are:

• Cloud hosting and database providers — to host the applications and store data.

• AI / ML processing providers — for speech-to-text, voice, and language-model processing of assessment content.

• Email-delivery providers — to send reports and service messages.

• Product-analytics providers — for usage analytics and error monitoring.

• Content and video providers — to serve assessment content and media.

A current, named list of our sub-processors — including each provider's location and the safeguard used for any transfer — is available on request at contact@insiderisk.com. We may also disclose data where required by law or to protect our legal rights.

7. International transfers

Where processing takes place. Our primary application database, application hosting and backups are located in the Frankfurt region of Germany. That does not mean all processing is confined to Germany or the EEA. Personnel and service providers may access or process personal data from other countries, as set out below.

InsideRisk SA is established in Switzerland, which the European Commission recognises as providing an adequate level of data protection, so personal data may be transferred from the EEA to us without additional safeguards. Personnel with access to production systems are located in the EEA, the United Kingdom or Switzerland.

Service providers outside Europe. Some providers, or their affiliates and personnel, are located outside the EEA and Switzerland, principally in the United States. Two situations arise:

• Data remains stored in the EU, but the provider's personnel outside the EEA may access it remotely for support, maintenance or security purposes.

• Content is transmitted outside the EEA for a specific processing function.

For some engagements the commissioning organisation enables an automated quality-control check on session transcripts, described in section 5. When it is enabled, transcript content is processed in the United States, and limited request content may be held there in the provider's security and abuse-monitoring logs for up to 30 days. The check is not required to run an assessment, and the commissioning organisation can switch it off at any point during an engagement, not only when it is set up. The commissioning organisation, not the individual participant, decides whether it is used. You can ask the organisation that arranged your assessment which configuration applies.

Where the Reporting Portal is used, your session transcript (without your name or contact details) is processed in the United States by our language-model provider to generate your report, and limited request content may be held there in the provider's security and abuse-monitoring logs for up to 30 days. Report emails, which contain your name and email address and may include a short summary of your report, are sent through an email-delivery provider in the United States.

Safeguards. Depending on the origin of the data and the recipient, we rely on either:

• an applicable adequacy decision, including the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, and only where the relevant United States entity holds a current certification covering the data in question; or

• the European Commission's Standard Contractual Clauses, using the module appropriate to the parties' roles, together with the Swiss addendum recognised by the FDPIC where the transfer originates in Switzerland.

Where we rely on Standard Contractual Clauses, we assess the laws and practice of the destination country and adopt supplementary measures where needed, following the European Data Protection Board's methodology. We will review each assessment at least annually, and whenever a provider's certification, processing location, retention period or sub-processors change.

You can contact contact@insiderisk.com to request the current list of relevant providers and destination countries, the mechanism relied on for each transfer, and a copy of the applicable Standard Contractual Clauses and Swiss transfer terms, redacted only where necessary to protect confidential commercial or security information. Where a commissioning organisation is the controller, we may coordinate your request with that organisation.

8. How long we keep data

We keep personal data only as long as necessary for the purposes above, after which we delete it or irreversibly anonymise it. Where we cannot give a fixed period, we use the following criteria:

• Assessment audio, transcripts and responses on the assessment Platform: deleted or anonymised automatically after the retention period agreed with the commissioning organisation (by default 60 days after your last activity in the session). Where the Reporting Portal is used, the transcript is also kept with your participant record to produce your report, for the duration of the client engagement, unless the organisation has chosen to have transcripts deleted automatically once the report has been generated.

• Reports and participant records (Portal): kept for the duration of the client engagement and a limited period afterwards.

• Free-experience registration and consent records: kept for the duration of the experience and a limited period afterwards; consent records are retained as long as needed to evidence the consent, then deleted.

• Analytics and error diagnostics: retained for a limited period in line with our analytics provider's standard settings, then deleted or aggregated.

• Account data: for the life of the account and a limited period afterwards.

• Enquiry / marketing data: until your request is resolved and a limited period afterwards, or until you object.

Where a service provider keeps limited security or abuse-monitoring logs, those logs are held for that provider's own fixed period and are not necessarily deleted at the same moment as our copy.

9. When the client organisation is the controller

Many assessments are commissioned by an organisation (for example your employer or a client of ours). In those cases that organisation is the data controller and InsideRisk acts as its processor, handling your data on its documented instructions; the organisation's own privacy notice governs why your data is collected and on what basis. Where you sign up for one of our free experiences directly (rather than through an organisation), InsideRisk is the controller and the consent you give at sign-up governs that processing. If you're unsure who arranged your assessment, contact them or us and we'll help direct your request.

10. Your rights

Subject to applicable law, you have the right to: access your data; have inaccurate data corrected; request erasure; restrict or object to processing based on legitimate interests (including our analytics); request portability; and withdraw consent where processing is based on consent, without affecting prior processing. Where you have taken part in a free experience, you can withdraw your consent to our team's review of your data at any time by contacting us; we will then stop that processing and delete the associated free-experience data, subject to the provider log retention described in section 8. To exercise these rights, contact contact@insiderisk.com. Where the client organisation is the controller, we may forward your request to them. You may also lodge a complaint with the data protection authority in your country, or with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

11. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, EU-region hosting where feasible, anonymisation of analytics IPs, and limited retention.

12. Children

Our services are intended for adults. We do not knowingly collect data from children below the applicable age of consent.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the "last updated" date; material changes will be communicated where appropriate.

14. Contact

InsideRisk SA — Route du Lac 27, 1071 Saint-Saphorin, Switzerland — contact@insiderisk.com.