Privacy policy

Who we are

Itematic ApS is a Danish company that builds and operates Itembox, a platform on which HR consultancies, test publishers and the organisations they serve run psychometric tests and questionnaires.

Itematic ApS, CVR 45 27 63 92, Gullfossgade 9, 2., 2300 København S, Denmark, anders@itematic.dk.

Our role depends on the situation. For this website and for our own customer relationships we are the data controller. For the assessments run on Itembox we are a data processor: we process personal data on behalf of, and on the instructions of, our customers, test publishers and consultancies, and the organisations they serve. Which of them is the data controller for an assessment is settled by the arrangement between them, never by Itematic. The information shown to you when you open an assessment tells you who is responsible for yours.

If you were invited to an assessment

You received an email from Itembox because an organisation using the platform registered you for an assessment: typically your employer or a company you are applying to, often through the consultancy or test publisher it works with. They decided to assess you, chose the tests, and entered your name and email address. The data controller for the assessment is one of them, and it is responsible for telling you why you are being assessed and what happens with your results. Itembox shows you its own information and consent text before you answer anything.

What Itembox processes about you

• Your name, email address and preferred language, entered by the organisation.
• The organisation and assessment you were registered for, and the invitations and reminders sent to you, including whether each message was delivered.
• Your answers, when you take a test, and the results derived from them for the organisation's professionals.
• Technical data needed to run the assessment securely: the access link issued to you, when it was used, and the time taken to answer.

Email we send

Itembox sends transactional email only: invitations, reminders, access links and account messages. We send no newsletters or marketing and we do not buy, rent or share address lists. Our emails contain no tracking images and no click tracking; links lead directly to the assessment. We keep a copy of each message for up to 90 days so that the organisation can see whether it reached you, after which the copy is deleted.

If you do not want to take part, you can ignore the invitation or tell the organisation named in the email. If you believe you received a message in error, or you want no further messages, contact the organisation or write to us at anders@itematic.dk, and we will help.

Legal basis and your rights

The legal basis for the assessment is determined by the organisation that assesses you, and it will normally be explained in the information shown to you when you open the assessment. Requests to access, correct, delete or anonymise your data go to that organisation; Itembox gives it the tools to do so, including anonymising your results at your request. You can always also write to us, and we will forward your request or help directly. See Your rights.

If you use Itembox for your organisation

If you have an Itembox account as an assessor or administrator, we process your name, work email address, login details, role and organisation, and a log of the actions you take on the platform. This is necessary to provide the service your organisation has contracted, to keep the platform secure and to show who did what with assessment data. Your organisation is the controller of this data and can ask us to correct or delete it.

If you are a customer or business contact

When an organisation becomes a customer, or someone contacts us about Itembox, we process the contact details, correspondence and contract and billing information needed to answer, to enter into and perform the agreement and to meet our legal obligations, such as bookkeeping (GDPR article 6(1)(b), (c) and (f)). We do not use these details for marketing without asking.

If you visit this website

This website sets no cookies and uses no analytics, fonts or scripts from third parties. It is hosted by GitHub, Inc. (GitHub Pages), whose servers record visitor IP addresses in their logs for security purposes, as described in GitHub's privacy statement. We do not receive or use those logs. Our legitimate interest in publishing information about the company is the legal basis (GDPR article 6(1)(f)).

Where data is processed and who helps us

Itembox and the personal data it holds are hosted with a European hosting provider in data centres in the European Union. Email from the platform is delivered through an email service that processes it in the European Union. Both are bound by a data processing agreement. This website alone is hosted by GitHub, Inc. (GitHub Pages) in the United States under GitHub's standard safeguards for international transfers; see If you visit this website.

A complete list of our processors is provided to our customers as part of the data processing agreement.

Personal data from assessments is not transferred outside the European Union. Should that ever change, we will update this policy and put the safeguards required by GDPR chapter V in place first.

How long we keep data

• Assessment data: for as long as the organisation that assesses you has decided, according to its own retention rules. When that period ends, Itembox anonymises the data: your name and contact details are removed and your answers can no longer be linked to you. The organisation, or you through it, can also have results anonymised earlier.
• Copies of email sent to you: up to 90 days after sending.
• User accounts: for the duration of your organisation's use of Itembox, then deleted or anonymised.
• Customer and contact data: for the duration of the relationship, and thereafter as long as Danish bookkeeping law requires, currently five years from the end of the financial year.

Your rights

Under the GDPR you have the right to access the personal data held about you, to have it corrected or deleted, to restrict or object to its processing, and to receive data you have provided in a portable format. Where processing is based on consent, you may withdraw it at any time without affecting what was done before.

For data processed on Itembox, the organisation that assesses you or employs you is responsible for answering your request, and we assist it. You are welcome to contact us directly at anders@itematic.dk; we will respond or pass your request on without delay.

You also have the right to complain to the supervisory authority. In Denmark that is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

Security

Connections to Itembox and between its components are encrypted. Access to personal data is limited to the people who operate the platform and need it for that purpose, and access credentials and other sensitive fields are stored encrypted. Every access link sent to a test taker is unique, and the platform records who did what with assessment data.

Changes to this policy

We update this policy when the platform, our processors or the law change. The version and date at the top tell you which version you are reading. Material changes affecting people who use Itembox will be announced to the organisations using it.