Privacy Statement
Esperto B.V. builds, hosts and distributes online assessments for experts, coaches and the organizations they work with. Handling personal data carefully is not a side activity for us; assessment answers say something about how people experience their work, and that deserves care. This statement explains what personal data we process, why we process it, on what legal basis, how long we keep it and which rights you can exercise.
- We process personal data of website visitors, newsletter subscribers, business contacts and assessment respondents.
- For some processing we are the controller. When a coach, consultant or organization runs an assessment with their own clients or employees, they are the controller and we act as their processor.
- We do not sell personal data, and we do not use assessment answers for advertising.
- Esperto does not use assessment outcomes to make decisions about you with legal or similarly significant effects.
- Some of the data we hold about you reaches us from someone else, for example when a coach or employer invites you to an assessment. We say where it came from.
- You can ask us at any time what data we hold about you, and ask us to correct or delete it.
- If you are unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Who we are and how to reach us
Esperto B.V. is a Dutch private limited company based in Utrecht. We operate an assessment platform and a marketplace of expert assessments, and we work with the experts who own the underlying methodologies and with the coaches and consultants who deploy them.
Controller
Esperto B.V.
Europalaan 93
3526 KP Utrecht
The Netherlands
Registration
Chamber of Commerce (KvK): 88522237
VAT: NL864666536B01
Privacy contact
Data Protection Officer
Esperto is not required to appoint a Data Protection Officer and has not appointed one. Privacy questions are handled by the privacy contact above.
Which services this statement covers
- The website espertoassessments.com, including all subpages and forms.
- The domain esperto.one and its subdomains, including the checkout environment pay.esperto.one and the booking link crowd.esperto.one.
- The Esperto assessment platform, where assessments are completed and reports are generated. The platform runs on servers in the Netherlands, managed by our hosting partner ACC & ICT.
- Our newsletters, email communication and commercial contact with coaches, experts and partners.
This statement does not cover websites, tools or platforms of third parties that we link to. Those parties have their own privacy statements.
When is Esperto a controller, and when a processor?
This matters, because it determines who you should contact about your data. Under the GDPR, the controller decides why and how personal data is processed. A processor only acts on the controller's documented instructions. Esperto has both roles, depending on the situation.
Our own website, marketing and customer relationships
We decide the purpose and the means ourselves, so we are responsible for this processing:
- Visits to our websites and the use of cookies.
- Contact forms, discovery call bookings and email correspondence.
- Our newsletter and other commercial communication.
- The commercial relationship with customers, coaches, experts and partners, including invoicing.
- Assessments that an individual or organization buys directly from Esperto, without a coach or partner in between.
Assessments deployed by a coach, consultant or employer
When a coach, consultant, expert or employer runs an assessment with their own clients, team or employees, that organization is the controller. Esperto processes the data on their instructions under a data processing agreement, which means:
- They decide who is invited, which questions are asked and who receives the report.
- They decide how long the data is kept. At their instruction we delete the data or return it, and we keep no copy of our own beyond what the agreement allows.
- We do not use their respondent data for our own purposes, and never for marketing.
- If you are a respondent and you want to exercise your rights, contact that organization first. If you contact us instead, we will forward your request to them without undue delay and tell you that we have done so.
Do you deploy Esperto assessments with your own clients or employees? Then you need a data processing agreement with us. We have a standard data processing agreement ready. Ask for it at privacy@esperto.one.
What personal data we process, and why
The table below sets out our processing activities: which data we process, for what purpose, on which legal basis under Article 6 of the GDPR, and how long we keep it. Where a legal basis is our legitimate interest, we have weighed that interest against your privacy, and you can always object.
| Who and what | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Website visitors | IP address, device and browser type, pages viewed, referring page, date and time, cookie identifiers. | Making the website work, keeping it secure, and understanding in aggregate how it is used. | Legitimate interest for functional and security data. Consent for analytics and marketing cookies. | Server logs: 6 months. Analytics data: 14 months. |
| Contact forms and discovery calls | Name, email address, telephone number if you give it, company, role, your message, and the details of a booked meeting. | Answering your question, preparing and holding the conversation, and following up on it. | Steps taken at your request prior to entering into a contract. Where no contract follows, our legitimate interest, namely answering your question and maintaining commercial contact. | 24 months after our last contact. |
| Newsletter and marketing | Name, email address, company, subject interests and tags, and engagement data such as opens and clicks. | Sending our newsletter and relevant updates, and keeping the mailing relevant rather than sending everything to everyone. | Consent, if you subscribed yourself. If you gave us your email address when buying a product or service from us, we may instead rely on our legitimate interest in telling you about our own similar products and services, as permitted by Article 11.7 of the Dutch Telecommunications Act. You are offered an opt-out both when we collect your address and in every message. Opens and clicks are only measured with your consent. | Until you unsubscribe, then 12 months. We keep a minimal record of your unsubscribe indefinitely, so that we do not email you again by accident. |
| Customers, coaches, experts and partners | Contact and company details, contract and agreement data, correspondence, account and usage data, payment and invoicing data. | Entering into and performing the agreement, providing support, administration, and meeting our statutory obligations. | Performance of the agreement for contract and account data. Legal obligation for invoicing and accounting data. Legitimate interest, namely maintaining our commercial relationship, for correspondence and relationship management. | Invoicing and accounting data: 7 years, the statutory Dutch tax retention period. Other relationship data: 2 years after the end of the relationship, and 5 years for contract documentation, in line with the general limitation period. |
| Assessment respondents, Esperto as controller | Name, email address, organization, role or team where relevant, your answers to the questionnaire, the resulting scores and the report, and any free text you enter. | Delivering the assessment you or your organization purchased, generating the report and providing support. | Performance of the agreement, if you purchased the assessment yourself. If someone else purchased it and invited you, our legitimate interest in delivering the service that was ordered, or your consent where participation is voluntary. | For as long as the account is active, then 24 months. Shorter on request. |
| Assessment respondents, Esperto as processor | The same categories, but processed on behalf of the coach, consultant, expert or employer who commissioned the assessment. | Only the purposes set by that controller and recorded in the data processing agreement. | Determined by that controller. Esperto has no independent basis and acts only on their instructions. | Set by that controller in the data processing agreement. We delete or return the data at their instruction. |
| Payments and invoicing | Name, email address, billing address, order details, transaction and payment status. Card details are entered directly with our payment provider and are never stored by Esperto. | Processing your payment, delivering your order and complying with accounting rules. | Performance of a contract and legal obligation. | 7 years, the statutory Dutch tax retention period. |
| Experts applying to work with us | Name, contact details, company, description of your methodology, materials you send us and our notes on the conversation. | Assessing whether a partnership makes sense and, if so, preparing it. | Steps taken at your request prior to entering into a contract, and our legitimate interest, namely assessing and building our portfolio of expert partnerships. | 24 months, and longer only with your consent. |
Special categories of personal data
We do not ask for special category data. Our assessments are not designed to collect data on health, religion, ethnic origin, political opinions, trade union membership, sexual orientation or criminal records, and we ask you not to enter such data in free text fields. We have no basis under Article 9 of the GDPR to process such data, so if it reaches us anyway we delete it as soon as we become aware of it. [TO CONFIRM: Luud, please check whether any current assessment includes items that could be read as health or wellbeing data, for example questions on stress or work happiness.]
Where your data comes from
Most of the data we hold you gave us yourself, by filling in a form, sending us an email or completing an assessment. Some data reaches us from somewhere else:
- From the person or organization that invited you. When a coach, consultant, expert or employer sets up an assessment, they provide us with your name, email address and often your role or team, so we can invite you. Where we act as their processor, they are the ones who have to tell you this; where we act as controller, this paragraph is that notice.
- From your own use of our website, through cookies and server logs, as described in the table above and in the cookie section.
- From public professional sources, such as a company website or a public LinkedIn profile, when we research a possible partnership or approach an expert. In that case we process your business contact details on the basis of our legitimate interest in professional outreach, and you can object at any time. [TO CONFIRM: Eric, this covers outreach lists such as the LinkedIn track. Confirm which sources are actually used.]
Whether you have to provide data
Providing data is not a statutory obligation, except for the data we need on an invoice, which Dutch tax law requires us to record and keep. For the rest it is a contractual necessity: without an email address we cannot send you an assessment invitation or a report, and without billing details we cannot deliver a paid order. Other fields are optional, you can leave them out without consequences, and where a form field is required we mark it as such.
Who we share your data with
We do not sell personal data, we do not trade it, and we do not use assessment answers for advertising.
We do use other parties to run our business, and they come in two kinds. Processors act only on our instructions, under a data processing agreement, and may not use the data for their own purposes. Independent controllers receive data from us but decide for themselves what they do with it, under their own privacy statement and their own legal obligations. Each card below says which kind it is.
Website hosting
Hostinger, for espertoassessments.com and the checkout environment. [TO CONFIRM: which Hostinger data center region]
Assessment platform
ACC & ICT, which hosts and manages the environment where assessments are completed and reports are generated, on servers in the Netherlands.
Email and office software
Microsoft 365 for email, documents, storage and the booking of discovery calls.
Email marketing
ActiveCampaign for our newsletter, subscription management and engagement measurement.
Payments
Stripe for payment processing. You enter your card details directly with Stripe, which acts as an independent controller for that part and applies its own privacy statement.
Accounting
Our accountant, who has statutory duties of their own, and the accounting software we use for invoicing and administration. [TO CONFIRM: parties, and whether the software supplier is a processor rather than a controller]
The coach or organization that commissioned the assessment
They receive the report, and they decide what happens with it. The expert who owns the methodology receives usage data at aggregate level, not individual answers. [TO CONFIRM: is this accurate for every partnership?]
Advisers and authorities
Lawyers, auditors or authorities, only where we are legally required to share data or need to establish or defend a legal claim.
On request we will provide the current, named list of the parties we share data with, including the country in which they process it. [TO CONFIRM: Eric and Luud to complete this list in the internal processing register before publication, and to check that a data processing agreement is in place with every party marked as processor.]
Transfers outside the European Economic Area
Some of the parties we work with are established in the United States or process data there. Where that happens we rely on an appropriate transfer mechanism under Chapter V of the GDPR: either an adequacy decision by the European Commission, including the EU-US Data Privacy Framework for suppliers that are certified under it, or the European Commission's Standard Contractual Clauses combined with additional measures where our assessment shows they are needed. Ask us at privacy@esperto.one which mechanism applies to a specific party and we will send you a copy of the safeguards, with commercially confidential terms removed. [TO CONFIRM: record per supplier which mechanism applies, in particular for ActiveCampaign, Microsoft and Stripe. The assessment platform is hosted in the Netherlands, so no transfer arises there.]
How we protect your data
We take appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access. What we do:
- Encrypted transport of all traffic between your browser and our systems.
- Assessment data is hosted on servers in the Netherlands, managed by our hosting partner ACC & ICT.
- Access on a need-to-know basis, with individual accounts and multi-factor authentication for administrator access. [TO CONFIRM]
- Regular backups, so data can be restored after an incident. [TO CONFIRM: frequency and retention]
- Data processing agreements with the suppliers who process personal data on our behalf, and a standard data processing agreement for the customers on whose behalf we process.
- Confidentiality obligations for everyone who works for or with Esperto.
Data breaches. If a breach occurs that is likely to result in a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we inform you as well, unless the law allows us to communicate publicly instead. Where we act as a processor, we notify the controller without undue delay so they can meet their own obligations.
Profiling and automated decision-making
Our assessments score your answers automatically and generate a personal report from them. That is profiling within the meaning of Article 4 of the GDPR: an automated evaluation of personal aspects, such as how you work or how you experience your team. We are open about that, because it is the whole point of an assessment. The scoring logic and the meaning of each dimension are described on the page of the assessment concerned, and you can always ask us how your outcome was calculated.
Esperto does not use assessment outcomes to make decisions about you. We produce the report; we do not decide anything about your job, your pay or your position on the basis of it. There is therefore no automated decision-making with legal or similarly significant effects within the meaning of Article 22 of the GDPR on our side.
An important note for employers and coaches. If you deploy an Esperto assessment, you are the controller for what you do with the outcome. Using an assessment result as the sole basis for a decision about selection, promotion, remuneration or dismissal can amount to automated decision-making under Article 22, with obligations that fall on you, and it is not what these instruments are built for. A meaningful human assessment is required. [TO CONFIRM: this needs to be stated in the terms of use and in the data processing agreement, not only here. Luud to add it there.]
Children
Our services are aimed at professionals and organizations, and are not directed at people under 16. We do not knowingly collect personal data of children. If you believe we have done so anyway, contact us and we will delete the data.
Your rights
The GDPR gives you a set of rights over your personal data. You can exercise them free of charge, and you do not need to explain why. We answer within one month; if a request is complex we may extend that by two months, and we will tell you before the first month is up. Only if a request is manifestly unfounded or excessive, for example because it is repeated endlessly, may we charge a reasonable fee or refuse it, and then we will tell you why.
Access
Ask which personal data we hold about you and receive a copy of it.
Rectification
Have data corrected or completed if it is inaccurate or incomplete.
Erasure
Have your data deleted, unless we are legally required to keep it, for example invoicing data.
Restriction
Have processing paused, for example while a correction request is being assessed.
Portability
Receive the data you gave us in a structured, commonly used and machine-readable format, or have it sent to another party. This covers data we process automatically on the basis of your consent or an agreement.
Objection
Object to processing based on our legitimate interest. Against direct marketing your objection is always granted.
Withdraw consent
Withdraw consent at any time. That does not affect the lawfulness of what happened before.
Complain
Lodge a complaint with a supervisory authority if you believe we are handling your data incorrectly.
Your right to object to direct marketing
We point this one out separately, because the law asks us to and because it is the right people use most. You can object to direct marketing at any time, and we will stop. No reason needed, no questions asked. Every email we send contains an unsubscribe link, and one email to privacy@esperto.one has the same effect.
How to exercise your other rights
Send your request to privacy@esperto.one. To protect your data against someone requesting it in your name, we may ask for additional information to verify your identity. We only ask for what is strictly necessary, and we do not keep those verification details.
Did you complete an assessment through a coach, consultant or employer? In that case they are the controller and Esperto is only the processor. Send your request to them. If you send it to us, we will forward it to them without undue delay and let you know that we have.
Not satisfied with our response? You can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, via autoriteitpersoonsgegevens.nl. If you live in another EU country, you can also complain to the supervisory authority there. We would appreciate the chance to resolve it with you first.
Changes to this statement
We update this privacy statement when our services, our suppliers or the applicable rules change. The version number and the date at the top of this page always show which version applies. For substantial changes that affect you directly we will notify you actively, by email or through a notice on the website, before the change takes effect.
Earlier versions are available on request, so you can check which text applied at a given moment.
Questions about your data?
Ask them. A privacy question is never a nuisance, and you should not need a lawyer to find out what happens to your data. Email privacy@esperto.one or write to Esperto B.V., Europalaan 93, 3526 KP Utrecht, The Netherlands.
Email our privacy contactVersion 1.0, 13 August 2026. Esperto B.V. is established in the Netherlands, so Dutch data protection law and the supervision of the Autoriteit Persoonsgegevens apply to our processing. This statement is published in English. [TO CONFIRM: a Dutch version is advisable for Dutch respondents. Article 12(1) of the GDPR requires the information to be intelligible to the person it concerns, and many respondents complete assessments in Dutch. Decide with Luud whether the Dutch version is published alongside this one, and drop any clause that gives the English text precedence over it.]