Assessment Data Security

On servers in data centers in the Netherlands, operated by our hosting partner ACC ICT B.V. All data centers involved, including the location that holds the replicated backups, are in the Netherlands, and stored assessment data does not leave the Netherlands.

No. Respondent data, answers, scores and reports are stored and processed in the Netherlands and are not transferred outside the EEA. Other customer data, such as an email from a customer contact person, is only processed outside the EEA under an adequacy decision or the Standard Contractual Clauses, after an assessment of the destination country, and only where the transfer is listed in Annex 3 of the data processing agreement with the mechanism used.

Three. ACC ICT B.V. in Nieuwegein, the Netherlands, hosts and manages the assessment platform including backups. Hostinger International Ltd. in Larnaca, Cyprus, hosts the website and checkout in a data center in Germany and does not process assessment data. Microsoft Ireland Operations Limited in Dublin, Ireland, provides the email and documents Esperto staff use for support, within the Microsoft EU Data Boundary. Esperto gives 30 days' written notice before adding or replacing a sub-processor, and customers may object on reasonable grounds.

No. Esperto B.V. holds no security certification of its own and does not hold a SOC 2 report. Our hosting partner ACC ICT holds its own certifications; their current status is stated in Annex 2 of our data processing agreement, and certificates are available on request through privacy@esperto.one. We state the position exactly as it is, so that your questionnaire can record it correctly.

Organizations that run assessments in their own environment can switch on single sign-on and enforce it for their users. Authentication then runs through the organization's own identity provider, including any multi-factor requirement that provider applies. Where single sign-on is not switched on, users sign in with an email address and a password. Respondents access their questionnaire through a personal invitation. Esperto's own administrator access uses individual accounts with strong, unique passwords, and access to the hosting partner's management portal requires two-factor authentication with a software token.

Our hosting partner makes automated daily backups of the hosted application landscape on a disk-to-disk-to-disk basis and replicates them to a second, geographically separate data center in the Netherlands. Standard backup retention is seven days and can be adjusted on request. Restores are tested periodically, including a check that restored data is usable and not merely present. Active storage is replicated to a storage environment outside the data center in which it runs.

Esperto notifies the customer without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting customer personal data. The notification contains, as far as known at that moment, the nature of the breach, the categories and approximate number of respondents and records concerned, the likely consequences, the measures taken or proposed, and a contact point at Esperto, with further information following in phases. Notifying the supervisory authority and respondents remains the controller's responsibility; the 48-hour term leaves room for the controller's own 72-hour obligation.

Retention is set by the controller and recorded in Annex 1 of the data processing agreement; the default is until the end of the services. Within 30 days after the end of the services the customer instructs Esperto whether the data is to be returned or deleted. Return takes place through an export in a structured, commonly used and machine-readable format. Esperto deletes the data, and ensures that its sub-processors delete it, within 30 days after the instruction, and confirms deletion in writing on request. Data in backups is overwritten in the hosting partner's normal backup cycle, with a standard retention of seven days.

No. Esperto does not use customer personal data for marketing, for profiling for its own account or for the development of new products. Statistical use of assessment data, such as norm groups and the validation of an assessment, takes place only on pseudonymised data from which name, email address and other direct identifiers have been removed and kept separately. It never results in a report at the level of an individual respondent, and it rests on an authorization in the data processing agreement that the controller can withdraw at any time.

Not on Esperto's side. The platform scores answers automatically and generates a report, which is profiling within the meaning of Article 4(4) GDPR, and Esperto is open about that. Esperto takes no decision about any respondent. Organizations that use our assessments agree in the data processing agreement not to use an outcome as the sole basis for a decision on selection, recruitment, promotion, remuneration or termination, and to have every such decision involve a meaningful assessment by a person with the authority and the competence to depart from the outcome.

Yes. In the first instance Esperto provides the data processing agreement and its annexes, answers to a reasonable written security questionnaire, and any recent report or attestation that Esperto or its hosting partner holds. Where that information does not reasonably suffice, the customer or an independent auditor bound by confidentiality may audit Esperto's compliance: at most once every twelve months unless there has been a breach or a supervisory authority requires it, announced 30 days in advance with a stated scope, during business hours, and limited to the systems, documents and people involved in the processing. In the sub-processor situation the end client exercises these rights through our customer, or directly where its contract with our customer requires that.

Yes. Esperto has a standard data processing agreement under Article 28 GDPR, version 2.2 of 6 September 2026, in English with a Dutch translation available. It is written so that it works both where our customer is the controller and where our customer is itself a processor for an end client and Esperto is the sub-processor, without amendment. Its annexes describe the processing, the technical and organizational measures and the sub-processors, and may be passed on to the end client and to a supervisory authority.

No. The questionnaires do not ask for special categories of personal data within the meaning of Article 9 GDPR or data relating to criminal convictions, and free-text fields carry an instruction not to enter such data. Respondents are identified by name and email address, with organization and role or team where applicable; no government identification numbers are collected. If special category data nonetheless reaches the platform, Esperto deletes it once identified and informs the customer.

The organization that commissioned the assessment, such as the coach, consultant or employer, because that organization is the controller. If a request reaches Esperto directly, Esperto does not answer it on the merits but forwards it to the customer without undue delay and tells the respondent that it has done so. Reports and respondent data can be exported from the platform in a structured, commonly used and machine-readable format to support access and portability requests.