Visiting this website only? Then we process solely the data you submit via the contact form (name, email address), to respond to your message. We do not use tracking or advertising cookies.

Stiqqo is a product of Stiqqo BV, Chamber of Commerce number 42002895, registered in Bussum, the Netherlands.

Contact: privacy@stiqqo.com

For the delivery of learning programmes, Stiqqo processes personal data as a processor on behalf of the organisation (employer, training provider or trainer) that invited you. For these processing activities that organisation is the controller: it determines the purposes and legal basis for processing your data, and Stiqqo follows its written instructions. For questions about these processing activities, contact that organisation in the first instance; it provides its own privacy information.

For a few limited processing activities Stiqqo itself determines the purposes and means, and Stiqqo is an independent controller. These are:

• Security and error logging: recording technical errors and securing the service, based on our legitimate interest in a secure and properly functioning service.
• Certificate verification: keeping earned certificates verifiable for a fixed period (see Retention periods), based on our legitimate interest and that of certificate holders in reliable, verifiable proof.

Product improvement with anonymous statistics: Stiqqo may aggregate and anonymise usage data on behalf of the controller organisation. Until anonymisation is complete, this remains personal data and Stiqqo acts as a processor. Only after the data can reasonably no longer be linked to a person may Stiqqo independently use the resulting anonymous statistics to improve the service.

You only receive access to Stiqqo through an invitation from an organisation. We receive your name and email address from that organisation.

We process: name and email address, your Google account data if you sign in with it (see below), learning progress and scores, answers to practice questions, time and frequency of use, and practice preferences.

In addition we may process technical data, such as your IP address, sign-in and session timestamps, browser and device data, technical error messages and email delivery status.

Signing in with Google: when you sign in with Google we receive your name, email address, unique Google account identifier and optionally your profile photo. We do not receive your Google password and do not get access to your email, calendar or files.

Special categories of personal data: Stiqqo is not intended for processing special categories of personal data, such as medical data, religious beliefs or trade union membership. We ask you not to include such data in open answers. If such data is entered nonetheless, it is processed solely according to the instructions of the controller organisation and only insofar as a valid legal basis exists.

The organisation that invited you is the controller and can view the following via its environment:

• your participation status, last activity and progress per programme;
• your scores and mastery level per practice moment, in summarised form;
• group reports at cohort level. These contain only aggregated insights and summarised themes. Verbatim answers from participants are not shown to the organisation. Personal reflection questions are never included in group reports.

Individual answers to open questions, separate multiple-choice selections and the automated feedback you receive are not shown to the organisation.

At the request of the controller organisation, Stiqqo may send practice reminders on behalf of that organisation. When these reminders are optional, we ask for your consent on behalf of the organisation. You may withdraw this consent at any time and without disadvantage via your practice preferences in the app. Withdrawal is as easy as giving consent.

For open questions Stiqqo uses artificial intelligence (AI) to generate automated feedback. To generate this feedback, the text of the practice question, your answer and the necessary assessment instructions are provided to our AI service provider. We do not send your name, email address, account number or other direct identifiers with it.

Our AI service provider retains the input and output for a maximum of 30 days and does not use them to train general AI models. Stiqqo has not consented to the use of this data for model training and does not provide participant answers as product feedback to the AI service provider.

AI feedback may be incorrect or incomplete and is not used for decisions with legal effects or similarly significant effects for you. AI-generated feedback is labelled as such in the app.

Stiqqo analyses your answers, results and usage moments to determine which topics you are offered again and when that happens. This is a form of automated personalisation, intended to support your learning process. This personalisation does not independently take decisions with legal effects or similarly significant effects for you.

We work with carefully selected service providers for hosting, database, email delivery, AI feedback and error logging. We have data processing agreements with all parties. Our application and database run within the European Union.

When personal data is processed outside the EEA, we use a transfer mechanism permitted under the GDPR, such as an adequacy decision, the EU-US Data Privacy Framework for certified US organisations, or standard contractual clauses combined with supplementary measures where necessary.

A current list of sub-processors, their function and processing location is available via privacy@stiqqo.com.

We never sell your data to third parties and do not use it for advertising purposes.

Stiqqo uses only functional cookies that are necessary for signing in and operating the service. We do not use tracking or advertising cookies.

• Account data (name, email address, preferences): up to 90 days after your participation ends, unless your organisation requests earlier deletion.
• Answers and individual results: up to 90 days after your participation ends. They are then anonymised: scores and topics may be retained in non-identifiable form for reporting to your organisation; the link to your name or account is permanently removed.
• Certificate data (name, programme, date, result): 12 months after issuance of the certificate, so that verification remains possible during that period, even if your account has already been deleted. This data is recorded separately at issuance and is independent of your account. Verification works solely via a unique, non-searchable verification code; only someone who has that code can view the data.
• Email delivery data: 30 days.
• Security and error logging data: 30 days.
• Back-ups: up to 30 days after deletion of the source data.

Depending on the processing and the applicable legal conditions, you have among other things the right of access, rectification, erasure, restriction, data portability and objection.

Where processing is based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal. You may also object, on grounds relating to your particular situation, to processing that Stiqqo carries out on the basis of a legitimate interest.

For processing for which your organisation is the controller, we advise you to direct your request to that organisation in the first instance. If you contact Stiqqo directly, we forward your request to the controller organisation and support it in handling the request; the controller responds in principle within one month. This period may be extended under the GDPR for complex or multiple requests.

For processing for which Stiqqo itself is the controller, such as security and certificate verification, Stiqqo handles your request itself, in principle within one month. Contact: privacy@stiqqo.com.

You have the right to lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl, 088 1805 250.

We take appropriate technical and organisational measures to protect your personal data, including encrypted connections, role-based access restrictions and database-level security.

In the event of material changes we will inform you by email. The date of the last update is shown at the top of this document.

Stiqqo BV, version 1.3

Stiqqo BV, Roodborstlaan 6, 1403 EL Bussum, the Netherlands. privacy@stiqqo.com