Confidentialité
Privacy Policy
What WhoTest collects, why, what it publishes, and how long it is kept.
1. Who is responsible
1.1 The controller of the personal data processed through https://www.whotest.com is WhoTest Editions Limited (C 114703), .
1.2 Any question about this policy, and any request to exercise a right, can be sent to [email protected].
2. Scope
2.1 This policy covers the data processed when a visitor browses https://www.whotest.com, takes a test, creates an account, subscribes, appears on the ranking, obtains a certificate, or contacts support.
2.2 It applies under Regulation (EU) 2016/679 (GDPR) and the Maltese Data Protection Act, together with the local law of the user's country of residence where that law affords additional protection.
3. What is collected
Account data — Email address, name, a hashed password or the identifier of the social account used to sign in, and language.
Attempt data — The test taken, the answers given, the time taken, the score, the level and the percentile. A test may be started before an account exists, in which case the attempt is attached to a technical cookie until the account claims it.
Ranking data — Where the user chooses to appear: the display name, the country and, if given, the city.
Certificate data — The name shown on a certificate, the test, the score and the date of issue.
Billing data — Subscription and payment records, amounts, dates and status, and the invoices issued, which carry the buyer's name and address. Card details are entered directly with the payment provider and are never received by WhoTest.
Support data — The content of messages sent through the contact form or by email.
Technical data — IP address, user agent, timestamps, application logs and error reports, and the anti-abuse signals produced when an account is created.
3.1 Answers to a test are ordinary personal data. WhoTest does not present its tests as clinical or medical instruments and does not treat a result as health data; nothing in the catalogue asks for a diagnosis, a treatment or a medical history.
4. What is published, and by whose decision
4.1 Two things can leave the account, and both are the user's own decision: an entry on the ranking, and a certificate shared by its link. Nothing else about a user is ever published.
4.2 A ranking entry shows the display name chosen, the country, the city where one has been given, the score and the time taken. A user may appear without a name, and may withdraw from the ranking at any time from their account: the entry then disappears, and the result stays in the account.
4.3 A certificate carries a link that lets anyone holding it verify the certificate and read the name, test, score and date it states. The link is the only access control: once shared it is readable by whoever receives it. A certificate can be revoked from the account, after which its link shows it as revoked.
4.4 Ranking pages and certificate verification pages may be indexed by search engines. Choosing a display name that does not identify you is the way to appear on the ranking without being found by name.
5. Why it is processed, and on what basis
| Purpose | Legal basis |
|---|---|
| Running a test, scoring it and producing the result | Performance of the contract |
| Attaching an anonymous attempt to the person who ran it, then to their account | Performance of the contract |
| Issuing and verifying certificates | Performance of the contract |
| Publishing a ranking entry | Consent, given by choosing to appear and withdrawable at any time |
| Computing percentiles and statistics from completed attempts, in aggregate | Legitimate interest |
| Creating and maintaining the account; authenticating the user | Performance of the contract |
| Taking payment, issuing invoices, keeping accounting records | Performance of the contract; legal obligation |
| Preventing fraud, cheating and payment disputes | Legitimate interest in protecting the service |
| Answering support requests | Performance of the contract; legitimate interest |
| Measuring audience and improving the service | Legitimate interest |
| Responding to a request from a competent authority | Legal obligation |
5.1 Scoring is automated, and this is the purpose of the service. It produces no legal effect and nothing similarly significant: the Terms forbid using a result or a certificate as a factor in a decision about employment, education, credit, insurance or eligibility for a benefit. A user may always ask for a scoring to be reviewed by writing to [email protected].
6. Who else processes the data
6.1 Personal data is never sold or rented. It is shared only with the providers below, each bound by a data-processing agreement, and with a public authority where the law requires it.
| Provider | Role | Data concerned |
|---|---|---|
| OVHcloud (OVH SAS) | Hosting of the application, the database and the object storage, in the European Union | All data held by the service |
| Stripe Payments Europe, Ltd. | Payment, card storage, subscription management and fraud prevention | Billing identity, payment method, transactions |
| Cloudflare, Inc. | Content delivery, protection against attacks, and the anti-bot check on sign-up | IP address, request metadata |
| Resend, Inc. | Sending transactional email | Email address and message content |
| Google Ireland, Ltd. | Audience measurement and tag management | Browsing data and cookie identifiers |
7. Transfers outside the EEA
7.1 The application, the database and stored documents are hosted in the European Union.
7.2 Some providers listed above process data outside the European Economic Area. Those transfers are covered by the European Commission's Standard Contractual Clauses and: where the provider is certified: by the EU–US Data Privacy Framework.
8. How long it is kept
| Category | Retention |
|---|---|
| Account data | For as long as the account exists |
| Attempts, answers and results | For as long as the account exists, or until the user deletes them |
| An attempt started without an account and never claimed | 12 months, then deleted |
| Ranking entries | Until withdrawn by the user, or until the account is deleted |
| Certificates | For as long as the account exists; a revoked certificate keeps its revocation record |
| Invoices and accounting records | 10 years, as required by accounting and tax law |
| Application logs and technical data | 12 months |
| Support correspondence | 3 years from the last exchange |
| Audience-measurement cookies | 13 months at most |
8.1 Deleting the account removes the account, its attempts, its results, its certificates and any ranking entry. Records that the law requires WhoTest to keep: invoices above all: are retained for their statutory period; everything outside that set is deleted or irreversibly anonymised. Aggregate statistics that identify nobody are retained.
9. Security
9.1 Traffic is encrypted in transit. Passwords are stored hashed, never in clear. A result is readable only by the account or the visitor that produced it, checked on every read; the correct answers of a test never leave the server.
9.2 Access to production systems is restricted to the staff who need it, over a private network, and is logged.
9.3 Where a breach is likely to result in a high risk to users' rights, the affected users and the supervisory authority are notified within the periods the GDPR prescribes.
10. Cookies and similar technologies
10.1 The Site uses:
- strictly necessary cookies: the session, the language, the anti-bot check, the security protections, and the cookie that attaches an attempt begun without an account to the person who began it;
- audience-measurement cookies (Google Analytics, deployed through Google Tag Manager) that measure how the Site is used, in aggregate;
- an attribution cookie recording how a visitor reached the Site, used to measure advertising.
10.2 Measurement and attribution cookies can be refused through the browser's settings, or through Google's own opt-out add-on. Refusing strictly necessary cookies prevents the service from working: an attempt could not be resumed or paid for.
11. Rights of the data subject
11.1 Every user has the right of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw a consent already given: in particular the consent to appear on the ranking: without that affecting what was done beforehand.
11.2 Several of these can be exercised directly: a ranking entry can be withdrawn, a certificate revoked, a result deleted, and the account itself deleted, all from the account settings.
11.3 Any other request can be sent to [email protected]. It is answered within one month, extendable by two months where the request is complex.
11.4 A user who considers their rights have not been respected may complain to the Office of the Information and Data Protection Commissioner in Malta, or to the supervisory authority of their own country of residence.
12. Minors
12.1 An account may be created only by a person aged eighteen (18) or over. A minor may take a test with the agreement of the holder of parental responsibility, who is responsible for the account used.
12.2 A ranking entry or a certificate concerning a minor is removed on request from the holder of parental responsibility, sent to [email protected].
13. Changes to this policy
13.1 This policy may be updated. The version that applies is the one published on the Site at the time of consultation; a material change is notified by email or in the account.
Questions about this document?
Our team answers your questions and guides you on everything.