Privacy Policy
Last updated: October 8, 2026. Version 1 of this document.
This policy explains what personal data we process when you use the International DISC Institute platform — the public website, the graduate directory, the campus where exams are taken and the areas for teachers and administrators — and what you can do about it.
1. Who is responsible for your data
The controller is International DISC Institute, a non-profit organization registered in the United States under number 6226774, with its registered address at 8 The Green, Suite B, Dover, DE 19901, USA. For any question about your data, or to exercise your rights, write to info@interdisc.org. We have not appointed a data protection officer.
Representative in Switzerland (Swiss Federal Act on Data Protection): Brigite Schuler, Schaffhauserstrasse 5, 8212 Neuhausen am Rheinfall, Switzerland. Representative in the European Union (article 27 GDPR): Brigite Schuler, Calle Gaztambide 81, 28003 Madrid, Spain.
2. What data we process and why
We only process data you give us, data generated when you use the platform, or data entered by the person who invites you (the Institute or your teacher). We do not buy data and we do not sell it.
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email, password (stored only as a bcrypt hash), role, language, country, city, profile photo | Provide the service and let you sign in | Performance of the contract (art. 6.1.b GDPR) |
| Exams: attempts, answers, scores, grading and files you attach | Assess you and issue your certification | Performance of the contract |
| Diplomas and seals: your name, the exam, number, score, issue and expiry dates | Issue your certification and let third parties verify it through the QR code | Performance of the contract |
| Directory profile: display name, photo, country, city, languages, bio, specialties, company, social links, website | Show you in the public graduate directory. You decide whether your profile is visible and what it shows | Performance of the contract |
| Subscriptions: level, status, dates and Stripe customer and subscription identifiers. We never see or store your card | Charge and renew paid certifications and directory plans | Performance of the contract; legal obligations (accounting) |
| Contact form: name, surname, email, phone, country, city and message | Answer you. The contact is stored in our email tool. We do not subscribe you to any newsletter | Your request (art. 6.1.b) and our legitimate interest in following it up (art. 6.1.f) |
| Acceptance of the Terms and this policy: documents, version, language, IP address, browser and date | Prove what you accepted and when | Legal obligation and legitimate interest (art. 6.1.c and f) |
| Cookie choice: categories, policy version, language, truncated IP, browser and date | Prove your consent or refusal | Legal obligation (art. 6.1.c) |
| Security: failed sign-in attempts (email, IP), administration audit log, error log | Protect accounts and the platform | Legitimate interest (art. 6.1.f) |
3. Automated grading
Open-ended answers can be graded with the help of artificial intelligence (OpenAI). We only send the question, your answer, the reference solution and the grading criteria: never your name or your email. A teacher or administrator can review and change any grade, and you can ask for a human review by writing to us.
4. Who receives your data
Other users only see what the platform shows them: your teacher sees your exams; anyone can see your directory profile if you make it visible, and anyone with your seal can verify your certification while your account exists. We use these providers, who process data on our behalf under a contract:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Application server and database | Helsinki (Finland) |
| DigitalOcean LLC | Database backups and file storage (diplomas, seals, photos, exam images) | Amsterdam (Netherlands) |
| Mailjet (Sinch) | Transactional email and contact lists | European Union |
| OpenAI | Grading of open-ended answers | United States |
| Stripe | Payments and subscriptions | European Union and United States |
| Google (reCAPTCHA) | Spam protection on the contact form | United States |
| Sentry | Application error reports (European region, no session recording) | European Union |
| Google Analytics, Google Ads, Google Tag Manager, Meta and Microsoft Clarity | Only if you accept the corresponding cookies: see the Cookie Policy | United States |
We may also disclose data when required by law or a competent authority.
5. International transfers
Our server, database, backups and files are in the European Union. Some providers (OpenAI, Stripe, Google, Meta, Microsoft) may process data in the United States. We rely on the EU–US Data Privacy Framework where the provider is certified and, otherwise, on the European Commission standard contractual clauses.
6. How long we keep your data
| Data | Period |
|---|---|
| Account, exams, diplomas, seals and directory profile | While your account exists |
| Register of certifications issued, after your account is deleted | For as long as the Institute exists, like the register of qualifications of any educational institution |
| Record of the deletion (without your email: only a hash of it) | The same period as the register of certifications |
| Record of cookie choices on our server | 24 months, then deleted automatically |
| Expired sessions, verification links and invitations | Deleted automatically once expired (invitations, 90 days after expiry) |
| Failed sign-in attempts | Deleted automatically after the lockout window |
| Payment data | As long as accounting and tax law requires |
| Your cookie choice in your browser | 12 months, then we ask again |
7. Deleting your account
To delete your account, write to info@interdisc.org from the email address of the account. An administrator will first send you, if you wish, a copy of your data (JSON) and will then delete it. We answer within one month.
- You lose access, and your account and directory profile disappear.
- Your diplomas and seals are deleted with their files, and the QR codes stop verifying your certification.
- Like any educational institution, we keep an internal register of the certifications issued (the name on the certificate, exam, number, date and score). It is only visible to our administrators, it is never published and it is not linked to your email: we keep only a hash of it, to recognise a later request from you.
8. Your rights
You can ask for access, rectification, erasure, restriction, portability and object to processing based on legitimate interest, and you can withdraw your consent at any time without affecting earlier processing. Write to info@interdisc.org; it is free and we reply within one month. You can change your cookie choice at any time from "Cookie settings" at the bottom of the page.
You can also complain to the data protection authority of the country where you live or work in the European Economic Area, to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the UK Information Commissioner’s Office (ICO).
9. Minors
Accounts are only for people aged 16 or over, or the higher minimum age required by the law of the country where they live. If you believe a minor has given us data, write to us and we will delete it.
10. Security
We use HTTPS, hashed passwords, role-based access with an audit log for administrators, sign-in rate limiting and lockout, and backups. If a breach puts your data at risk we will notify the competent authority and, where required, you.
11. Changes and languages
We will publish any change on this page with a new date and version, and we will tell you before it applies if it is significant. This document is published in several languages. Translations are provided as a courtesy; if there is any difference between versions, the English version prevails.