Privacy Policy

This Privacy Policy explains how BioQuant IQ GmbH in Gründung (“BioQuant IQ”, “we”, “us”) processes personal data in connection with the Arena website and product. We are committed to processing personal data lawfully, fairly and transparently under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

1. Who we are

The data controller is BioQuant IQ GmbH in Gründung, Baselmattweg 135, 4123 Allschwil, Switzerland. For any privacy question or to exercise your rights, contact letustalk@bioquantiq.ch.

2. What we collect

• Contact requests — when you use our contact form we collect your name, work email, company (optional), and the description of the problem you choose to share.
• Product data (Arena) — Arena runs as facilitated cross-functional decision sprints for a customer organisation. Within a sprint, Arena processes the decisions and decision-behaviour of the team at the team / session level (for example, how the group commits, compares, defers or anchors). Arena does not build an individual personality profile, and does not produce an individual score used for employment decisions.
• Technical & usage data — with your consent, privacy-friendly analytics about how you use the site (see our Cookie Policy).

3. Why we process it, and our legal bases

• To respond to contact requests — legitimate interest / steps prior to a contract.
• To provide and improve the Arena product to our customers — performance of a contract with the customer organisation.
• To run analytics and improve the site — consent (which you can withdraw at any time).

Model training. We do not use customer data or personal responses to train general-purpose or third-party AI models. We confirm this on request.

4. What Arena measures — team-level, with human judgement in the loop

What we measure. Arena measures the decisions and decision-behaviour of a team inside a sprint — not personality, identity, or protected characteristics, and not an individual ranking. Where behaviour is observed it is read at the team / session level to improve how the group decides; progress is measured against the team’s own baseline.

Role-based access. Arena is deployed by an organisation. Access to a sprint’s outputs is role-based — typically the sponsoring leaders and authorised administrators, as configured by the customer.

No solely automated employment decisions. Consistent with Article 22 GDPR, Arena’s outputs are not used to make decisions producing legal or similarly significant effects — such as hiring, promotion, termination or selection — based solely on automated processing. Those decisions remain with people; Arena informs the decision.

5. Retention

We keep personal data only as long as necessary for the purposes above or as required by law, then delete or anonymise it. Default retention periods are set out in our customer agreements. As a guide, contact-enquiry data is kept for up to 24 months and product data for the term of the customer agreement, unless a longer period is required by law.

6. Your rights (GDPR / FADP)

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority (in Switzerland, the FDPIC; in the EU, your local authority). To exercise any right, email letustalk@bioquantiq.ch.

7. International transfers

Where personal data is transferred outside Switzerland or the EEA, we rely on recognised safeguards such as adequacy decisions or Standard Contractual Clauses. Arena is hosted within Switzerland and the EEA; a current list of our sub-processors is published in section 8 below.

8. Sub-processors, telemetry & data-processing agreements

So nothing material is left “on request”, this section publishes who processes your data, what runs on the site, how long we keep it, and the agreements we offer.

Sub-processors

These third parties process data on our behalf when you use this site:

• Netlify, Inc. — website hosting, global content delivery, form delivery. A Data Processing Agreement incorporating the EU Standard Contractual Clauses is in place.
• Plausible Analytics (EU-hosted, EU-owned) — privacy-friendly, cookieless usage analytics, loaded only after you accept analytics. No cookies, no cross-site tracking, no personal profiles.

We update this list here before adding any new sub-processor.

Telemetry on this site

Plausible runs only after you accept analytics and is fully cookieless.

Retention & deletion

Enquiry details you send through our forms (name, work email, company, and the problem you describe) are kept only as long as needed to respond and follow up, and are deleted on request — see sections 5 and 6. To delete your data, email letustalk@bioquantiq.ch.

DPA & DPIA

A Data Processing Agreement (DPA) and, where a deployment requires it, support for a Data Protection Impact Assessment (DPIA) are available to clients — request either at letustalk@bioquantiq.ch.

9. Security

We apply appropriate technical and organisational measures to protect personal data — including encryption in transit, role-based access controls, sandboxed client environments, least-privilege processing and vendor due-diligence. A summary of our security and hosting posture is available on request.

10. Changes

We may update this policy; material changes will be reflected by the “last updated” date above.