Privacy policy
This policy describes which personal data are processed when you use this instrument, for what purpose and on what legal basis. It is deliberately specific: it names what is actually collected, not everything that might conceivably be.
Controller
Sebastian Helms
Arndtstr. 63
04275 Leipzig
Germany
Email: helms@straw.io
These details also apply to all data protection matters. Further mandatory information is given in the Legal notice.
What data are processed
| Data | Purpose | Legal basis |
|---|---|---|
| First name, surname, email address | Attributing the result to you and delivering the report | Consent, Art. 6(1)(a) GDPR |
| Year of birth, gender, highest education, first language (optional) | Later norming of the instrument and checking whether it disadvantages particular groups | Consent, Art. 6(1)(a) GDPR |
| Your individual answers with response times | Computing the result, checking how soundly the test was taken, and later review of the scoring | Consent, Art. 6(1)(a) GDPR |
| Computed scores, confidence intervals, soundness indicators | Producing the results report and letting you open it again | Consent, Art. 6(1)(a) GDPR |
| Access code, time of redemption, language version | Ensuring a code is used only once | Performance of a contract, Art. 6(1)(b) GDPR |
| Time of your consent | Demonstrating that consent was given | Legal obligation, Art. 6(1)(c) GDPR |
Your details are not used for advertising, not sold, and not combined into profiles beyond the scoring of this instrument. No automated decision-making within the meaning of Art. 22 GDPR takes place: the report is an evaluation, not a decision about you.
Technical safeguards
First name, surname, email address, the optional details about you and the stored report are held in the database in encrypted form (AES-256-GCM, with the key kept separately from the database). Unauthorised access to the database alone therefore yields no readable personal data.
All transmission takes place exclusively over HTTPS.
The administration area is password-protected and shows, in lists, only your first name and the initial of your surname together with a shortened email address.
Storage on your device
While you take the test, your progress is held in your browser’s local storage so that an accidental reload does not destroy your work. After you finish, a copy of the report is also kept there so that you can open it again. If you clear your browser’s site data, that copy is lost.
No cookies are set for taking the test. One technically necessary cookie is created only when signing in to the administration area; it contains no personal data and expires after twelve hours.
To improve the interface, we measure which pages are opened and at which point a sitting is abandoned. This uses Umami on a server of our own (analytics.straw.io) -- no external provider, no onward transfer. Umami works without cookies and stores nothing on your device; your IP address is not retained, and there is no recognition across different websites. If your browser sends "Do Not Track", no measurement takes place.
What is measured is solely route and duration: that a code was checked, that registration was completed, which subtest was finished, how long a sitting took, whether the report was printed or exported, and whether the language was switched. What is NOT measured: your name, your email address, your access code, your answers and your result. Neither the overall score nor the percentile appears in the measurement. The legal basis is our legitimate interest in a working interface (Art. 6(1)(f) GDPR); you may object under Art. 21 GDPR.
Nothing is sent during the two timed subtests. A network request in the middle of an item would feed into the performance being measured.
No third-party content is loaded. Fonts, graphics and QR codes come exclusively from this server; there is no embedding of font services, map providers, video platforms or social networks. Opening a page therefore creates no connection to any other provider, and your IP address is not disclosed to any third party.
Recipients and processors
Vercel Inc. — operation of the website. Processing takes place in a data centre within the European Union (Frankfurt am Main, region fra1); the execution region is fixed in the project configuration and cannot be changed incidentally. Vercel Inc. is a US company, so access from a third country cannot be entirely excluded; for that case the standard contractual clauses and/or the EU-US Data Privacy Framework apply.
Neon Inc. — operation of the database. The data are held in a data centre within the European Union (Frankfurt am Main).
Beyond this, your data are not passed to third parties. Data processing agreements under Art. 28 GDPR are in place with both providers.
Retention period
Your details and your result are stored until you request erasure or the purpose ceases to apply. There is currently no automatic deletion period; erasure on request is carried out without delay.
Erasure covers the sitting, all individual answers, the computed scores, the stored report and — where no further sitting exists — your personal record together with the associated access code.
Your rights
Under the GDPR you have the right of access to your personal data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, use the contact details above.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
Withdrawing consent
Where processing is based on your consent, you may withdraw it at any time. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is unaffected. A withdrawal in writing to the address given above is sufficient and leads to erasure as described in the preceding section.
Minors
This instrument is intended for adults. Its norms refer to the adult population; it is neither suitable nor intended for children and adolescents.
Version
This policy applies from 1 October 2026.