Privacy Policy

This Privacy Notice explains how your personal data is handled on hdi.vision and in the HDI application. Two organisations are responsible, each for its own part.

Udruga HDI Humana Digitalna Inteligencija, a Croatian association, OIB 38835255149, is the controller of your assessment data: your account, your answers and your reports. Registered address: Bidrovečka cesta 33, 10000 Zagreb, Croatia. Postal address: Radauševa 4, 10000 Zagreb, Croatia.

NEVJEROJATNO, obrt za promidžbu, a Croatian sole-trader business, is a separate controller for invoicing and payment data only: the name and billing details on your invoice, what you bought, the amount and the payment record. Its identification number is given in the pre-contract information and on each invoice. Registered address: Bidrovečka cesta 33, 10000 Zagreb, Croatia. Postal address: Radauševa 4, 10000 Zagreb, Croatia. It also builds and runs the HDI website and application for the association, and can access the data stored in it to do so. It does not use that data for its own purposes. Your answers and reports are never part of the payment data.

For anything about your data, write to info@hdi.vision. We pass your request to whichever of the two is responsible.

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you disagree with our policies, please do not use our services. For questions, contact us at info@hdi.vision.

1. What Information Do We Collect?

Information you provide voluntarily

We collect personal information you provide when you register an account, take the HDI assessment, or contact us. This includes:

• Name, email address, username, and password
• Country, gender, education level, employment status and your usual daily screen time, which the registration form asks for. We store them with your account.
• Organization code and organization membership, if you join HDI through an organization
• Responses to HDI assessment questions (including information about your digital behaviour)
• Assessment attempts, timestamps, module scores, facet scores, subfacet scores, grades, improvement reports, and privacy sharing preferences
• Messages sent via the contact form

Sensitive information

The HDI assessment may collect data relating to your self-reported digital behaviour patterns, wellbeing indicators, and psychological traits (such as self-reported anxiety, mood, or behavioural tendencies). Under GDPR Article 9, this may constitute sensitive personal data.

We collect this data only with your explicit consent, provided at the point of assessment. You may withdraw this consent at any time by contacting us at info@hdi.vision, though withdrawal will prevent further use of the assessment. This data is used solely for:

• Generating your personal HDI report and improvement recommendations

Your answers are not used for scientific research.

Important: HDI assessment data is not shared with healthcare providers, insurers, employers, or any third party without your explicit separate consent. It is never used for profiling, advertising targeting, or automated decision-making with legal effects.

Information collected automatically

When you visit our site, we automatically collect:

• IP address, browser type and version, device characteristics
• Operating system, language preferences
• Pages visited, time spent, referring URLs

2. How Do We Use Your Information?

We process your information to:

• Create and authenticate your account on test.hdi.vision
• Deliver your HDI assessment report and personalised recommendations
• Let you share your individual results with your organisation's administrator, test by test, if you choose to. Sharing is off unless you switch it on.
• Let organisations that give their people access to HDI manage test availability and retakes
• Provide data export and anonymization request workflows
• Take card payments through Stripe, once payment is switched on. Invoicing and payment data are the responsibility of NEVJEROJATNO, obrt za promidžbu, as described under 'Who is responsible'.
• Respond to your enquiries and contact form submissions
• Comply with legal obligations under Croatian and EU law

3. Legal Bases for Processing (GDPR)

We only process your personal information when we have a valid legal basis to do so under applicable law:

• Consent - where you have given us explicit consent (e.g. for sensitive assessment data or marketing communications)
• Contract performance - to deliver the services you have purchased or requested
• Legal obligation - where processing is required by law
• Legitimate interests - for security, fraud prevention, and service improvement, where these are not overridden by your rights

4. Do We Share Your Information?

We do not sell your personal information. We may share information with:

• Plus Hosting Grupa d.o.o. (plus.hr), Croatia - hosting, storage and backups of the website and the application, under a contract with NEVJEROJATNO, obrt za promidžbu.
• Stripe - card payments for NEVJEROJATNO, obrt za promidžbu, once payment is switched on. It is not in use today.
• Law enforcement or regulatory authorities where required by law

We do not collect any personal information from third parties, and we do not share your individual assessment data with any third party without your explicit consent.

Organization access and privacy by default

Your organisation's administrator sees your individual results only for the tests you choose to share in your profile or My Results. You can switch sharing off again there.

Super admin access to individual user data is restricted to platform administration, support, security, legal compliance, and troubleshooting purposes.

Organisations that give their people access to HDI

When an organisation gives its employees, students or members access to HDI, it sees individual results only for the tests a person chooses to share with it. How responsibility for this data is divided between the organisation and us is set out in our agreement with that organisation. For anything about your data, you can write to us at info@hdi.vision, whichever organisation gave you access.

5. Cookies and Tracking Technologies

We use only the cookies needed for the website and the assessment platform to work:

• Essential cookies - necessary for the site and assessment platform to function

You can control cookies in your browser settings. If you block the cookies needed to sign in, the assessment platform will not work.

6. How Long Do We Keep Your Data?

We retain your personal information for as long as necessary to fulfil the purposes outlined in this notice, or as required by law. Specifically:

• Account data - kept for as long as your account exists. You can ask us to anonymise your account at any time; we do not offer a separate deletion request, and no fixed period runs after one.
• Your answers and results - kept for as long as your account exists, unless you ask us to anonymise them.
• Payment records - kept for at least seven years, as Croatian tax law requires.
• Audit logs and privacy request records - kept as needed for security, legal compliance, dispute resolution and accountability. They are not deleted automatically.
• Contact enquiries - kept for 12 months after the conversation is closed, then deleted. Contracts and invoices are kept for as long as accounting law requires.

When an anonymization request is completed, HDI deletes or neutralizes individual answers, individual statistics, and private improvement reports, and removes or replaces direct identifiers where feasible. Purchase records, invoices, audit logs, and other records may be retained where required for legal, tax, accounting, security, or dispute-resolution reasons. Aggregate snapshots do not contain user IDs and are created only for groups with sufficient sample size to reduce re-identification risk.

7. Your Privacy Rights

As a resident of the EEA (including Croatia), you have the following rights under GDPR:

• Right of access - to receive a copy of your personal data
• Right to rectification - to correct inaccurate data
• Right to erasure - you can ask us to anonymise your account. When we do, we delete your answers, your statistics and your private reports, and we overwrite the name and contact details on your account record. The account record itself is kept, together with invoices and other records the law requires us to hold.
• Right to restrict processing - to limit how we use your data
• Right to data portability - to receive your data in a structured, machine-readable format
• Right to object - to object to processing based on legitimate interests
• Right to withdraw consent - at any time, without affecting the lawfulness of prior processing

Registered users can use the in-app data export and anonymization request tools in their profile. You may also contact us at info@hdi.vision. We will respond within 30 days unless applicable law permits an extension. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) at azop.hr.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal information, including authenticated access, role-based access, email verification, privacy-by-default settings and administrative privacy request visibility. However, no electronic transmission or storage system is 100% secure. We encourage you to use a strong, unique password for your account and to contact us immediately if you suspect unauthorised access.

9. International Data Transfers

Our hosting provider, Plus Hosting Grupa d.o.o., keeps the website, the application and their backups on servers in Croatia, and we do not transfer that data outside the European Economic Area. When card payment is switched on, Stripe will process the payment data. Before payment opens, this section will say where Stripe processes it and on what safeguard.

10. Children's Privacy

Our own accounts and assessments are for adults. In the parent edition, an adult parent or guardian answers questions about their child; the child does not answer. We use those answers only to prepare that parent's report, as the parent edition's consent text describes. For children aged 12 to under 18, we ask the parent, before the first answer, to confirm that they have told their child about the questions and the report. We keep a record of that confirmation (which text was shown, when, and the choice made) with the parent's answers, and delete it with them. If you believe a child has provided us with personal data, please contact us immediately.

11. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, data subject access requests, or to exercise your rights:

• Email: info@hdi.vision
• Phone: +385 98 417 311
• Post: Udruga HDI Humana Digitalna Inteligencija, Radauševa 4, 10000 Zagreb, Croatia