Privacy Policy

The Skillful Collaboration assessment platform is operated by ici2learn B.V., registered in the Netherlands with KvK number 65555120 and VAT number NL856160179B01, with its registered address at Impalastraat 30, 3523 PN Utrecht, the Netherlands ("we", "us", "our").

We provide coaches, trainers, and facilitators ("Partners") with tools to run structured team assessments and generate reports for their clients.

For any privacy-related questions or to exercise your rights, contact us at: info@skillfulcollaboration.com

Under the GDPR, the responsibilities for personal data depend on who determines why and how it is processed.

Partner account data: ici2learn B.V. is the data controller. We determine why and how we process data about Partners who create an account on the platform.

Team member data: the Partner (coach or facilitator) is the data controller for the personal data of their team members. The Partner decides who to invite, for what purpose, and uses the results in their professional practice. ici2learn B.V. acts as the data processor — we process team member data on behalf of and under the instructions of the Partner, as described in our Terms of Service.

Partners are responsible for having a lawful basis to collect their team members' personal data and for informing them that an assessment is taking place using this platform.

From Partners (coaches / facilitators who create an account):

• First and last name
• Company name (optional)
• Email address
• Account credentials (managed securely by Supabase Auth — we never see your password)
• Credit balance and purchase history
• Billing details including name, address, and VAT number (stored with Stripe — see section 5)
• Marketing communication preference (whether you opted in at signup)

From Team Members (people who complete an assessment):

• Email address (from the invitation sent by the Partner)
• First and last name
• Role within the team
• Time spent in the team
• Team size and work method (in-person, hybrid, remote)
• 20 assessment responses (scored 1–5 per statement)

Automatically collected:

• IP addresses and server request logs, processed by our hosting provider Vercel as part of normal platform operation
• A session cookie used to keep Partners logged in

Partner account data (ici2learn B.V. as controller):

• Account management and platform access: necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).
• Payment processing and invoicing: necessary for the performance of the contract and compliance with legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Marketing communications (product updates and tips): based on your consent, given at signup (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by contacting us.

Team member data (Partner as controller, ici2learn B.V. as processor):

• Delivering the assessment: responses are used to compute scores and generate a personal PDF report and a team-level report. The Partner, as data controller, is responsible for establishing and communicating the appropriate legal basis for this processing to their team members.
• Sending the personal report: the PDF is emailed directly to the team member who completed the assessment.
• AI-generated action points: category scores (no personal identifiers) are sent to OpenAI to generate personalised improvement suggestions included in the report.

We use the following third-party services to operate the platform. Each acts as a sub-processor on our behalf (or, in the case of Stripe, as an independent controller for payment processing).

• Supabase — database and authentication hosting. All data is stored in the West EU (Ireland) region. Data retained for as long as your account is active. Privacy Policy →
• Vercel — website and API hosting. Processes server requests including IP addresses as part of normal hosting operations. Privacy Policy →
• Stripe — payment processing. Receives Partner billing name, address, VAT number, and payment method details. Stripe is an independent controller for payment data. Payment records are retained for up to 7 years to comply with Dutch and EU tax obligations, even after account deletion. Privacy Policy →
• OpenAI — AI-generated action points. We send only the 4 numeric assessment category scores — no names, email addresses, or other personal identifiers are included. OpenAI does not use API data for model training. Data is retained by OpenAI for a maximum of 30 days, then deleted. Privacy Policy →
• Resend — email delivery. Used to send assessment invitation emails (member email and team name) and personal report emails (member name and the PDF report as an attachment, which includes their full assessment data). Privacy Policy →

We do not sell your data to any third party.

Some of our processors are located outside the European Economic Area (EEA). We ensure appropriate safeguards are in place for all such transfers:

• Stripe, Resend, OpenAI, and Vercel are US-based companies. Each participates in the EU–US Data Privacy Framework and/or uses Standard Contractual Clauses for transfers from the EEA.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or destruction. These include encrypted connections (HTTPS), access controls, and hosting on infrastructure maintained by certified cloud providers. While we take these measures seriously, no system is completely secure and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and, where required, inform affected individuals without undue delay.

The platform uses automated processing to compute assessment scores and generate AI-powered action points based on those scores. These outputs are advisory in nature — they are a facilitation tool intended to support reflection and conversation, and do not constitute binding decisions, professional recommendations, or legally significant outcomes. No solely automated decisions with legal or similarly significant effects are made about any individual.

• Partner account data: retained for as long as your account is active. When you delete your account, all associated data (teams, assessments, responses, usage logs) is permanently deleted from our database.
• Team member responses: retained as long as the Partner's account is active. Team members can also request deletion independently — see section 8.
• Stripe payment records: retained for up to 7 years in accordance with Dutch and EU tax law, even after account deletion. Contact Stripe directly to exercise rights over payment data.
• OpenAI: score data is retained by OpenAI for a maximum of 30 days, then deleted.

If you are based in the EU or EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to processing
• Portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (for marketing communications) — you can unsubscribe directly from any marketing email we send, or by contacting us

To exercise any of these rights, email us at info@skillfulcollaboration.com. We will respond within one month.

Team members who wish to have their assessment data deleted should contact us with the email address used to complete the assessment. We will delete the relevant response record from our database.

You also have the right to lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens (AP) — autoriteitpersoonsgegevens.nl

We use a single session cookie to keep Partners logged in. We do not use tracking, advertising, or analytics cookies. No cookie consent banner is required.

We may update this policy from time to time. The date at the top of this page will reflect the most recent version. For material changes, we will notify Partners by email. Continued use of the platform after changes constitutes acceptance of the updated policy.