IWPA Privacy Policy

The IWPA platform is operated by The Fourth Dimension Training & Consultancy FZ LLC, Meydan Grandstand, 6th Floor, Dubai, United Arab Emirates (4D, we, us, or our).

IWPA and its assessment methodology, item framework, psychometric structure, associated content, and related intellectual property are jointly owned by The Fourth Dimension Training & Consultancy FZ LLC and PCI Learning & Development.

The technology used to administer, score, and generate IWPA profiles is provided through Phoenix by 4D.

For most direct purchases and platform operations, The Fourth Dimension Training & Consultancy FZ LLC acts as the data controller. In an organizational campaign, the inviting organization may also act as a controller for its own purposes. Its invitation or campaign notice should explain its role and what information it receives.

Privacy enquiries: privacy@iwpa.io

This Policy covers:

• people who purchase an IWPA product;
• participants who take an assessment;
• people invited by an organization;
• organizational customer contacts;
• visitors who contact us or use the website.

Depending on how you use IWPA, we may collect:

### Purchase and account information

• name;
• email address;
• order, product, price, currency, and payment status;
• acceptance of legal terms and policy versions;
• customer-support communications.

Payment card information is handled by the payment provider shown at checkout and is not intended to be stored directly by IWPA unless explicitly stated.

### Invitation and campaign information

• participant name and email supplied by the inviting organization;
• organization and campaign identifiers;
• the purpose of the campaign;
• the profile or output the organization is permitted to receive.

### Intake and demographic information

We may ask for information such as:

• country of residence;
• gender;
• employment status;
• job title or role family;
• level of study;
• field of study.

This information does not change your assessment score. Where it is used for research or benchmarking, it is handled as described in Sections 8 and 9.

### Assessment information

• responses to assessment items;
• assessment, scoring, and profile-template versions;
• computed scores, bands, composites, and occupational-interest ranks;
• response-quality indicators;
• completion, timing, and attempt status;
• generated profile content and recommendations.

### Technical and communication information

• browser, device, IP address, security, and diagnostic information;
• service and audit logs;
• transactional email delivery status;
• support messages and attachments you provide.

We use personal information to:

• provide checkout, invitations, assessment access, scoring, profiles, and secure downloads;
• authenticate tokens and prevent unauthorized access;
• communicate transactional information;
• support customers and participants;
• maintain security, reliability, auditability, and version history;
• comply with legal and contractual obligations;
• investigate misuse, fraud, or technical faults;
• with applicable consent, validate and improve the assessment, calculate aggregate averages and statistics, monitor fairness, and develop legitimate benchmark datasets.

We do not sell assessment responses or personal data for advertising.

We do not use identifiable assessment responses to target advertising.

Depending on the person, service, and applicable law, we rely on one or more of the following grounds:

• contract: to provide a purchased or requested service;
• consent: where you have made a specific choice, including optional research or benchmarking participation where required;
• legitimate interests: to operate, secure, improve, and support the service, provided those interests are not overridden by your rights;
• legal obligation: where we must retain, disclose, or process information to comply with law;
• establishment or defence of legal claims: where necessary.

Where an organization invited you, that organization is responsible for identifying its own lawful basis for requesting and using the assessment.

You may withdraw consent for future processing at any time. Withdrawal does not affect processing that was lawful before withdrawal or processing that relies on another valid legal ground.

Scores are calculated by a deterministic, versioned scoring engine. External AI tools do not calculate or alter scores.

We may use external artificial intelligence service providers to generate narrative explanations, summaries, visual specifications, or recommendations from already-calculated results and supporting evidence.

We limit the information sent to an AI provider to what is reasonably needed for the relevant function. We do not instruct external AI providers to make employment or other consequential decisions about participants.

The current providers used by the platform may change. Material provider categories remain described in this Policy, and current subprocessors may be listed separately.

Information may be shared with:

• the participant;
• a purchaser where the purchaser is also the participant or is otherwise authorized;
• an inviting organization, limited to the output disclosed for the campaign;
• service providers supporting hosting, databases, storage, email, payments, security, analytics where used, and AI-supported generation;
• professional advisers and authorities where necessary for legal, security, or compliance purposes;
• an acquiring or successor organization in a lawful business restructuring, subject to appropriate protections.

Organizations do not receive unrestricted access to participant response-level data by default.

Our goal is to improve IWPA using data without publishing or using participant names in research statistics.

Where permitted and, where required, with your optional consent, we may retain and use a research copy of assessment information to:

• calculate averages and distributions;
• evaluate reliability and consistency;
• improve interpretation quality;
• test scoring changes before release;
• identify technical or response-quality issues;
• examine fairness and adverse-impact risks;
• develop future norm groups and population comparisons.

The research or benchmark dataset used to calculate averages does not include names, email addresses, phone numbers, payment details, token secrets, or direct contact details.

Instead, the dataset uses a random or pseudonymous identifier. A separate restricted record may temporarily preserve a link to the operational participant record for consent management, deletion requests, audit, duplicate detection, and data-quality controls. Because that link may be reversible, this state is called pseudonymised, not anonymous.

Access to any linking record must be restricted to authorized personnel and systems.

Where feasible and appropriate, data may later be de-identified further by removing the linking reference and reducing indirect identifiers.

We do not publish participant-level research records.

Population comparisons are not shown unless an approved benchmark dataset meets the standards in the Benchmarking and Data Use Policy.

Averages or other aggregate statistics must be calculated across a sufficiently large group and reviewed for re-identification risk. We do not publish small-group statistics where a person could reasonably be identified from a rare combination of characteristics.

Once information has been transformed into a genuinely anonymous aggregate that no longer contains an individually addressable record, it may not be possible to remove one person's historical contribution from that already-created statistic.

A person who withdraws optional research consent will be excluded from future identifiable or pseudonymised research processing where required and reasonably possible. Withdrawal does not require us to dismantle an already-created, irreversibly anonymous aggregate.

When an organization invites you, the invitation or consent screen should identify:

• the organization;
• the purpose of the assessment;
• what information or output it will receive;
• any additional terms that apply.

The organization is responsible for its own use, retention, security, and lawful basis for the information it receives.

IWPA does not make employment, promotion, admission, or other consequential decisions on the organization's behalf.

We and our service providers may process information in countries other than the country where you live.

Where applicable law requires safeguards for an international transfer, we use contractual, organizational, or other recognized safeguards appropriate to the transfer.

If services are later provided through a local affiliated entity, we will identify that entity in the relevant notice, checkout, order form, or regional supplement.

We retain information only for as long as reasonably needed for the purposes described in this Policy, including service delivery, auditability, security, dispute handling, legal obligations, and approved research.

Operational records may include:

• order and acceptance records;
• assessment attempts and versioned scores;
• generated profile history;
• security and transactional logs.

Finalized assessment and scoring records may be retained to preserve an auditable history of the exact assessment and scoring version that produced a profile. Where deletion is requested, we assess which information can be deleted, anonymized, or restricted and what must be retained for legal, contractual, fraud-prevention, or record-integrity reasons.

Optional research records are retained only while the relevant research or validation purpose remains active and subject to consent, governance, and applicable law.

Anonymous aggregate statistics may be retained indefinitely because they no longer identify an individual.

We use reasonable technical and organizational measures designed to protect information, including access controls, token validation, separation of participant and organization permissions, audit logging, and secure service providers.

No internet service can guarantee absolute security. You should protect your email account, devices, token, profile links, and downloaded files.

Depending on your location and applicable law, you may have rights to:

• request access to personal information;
• request correction;
• request deletion;
• request restriction of processing;
• object to certain processing;
• receive a portable copy where applicable;
• withdraw consent;
• object to certain automated processing;
• complain to a competent data-protection authority.

To make a request, email privacy@iwpa.io. We may need to verify your identity before acting.

These rights are not absolute. We will explain where a request cannot be fully completed because of legal obligations, security, record integrity, legal claims, or because the information has already been irreversibly anonymized.

IWPA calculates scores automatically using fixed scoring rules, but IWPA does not itself make a legal, employment, promotion, admission, or similarly consequential decision about you.

Organizations must not treat the profile as the sole basis for such a decision and remain responsible for human review and their own compliance obligations.

The standard IWPA service is intended for people aged 18 or over.

We do not knowingly allow a child to purchase or take the standard public assessment independently. A future supervised service for younger participants would require a separate approved process and notice.

We may use cookies or similar storage that are necessary for security, session continuity, checkout, language preferences, and core site functions.

Where non-essential analytics or advertising technologies are introduced, we will update this Policy and provide any consent controls required by applicable law.

We send service communications such as purchase confirmations, invitations, assessment status messages, profile-ready notices, security notices, and support replies.

These are not marketing messages. Any future marketing communication will use a separate opt-in where required and will include a way to unsubscribe.

We may update this Policy as the service, providers, and legal requirements evolve. The current version and effective date will be published on the website.

Material changes affecting existing information will be communicated where required.

Privacy enquiries and rights requests: privacy@iwpa.io Legal enquiries: legal@iwpa.io Support: support@iwpa.io

Postal address: The Fourth Dimension Training & Consultancy FZ LLC Meydan Grandstand, 6th Floor Dubai, United Arab Emirates