Last updated 20 October 2026
The controller under the EU General Data Protection Regulation (GDPR) is:
Path GmbH, Ottobrunner Str. 11, 81737 München, Germany
Managing directors: Gregor Schneider, Zippora Schneider-Ulrich
Email: privacy@personalitypath.com
We have not appointed a data protection officer because we are not legally required to. For any privacy question, write to the email above.
| What you do | Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Visit the website or app | IP address, browser, device, pages requested, time | Deliver pages securely, prevent abuse | Art. 6(1)(f) legitimate interest in a secure, working site | Server logs up to 30 days |
| Take the free test | Your answers, calculated result, language, optional first name | Calculate and show your result | Art. 6(1)(b) contract | 24 hours without account; until you delete your account if you save it |
| Create an account | Email, name, password (encrypted), language, login times | Run your account, save results | Art. 6(1)(b) contract | Until you delete your account |
| Buy a report or credits | Name, email, billing country, order and payment details (via Stripe) | Process the order, deliver, invoice | Art. 6(1)(b) contract; Art. 6(1)(c) tax law | Invoices and accounting vouchers 8 years (§ 147 AO); books and annual accounts 10 years; business letters 6 years |
| Use coach or team features | Name, email, results shown in team reports, invitations, coach notes | Provide coach and team reports | Art. 6(1)(b) contract | Until you leave the team or delete your account |
| Subscribe to our newsletter | Email, first name, sign-up time and IP, opens and clicks | Send articles and offers you asked for | Art. 6(1)(a) consent | Until you unsubscribe; proof of consent up to 3 years after |
| Contact support | Your message, email, order details | Answer your request | Art. 6(1)(b) or (f) | Up to 3 years after the request is closed |
| Accept analytics cookies | Pages viewed, clicks, device, approximate location, pseudonymous ID | Understand and improve the site and app, run A/B tests | Art. 6(1)(a) consent, § 25(1) TDDDG | Up to 2 years, or until you withdraw consent |
| Accept marketing cookies | Pseudonymous ID, pages viewed, purchases | Measure and target our ads on Google and Meta | Art. 6(1)(a) consent, § 25(1) TDDDG | Up to 2 years, or until you withdraw consent |
| Choose cookies | Random id, your choice, language, country, browser name, time, version of this notice | Keep proof of what you allowed | Art. 6(1)(f) legitimate interest in showing what you agreed to | 3 years, then deleted |
Transactional emails (order confirmations, password resets, team invitations) are part of the contract and don't need newsletter consent. If you use our withdrawal button, we process your name, order ID and email to handle it (Art. 6(1)(c) GDPR) and keep that record for 3 years.
Personality test answers are personal and we treat them that way.
When a coach or team owner invites you, they see your name and whether you have completed the test. They see your results only once a report is assigned or released to them, and team members see each other's types and results in the team report. Your individual answers are never shown. You can leave a team at any time.
Coaches who invite their own clients are responsible for having a lawful basis to do so. For the client data we process on their behalf, we act under a data processing agreement with the coach (Art. 28 GDPR).
We use the following providers. Each processes data only on our instructions under a data processing agreement, unless stated otherwise.
| Provider | What for | Where data is processed | Safeguard for transfers outside the EU |
|---|---|---|---|
| Supabase Inc. | Database and user login | EU | Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Website hosting | EU and USA | EU-US Data Privacy Framework (DPF) |
| Netlify Inc. | App hosting | EU and USA | SCCs |
| Render Services Inc. | Content management system (no user accounts) | EU | DPF |
| Amazon Web Services (S3, SES) | Image storage; sending emails | S3: EU; SES: USA | DPF |
| Plunk (self-hosted at DigitalOcean, Frankfurt; sends via AWS SES) | Email newsletters and transactional emails | Germany; sending via AWS SES (USA) | DPF (for AWS SES) |
| Cloudflare Inc. | Security, bot protection, fast delivery | EU and worldwide | DPF |
| Stripe Payments Europe Ltd. | Payment processing; Stripe is also an independent controller for fraud prevention and its legal duties | EU and USA | DPF |
| PostHog Inc. (EU Cloud) | Product analytics and A/B tests (with consent) | Frankfurt, Germany | SCCs for any support access |
| Google Ireland Ltd. | Google Analytics, Google Ads, Search Console (Analytics and Ads with consent) | EU and USA | DPF |
| Meta Platforms Ireland Ltd. | Meta Pixel for ad measurement and targeting (with consent); joint controller for collection under Art. 26 GDPR (essentials: facebook.com/legal/controller_addendum; Meta handles your rights for data it processes afterwards) | EU and USA | DPF |
| Personality Path | Store a copy of your cookie choices for 3 years | EU | Data stays in the EU |
We also share data with authorities, tax advisers or courts only where the law requires it.
Some providers are based in the USA or may access data from there. We transfer data only where an adequacy decision exists, in particular for US companies certified under the EU-US Data Privacy Framework, or under the EU Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.
We use technically necessary cookies and storage without consent, for example to keep you logged in, remember your test progress, process payments and save your cookie choices (§ 25(2) TDDDG). All other cookies and tracking (analytics and marketing, section 2) run only after you agree in our cookie banner. You can change or withdraw your choice any time via "Cookie settings" in the footer. We set two cookies of our own. pp_consent remembers your choice for 6 months. pp_consent_region remembers whether we must ask you, for 1 day. Analytics cookies are set only after you allow them. When you choose, we also keep a copy on our server. That copy has a random id, your choice, the language, the country, the name of your browser, the time, and which version of this notice you saw. We keep it for 3 years and then delete it.
You have the right to:
Your right to object (Art. 21 GDPR). You can object at any time, for reasons arising from your particular situation, to processing based on Art. 6(1)(f) GDPR, including our anonymised research. You can object to direct marketing at any time without giving reasons; we will then stop using your data for it.
Email privacy@personalitypath.com to use any of these rights. You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, but you can contact the authority where you live or work.
We protect your data with encryption in transit (TLS), encrypted passwords, access controls and regular backups. Only people who need access to do their job have it.
The Service is for people aged 16 and older. We do not knowingly collect data from younger children. If you think a child under 16 has given us data, please tell us and we will delete it.
We apply this policy to everyone. If you live in the USA, including California: we do not sell your personal information. Advertising cookies from Google and Meta may count as "sharing" under some US state laws; they run only with your consent, and you can opt out at any time via "Cookie settings".
We update this policy when our services or the law change. The current version is always on this page, with the date at the top. If a change affects how we use data you already gave us, we will tell you by email.
