Privacy Policy
How Quest handles personal data across assessments, results and account activity.
Last updated: 5 August 2026
1. Who we are
Quest is a multi-tenant assessment platform. Your organisation (the “tenant”) is the controller of the personal data it collects through Quest; Quest acts as the processor operating the platform on the tenant’s behalf.
2. What we collect
- Account data — name, email and role for managers and administrators.
- Assessment data — invitations, responses to questionnaire items, and computed scores.
- Consent records — the consent you accept before starting an assessment, with a timestamp.
- Security & audit data — sign-in events, two-factor status and administrative actions.
- Technical data — minimal session information required to operate the service.
3. How we use it
Personal data is used only to deliver assessments, calculate and present results, secure the platform, and meet the tenant’s legal and reporting obligations. We do not sell personal data or use assessment responses for advertising.
4. Legal basis & consent
Respondents are asked for explicit consent before an assessment begins, and that consent is recorded. Depending on the tenant’s context, processing may also rely on legitimate interest or a legal obligation.
5. Retention
Data is retained for as long as the tenant’s retention policy requires and is then deleted or anonymised. Audit evidence may be kept longer where law requires it.
6. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent. Requests are handled by the tenant as the data controller.
7. Contact
For privacy questions, contact your organisation’s administrator, who can escalate to the Quest team where needed.