Privacy Policy

1. Who is responsible

PEAKTEAMS is a product of Libaty GmbH. The controller within the meaning of the General Data Protection Regulation (GDPR) for the website peakteams.io and the PEAKTEAMS service is:

If you use PEAKTEAMS on behalf of an organisation that has concluded a data processing agreement with us (Art. 28 GDPR), we process that organisation's team and survey data as its processor. The organisation is then the controller for that data and is responsible for informing its team members. Organisations can request a data processing agreement at legal@peakteams.io.

2. Summary

• We process the data needed to run team surveys: the team owner's account, the names and email addresses of invited team members, and survey answers.
• Team owners see survey results only in aggregated form and only once a minimum number of team members have responded. They never see who gave which answer (details).
• Our database and application servers are in Ireland (EU). Some providers are based in the USA or Singapore (list of providers).
• Google Analytics, PostHog and Sentry Session Replay only run after you consent in the cookie banner. Ahrefs Web Analytics runs without cookies and without consent.
• We do not sell personal data and do not use it for advertising.

3. Visiting the website

When you open a page, your browser sends technical data to our hosting provider Vercel: IP address, date and time, the requested page, referrer, and browser and device information. This is necessary to deliver the website, keep it stable and protect it against attacks.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Information that is strictly necessary for the service to work is stored on your device under § 25(2) TDDDG. See our Cookie Policy for everything we store in your browser.

4. Accounts

When you create an account we process:

• first name, last name, email address and password (stored only as a hash);
• optionally a profile photo;
• if you sign in with Google: the name, email address and profile picture that Google shares with us;
• the time of your last sign-in;
• a record of your acceptance of our Terms and this Privacy Policy (document versions, time, IP address and browser information).

Purpose and legal basis: providing your account and the service (Art. 6(1)(b) GDPR). We keep the acceptance record to be able to prove which terms applied (Art. 6(1)(f) GDPR).

Our platform administrators can access account and team data where this is necessary for support, security or fixing errors. When an administrator views the service as a specific user for support purposes, the start and end of that session are logged.

5. Teams and surveys (team owners)

When you create a team we process:

• team name, description and optional team photo;
• team attributes you select: industry, company size, organisational structure, functional area, country, how the team is distributed, team structure, team type and team age;
• the team members you invite (see the next section) and the surveys you start.

Purpose and legal basis: running surveys for your team and showing you the results (Art. 6(1)(b) GDPR).

As a team owner you decide whom to invite. You need a legal basis for sharing your team members' names and email addresses with us, should tell them about the survey, and may need to involve employee representatives (such as a works council) where the law requires this. See our Terms.

6. Invited team members

This section informs you under Art. 14 GDPR if a team owner has invited you. We did not collect this data from you but received it from the team owner who invited you.

We process:

• your first name, last name and email address;
• optional attributes the team owner enters: time in the team, seniority and membership status (permanent or temporary);
• the status of your invitation (sent, started, completed) and the reminders sent to you.

Purposes: sending you your personal survey link and reminders, showing the team owner whether you have responded, and breaking down results by the attributes above (only for groups with enough responses, see section 8).

Legal basis: Art. 6(1)(f) GDPR. The team owner has a legitimate interest in understanding and improving how their team works, and we have a legitimate interest in providing this service. If the team owner acts for an organisation that has a data processing agreement with us (our template is at /trust/dpa), that organisation is the controller and its own legal basis applies.

Taking part is voluntary. You can object to the processing at any time (see Your rights) or ask the team owner to remove you from the team.

7. Answering a team survey

You do not need an account to answer a survey. When you answer, we process:

• your answers;
• the time spent on each question, and when you started and submitted;
• your browser information (user agent).

Your answers are saved as you go, so you can pause and resume with your personal link. A cookie keeps your survey session for up to 14 days.

Legal basis: Art. 6(1)(f) GDPR (see section 6), or the legal basis of the organisation that runs the survey.

8. How confidential survey answers are

PEAKTEAMS surveys are confidential. We protect your answers as follows:

• Team owners see results only in aggregated form (for example averages and distributions). Results are only shown once a minimum number of team members, not counting the team owners themselves, have completed the survey. We set this minimum for the whole platform; it is currently five.
• Breakdowns by team attributes (for example seniority) are only shown when each group contains enough responses.
• Team owners can see whether each invited member has started or completed the survey, so they can send reminders. They cannot see your individual answers.
• Some surveys ask you to rate your teammates. In the results, team members appear as letters instead of names.
• Free-text answers are shown to the team owner word for word, without your name. Please leave out details that could identify you.

Surveys are not anonymous in the strict sense: we store your answers together with a reference to your personal invitation. We need this so you can resume the survey and so that each person answers only once. This reference is not shown to the team owner.

9. Free Team Assessment

You can take the Free Team Assessment without an account. Your answers are sent to our server to calculate your result but are not stored there. We store a session record with the start and completion time, the number of answers, the resulting team identity, the page you started from and your browser information. If you create an account afterwards, we link the record to your account to understand which assessments lead to sign-ups.

If you choose to share your result, we create a public result page with your team identity and scores (no name or email address). Anyone who has the link can view it.

Legal basis: Art. 6(1)(b) GDPR for calculating and sharing your result; Art. 6(1)(f) GDPR for the session record (improving the assessment).

10. Self-tests (Resources)

The Leadership Style Assessment, Work Personality Test and Burnout Test can be taken without an account. Your answers are kept in your browser's local storage, so you can continue later, and are not sent to us unless you save them to an account.

• Leadership Style and Work Personality: if you are signed in, your answers, time per question and scores are saved to your account automatically so you can see them again (Art. 6(1)(b) GDPR).
• Burnout Test: your answers can reveal information about your health (Art. 9 GDPR). We only save them to your account if you tick the consent box and click save (Art. 9(2)(a) and Art. 6(1)(a) GDPR). You can delete saved results in the report at any time; this also withdraws your consent for the future.

With analytics consent we record that a test was started, reached a progress milestone or was completed. We do not send your answers or results to analytics providers.

These tests are for self-reflection. They are not a medical or psychological diagnosis.

11. Contact and coach forms

If you use the contact form, we process your name, email address, optional company and your message. If you register interest as a coach, we also process your website and coaching experience. The form content is sent to our team by email (via Resend) and is not stored in our database.

Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (answering your request).

12. Feature board

Signed-in users can suggest features and vote. We store your suggestions and votes with your account and may email you when the status of your suggestion changes (Art. 6(1)(b) GDPR).

13. Emails we send

• account emails, such as confirming your email address or resetting your password;
• survey invitations to team members, and reminders the team owner sends;
• a notification to the team owner when all invited members have responded;
• updates about your feature board suggestions.

We do not send newsletters or marketing emails. For each email we log the recipient, type, subject and delivery status, to troubleshoot delivery and prevent misuse (Art. 6(1)(f) GDPR).

14. Analytics and error monitoring

With your consent

Only if you allow analytics cookies in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG):

• Google Analytics 4 (Google Ireland Limited) measures page views and how visitors use the website.
• PostHog (EU data region) records page views and product events, such as a survey being started or completed. If you are signed in, events are linked to a pseudonymous user ID, not your name or email address.
• Sentry Session Replay records a sample of sessions to help us reproduce errors.

You can withdraw your consent at any time with effect for the future (see the Cookie Policy).

Without consent

• Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore) counts page views without cookies or other storage on your device. Your browser necessarily sends your IP address and browser information when loading the script. Legal basis: Art. 6(1)(f) GDPR (understanding how our website is found and used).
• Sentry error monitoring (EU data region) receives technical information when an error occurs, such as the page, browser, error message and stack trace. Legal basis: Art. 6(1)(f) GDPR (a working service).

15. Recipients and processors

We use the following service providers. They process data on our behalf under data processing agreements (Art. 28 GDPR), except Google as the provider of Google sign-in, which acts as a separate controller. The current list with transfer safeguards and links is at /trust/sub-processors.

Team owners see the aggregated results of their team's surveys as described in section 8. We disclose data to authorities only where we are legally obliged to.

16. Transfers outside the EU

Some of the providers above are based in the USA or Singapore, or may access data from there. Where data is transferred to a country without an adequate level of data protection, we rely on an adequacy decision of the European Commission (for US providers certified under the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards at legal@peakteams.io.

17. How long we keep data

• Account data, including the acceptance record, is kept as long as your account exists and deleted when you delete your account.
• Team, member, survey and response data is kept as long as the team exists. When a team is deleted, its members, surveys and responses are deleted with it.
• Saved self-test results are kept until you delete them or your account. Answers in your browser stay there until you clear your browser storage.
• Free Team Assessment session records, shared result pages, feature board entries and email delivery logs are kept while they are useful for the purposes above. We delete them on request.
• Contact emails are kept as long as needed to handle your request.

Where statutory retention obligations apply (for example under commercial or tax law), we keep the data concerned for the required period and restrict its use.

18. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, email legal@peakteams.io. If you were invited to a team survey, you can also contact the team owner.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

19. Other information

Do you have to provide data?

No. However, we need your name, email address and a password (or Google sign-in) to create an account, and you can only answer a team survey with a personal invitation.

Automated decision-making

Survey and test results are calculated automatically. We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR).

Security

Data is transmitted over encrypted connections (TLS). Access to data in our database is restricted by row-level security, so accounts can only access the data they are permitted to see. More on our Data Privacy & Security page.

Children

PEAKTEAMS is not directed at children under 16.

Changes to this policy

We update this policy when our processing or the law changes. The current version is always available on this page. If you have an account, we will inform you of material changes.