Privacy Policy

Last updated: 6 October 2026

EnneagramTest ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our website at enneagramtest.co.uk and our assessment platform at app.enneagramtest.co.uk.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC148551.

1. Who We Are

EnneagramTest is operated by Eugenio Leijten, trading as EnneagramTest.

Address: TA3 7EQ, Taunton, England
Email: legal@enneagramtest.co.uk

2. What Data We Collect

Clients (assessment participants)

The assessment is for people aged 18 or over.

• Your name and email address — provided by you at the start of your assessment
• Your assessment responses — gathered during the guided conversation. Depending on what you choose to share, these may include special category data, such as information about your health (including mental health), beliefs, or sex life and sexual orientation
• Your Enneagram report — generated after your assessment and made available to you via a secure link for 12 months
• Your consent record — the date and time you agreed to participate in the assessment and gave explicit consent to the processing of any special category data you share
• Session metadata — duration, date, and Enneagram type result

Practitioners (coaches and therapists)

• Your name and email address — provided during registration
• Your branding preferences — colours, logo, profile photo, and font choices
• Purchase history — token pack purchases and invoice records
• Client assignment records — which tokens have been assigned to which clients

Website visitors

• Standard web analytics data — pages visited, browser type, approximate location
• Cookie data — see our Cookie Policy

3. How We Use Your Data

• To deliver the Enneagram assessment service to clients
• To make your personalised report available to you via a secure link
• To allow practitioners to manage their account and assign assessments to clients
• To process payments for token purchases (via Stripe)
• To send invoices and account notifications to practitioners
• To improve our service and ensure it works correctly
• To review and improve the accuracy and quality of the AI assessment. This may include members of our team re-examining completed assessment conversations and reports, and re-running them through our AI provider to test and validate changes to our methodology, for up to 12 months after your assessment is completed.
• To comply with our legal obligations

4. Legal Basis for Processing

• Contract: processing necessary to deliver the service you have requested
• Legitimate interests: improving our platform, preventing fraud, maintaining security
• Legal obligation: retaining records for tax and accounting purposes
• Consent: where you have explicitly agreed, for example to receive marketing communications
• Explicit consent (UK GDPR Article 9(2)(a)): for any special category data you choose to share during your assessment. Before the assessment begins, you are asked to give this consent separately. We process this information only to carry out your assessment, create your report and, within the 12-month retention period, review and improve the accuracy of the typing and the quality of the reports. Where you take the assessment through a practitioner, your practitioner receives and reviews your report as part of this processing. You can withdraw your consent at any time by contacting your practitioner or, if you took a free demo assessment, by emailing legal@enneagramtest.co.uk, and we will delete your assessment conversation and report. Withdrawing consent does not affect processing carried out before you withdrew it.

Automated processing

Your Enneagram type and report are produced by AI from your assessment conversation. Your report is always reviewed by a person before it is released to you: by your practitioner, or, for a free demo assessment, by us. No decision about you is made solely by automated means. An Enneagram type is a description intended for self-reflection; it is not used to make any decision that has legal or similarly significant effects on you.

5. Who We Share Your Data With

We share your data only where necessary to deliver our service:

• Anthropic — our AI provider. We use Anthropic's Claude models to conduct the assessment conversation and generate your report (Claude Sonnet), and for two smaller background tasks: an automated check on submitted practitioner reviews and generating the optional Insight Exploration follow-up document (Claude Haiku). This is accessed via the Anthropic API — not via Claude.ai or any other consumer product. Under Anthropic's standard API terms, conversation data submitted this way is not used to train Anthropic's models by default; see Anthropic's data usage policy for details.
• Stripe — payment processing for token purchases
• Fastmail — email delivery
• Cloudflare — platform hosting, data storage, and security
• Your practitioner — your report is shared with your practitioner, who reviews it before it is released to you, as agreed when you accepted the assessment invitation. Your practitioner does not see your conversation transcript.

We do not sell your personal data to third parties.

6. Data Retention

• While active, your assessment conversation transcript and report (PDF and HTML, including the optional Insight Exploration follow-up document) are held in Cloudflare R2 under EU data residency.
• Your assessment conversation transcript and all report documents are deleted 12 months after your assessment is completed, by an automated daily process.
• Your practitioner can ask us to delete your assessment (transcript and reports) at any point before that, and we will action it promptly.
• Client name and email are retained for as long as the associated token record exists.
• Practitioner account data is retained for the duration of the account and for 7 years thereafter for accounting purposes.
• Invoice records are retained for 7 years in line with HMRC requirements.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict how we process your data
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, please contact us at legal@enneagramtest.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO at ico.org.uk.

8. Security

We take appropriate technical and organisational measures to protect your personal data, including encrypted data transmission (HTTPS), access controls, and secure third-party processors. However, no internet transmission is completely secure and we cannot guarantee absolute security.

9. Cookies

We use cookies to operate our website and platform. Please see our Cookie Policy for full details.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify practitioners of significant changes by email. The current version is always available at this URL.

11. Contact Us

For any privacy-related questions or requests, please contact:
Email: legal@enneagramtest.co.uk
Address: TA3 7EQ, Taunton, England