Development Dimensions International's Privacy Policy

This Privacy Policy is effective as of November 25, 2022
(Click here to download a PDF version of this policy.)

Introduction:

Development Dimensions International (“DDI”) takes your privacy very seriously. Please read this privacy policy carefully as it contains essential information about who we are, how and why we collect, store, use, and share your personal information. This privacy policy also explains your rights in relation to your personal information and how to contact us or supervisory authorities if you have a complaint or wish to submit a data subject request. If you have questions or complaints regarding our Privacy Policy or practices, please contact our Data Protection Officer at DataProtectionOfficer@ddiworld.com.  

DDI designed and manages the site you are viewing. DDI provides a range of Internet-based tools to support leadership solutions including, leadership development, talent strategy, and assessment solutions to the global worldwide market. This Privacy Policy applies to the collection and use of information of the websites and platforms on sites where this policy is linked (“Sites”).

The use of information collected through our Sites shall be limited to the purpose for which it was gathered, i.e., providing a service for which a Client has engaged DDI, providing information to prospective Clients, gathering information for research purposes, or gathering information on applicants for career opportunities at DDI.

We collect and use certain personal information about you. When we do so we are subject to various laws in the United States and the General Data Protection Regulation (“GDPR”) which applies across the European Union, and we are responsible as “processor” of that personal information for the purposes of those laws. Further, we are also subject to China’s Personal Information Protection Law (“PIPL”) and are responsible as “processor” of that personal information. Additionally, we are also subject to Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) as well as Thailand’s Personal Data Protection Act (“PDPA”).  We will abide by each of these laws solely to the extent that we process your data subject to the jurisdiction covered by each applicable law.

Key Terms:

The personal information listed above is required to provide products and/or services to you, unless otherwise specified within your DDI account page. If you do not provide the personal information we request, it may delay or prevent us from providing products and/or services to you.

How Your Personal Information Is Collected:

DDI collects personal information directly from consumers’ website, email, phone, and indirectly from enterprise clients who may provide us with your information in accordance with applicable employment or contractor agreements. DDI may also collect information:

• Directly from a third party;
• From a third party (such as your employer) with your consent;
• From cookies on our website; and
• Via our IT systems, including:
  1. Automated monitoring of our websites and other technical systems
  2. Communication systems such as email and instant messaging services

DDI may also collect personal information from public sources. By posting personal information online that is publicly accessible, you may receive unsolicited messages from other parties in return. Please keep in mind that whenever you voluntarily disclose personal information online - for example on blogs, message boards, through email, or in chat areas - that information can be collected and used by others.

We are not responsible for the personally identifiable information you choose to submit in these forums. To request removal of your personal information from our blog or community forum, contact us at DataProtectionOfficer@ddiworld.com. In some cases, we may not be able to remove your personal information, in which case we will let you know if we are unable to do so and why.

How and Why, We Use Your Personal Information:

Under applicable data protection laws, as a processor DDI can only use your personal information if we have a proper reason for doing so, e.g.,

• To comply with our legal and regulatory obligations;
• For the performance of our contract with you or your employer or to take steps at your (or your employer’s) request before entering into a contract; or
• Where you have given consent.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. The table below explains what we use (process) your personal information for and our reasons for doing so:

DDI also collects information from our users at several different points on the Sites. Our clients may use our Sites to collect candidate/applicant personal information, including names, addresses, and phone numbers, regarding a specific job posting or opening. There is no direct relationship between the client’s site(s) and the Sites, although at a client’s request, client sites may link to content on the Sites.

To use full functionality offered by the Sites, a user may be required to provide certain Personal Information. Personal Information may be shared and used by DDI and the client (for which the applicable site is hosted) as well as any other third-party vendors secured by the client to facilitate candidate or employee assessment or selection processes.

Summaries of de-identified or anonymized and aggregated data analyses may be presented to public audiences (e.g., scientific conferences). Review of DDI’s general approaches and accumulated results with professional audiences ensures that DDI's assessment methods remain up to date with best practices and professional, technical, and legal standards. While these summaries may be linked to general industries, the identities of client organizations and individuals remain completely confidential.

Summaries of aggregated data may also be used to create normative profiles (or “benchmarks”) for assessments. Normative profiles will not identify individuals or client organizations; however, the source data may link back to some or all the client organizations that are contained within the data set for the purpose of defining the characteristics of the norm sample (such as platform, industry, etc.)
 

DDI routinely shares personal information with:

We only allow our service providers to handle your personal information if we are satisfied, they take commercially reasonable and appropriate measures to protect your personal information. We also impose contractual obligations on service providers to confirm they can only use your personal information to provide services to us, to you, or to remain compliant with applicable laws and regulations of pertinent jurisdictions. We may also share personal information with external auditors in relation to ISO accreditation and the audit of our accounts.

We may also need to share some personal information with other parties, such as potential buyers of some or all our business during a re-structuring. We will typically anonymize or de-identify information, but this may not always be possible. Recipients of your personal information will be bound by confidentiality obligations.                         

Personal Information Disclosed to Vendors:

In the preceding 12 months, we have disclosed to vendors the following categories of personal information that identifies, relates to, describes, is capable of being associated with, or could be linked, direct or indirectly, with a particular consumer or household:

• Identifiers (e.g., first and/or last name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers);
• Information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, physical characteristics or description, address, telephone number, education, employment, employment history, or any other similar information;
• Characteristics of protected classifications under California or federal law;
• Commercial information (e.g., products or services purchased, obtained, or considered, or other purchasing or consumer histories, tendencies or similar information);
• Biometric information;
• Internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement);
• Geolocation data;
• Audio, electronic, visual, haptic, or similar information;
• Professional or employment-related information;
• Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences and characteristics.

Where Your Personal Information is Held:

All Personal Information, regardless of the country of origin, is transferred to, processed, and stored in the United States. Data may also be accessed or used globally where authorized Client or DDI associates providing services to the Client are located. In addition, DDI is compliant with GDPR, PIPEDA, PIPL, and PDPA and the associated requirements to the extent we are processing data subject to those applicable jurisdictions.

Information may also be stored at our offices and those of our group companies, third party agencies, service providers, employees, contractors, affiliates, representatives, and agents as described above (see: “Who We Share Your Personal Information With” above). Some of these third parties may be based outside the European Economic Area and the United States. Note: subprocessors’ servers are not located outside the EEA and U.S. For more information, including on how we safeguard your personal information when this occurs, see below: “Transferring Your Personal Information Out of the EEA and U.S.”

How Long Your Personal Information Will Be Kept:

DDI will retain your personal information while you have an account with us or while we are providing products or services to you, and for up to 5 years post user inactivity. Thereafter, we will keep your personal information for as long as is necessary:

• To respond to any questions, complaints, or claims made by you or on your behalf;
• To fulfill a lawful request made by a regulatory body of an applicable jurisdiction;
• To show that we treated you fairly; or
• To keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods apply for distinct types of personal information. DDI may however, retain and use your information in anonymized format for research purposes for indefinite periods of time.

When it is no longer necessary to retain your personal information subject to the agreed upon retention period, DDI will delete or anonymize said information. 

Transferring Your Personal Information Out of the EEA and U.S.:

To deliver services to you, it is sometimes necessary for us to share your personal information outside the European Economic Area and United States, e.g.:

• With our offices outside the EEA and U.S.;
• With your and our service providers located outside the EEA or U.S.;
• If you are based outside the EEA or U.S.;
• Where there is an international dimension to the services we are providing you.

The following countries to which we may transfer personal information have been assessed by the European Commission as providing an adequate level of protection for personal information:

• Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom, and Uruguay.
  • For more information, see the official website of the European Commission, here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

Except for the countries list above, non-EEA countries do not have the same data protection laws as the United Kingdom and EEA. DDI will, however, ensure the transfer complies with data protection laws and exercise reasonable efforts to keep all personal information secure. Our standard practice is to use standard contractual clauses that have been approved by the European Commission. To obtain a copy of those clauses, see: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. If you would like further information, please contact our Data Protection Officer (see “How to Contact Us” below).

Your Rights Under the General Data Protection Regulation (“GDPR”) to the extent we to the extent we are processing data subject to GDPR jurisdiction:

For further information on each of those rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner’s Officer (ICO) on individual rights under the General Data Protection Regulation.

Your Rights Under the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act ("CPRA") – to the extent we to the extent we are processing data subject to a CCPA or CPRA jurisdiction:

Keeping Your Personal Information Secure:

We have implemented commercially reasonable security measures in place to avert personal information from being accidently lost or used or accessed in an unauthorized manner. We limit access to your personal information to those who have a genuine business need to access it.  We limit processing to your personal information to those who have a genuine business need to process it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. DDI continually tests its systems and is ISO 27001 certified, which means we follow top industry standards for information security. DDI aligns to the ISO 27701 standard for privacy. DDI also has procedures in place to deal with any suspected data security breach. DDI will notify you and any applicable regulator of a suspected data security breach where legally required to do so.

DDI takes industry standard and reasonable precaution to protect our users' information during transmission and upon receipt. When users submit Personal Information via the Sites, their information is protected both online and offline. When you enter sensitive information on our Sites, we encrypt that information using secure socket layer technology (SSL). Additionally, all data is encrypted on disk via hardware encryption.

The servers that store personally identifiable information are in a secure environment in a secure Tier 4 data center. Only employees who need the information to perform a specific job are granted access to personally identifiable information. Those employees are required to respect the confidentiality of your Personal Information.

For Sites where you have a user account, you are solely responsible for maintaining the confidentiality of your username and password. If you believe that confidentiality has been compromised, contact DataProtectionOfficer@ddiworld.com.

How to Exercise Your Rights:

If you would like to exercise any of your rights as described in this Privacy Policy, please:

• Complete a data subject request form available on our website at:  https://corp.ddiworld.com/gdpr/data-request-form-individual;
• By email at: DataProtectionOfficer@ddiworld.com;
• Or by postal mail sent to:

Attn: DDI Data Protection Officer

Development Dimensions International, Inc.

1225 Washington Pike

Bridgeville, PA 15017 USA

Please note that you may only make a CCPA or CPRA-related data access or data portability disclosure request twice within a 12-month period.

If you choose to contact us directly by email, phone, postal mail, webform, or similar means, you will need to provide DDI with:

• Enough information to identify yourself (e.g., your full name, address, client/user ID, reference number, or IP address);
• Proof of your identity or address (e.g., a copy of your government issued ID, a recent utility bill, or voter registration); and
• A description of what right you wish you exercise and the information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person’s behalf.

Any personal information we collect form you to verify your identity in connection with you request will be used solely for the purposes of verification.

How to File a GDPR Complaint:

Our Data Protection Officer will strive to resolve any query or concern you raise about our use of your information.

The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in the European Economic Area state where you work, normally live, or where any alleged infringement of data protection laws occurred.

Service Announcements:

On rare occasions it is necessary to send out a service-related announcement. For instance, if access is suspended to one or more of our Sites for maintenance, an email notification may be generated and sent to end users. Users may not opt-out of these notifications; these communications are informational in relation to the service being rendered and not promotional in nature.

Changes to This Privacy Notice:

DDI may change this privacy notice from time to time. When we do, we will post changes on the Sites and other places deemed appropriate, so our users are always aware of what information we collect, how we use it, and under what circumstances, if any, we share or disclose it.

If we are going to use users' Personal Information in a manner different from that stated at the time of collection, we will notify users by posting a notice on the Sites for 30 days or emailing you prior to the change becoming effective.

Choice/Opt-out:

Users who provide information requested by the Sites, or who continue to use the Sites after having an opportunity to review this Privacy Policy, thereby consent to the terms of this Privacy Policy and to DDI's use of the information it collects as described in this Privacy Policy. Those who do not agree to this Privacy Policy may not use the Sites. Users also have the right to revoke prior consent at which time access to Sites and usage of Services would cease.

Transfer or Assignment:

Transfer or Assignment in Connection with Business Transfers or Bankruptcy. In the event of a merger, acquisition, reorganization, bankruptcy or other sale of all or a portion of our assets, any user information owned or controlled by us may be one of the assets transferred to third parties. We reserve the right, as part of this type of transaction, to transfer or assign your personal information and other information we have collected from users of the Sites to third parties. Data collected via some Sites, however, belong to our client organizations and would not be considered an asset to be transferred without prior consent. Other than to the extent ordered by a bankruptcy or other court, or as otherwise agreed to by you, the use and disclosure of all transferred user information will be subject to this Policy. However, any information you submit or that is collected after this type of transfer may be subject to a new privacy policy adopted by the successor entity.

Consent to Marketing:

By submitting a contact form, or any other form accessible from our public Internet Sites, users consent to DDI emailing them, collecting their personal information, and processing that information in the provision of services and for the purposes of marketing and research. A link is provided with each form to make users aware of their rights and the ways in which their information will be used as referenced in DDI’s Data Privacy Policy. Users have the right to revoke this consent at any time.

Acceptable Use:

This section applies to the software systems and all related electronic or printed help and documentation accessed via the Sites.

Users are granted non-exclusive, non-transferable, non-sublicensable, revocable permission to access and display the Sites on their computer screens and to generate outputs from the Sites as designed and intended per descriptions in the Sites' relevant documentation. Users acknowledge that DDI will not be liable or held at fault for any performance or operational problems resulting from nonconformance to the published technical specifications necessary for access to the Sites as previously provided to DDI’s clients. DDI shall not be liable or held to be in default of performance or operational obligations due to any technical or design problem within the electronic network which compromises users' access to the public Internet.

Neither the Sites, screens within the Sites, nor the hard-copy outputs generated from the Sites may be used by or disclosed to third parties except as may be required in connection with inquiries by government or regulatory authorities.

DDI provides Web-based or Cloud-based applications, virtual reality programs, equipment, assessments, testing, software systems and related tools which may be used by DDI to perform and provide Services (“Tools”). Except as expressly authorized herein, users shall not: (i) copy the Tools in whole or in part; (ii) reverse compile, reverse assemble, or access with intent to "hack" all or any portion of the Tools; (iii) distribute, market, rent, lease, provide access to, or transfer the Tools to third parties; or (iv) modify the Tools except as otherwise provided. No license, right, or interest in any DDI trademark, trade, or service mark is granted hereunder.

For additional information, please read DDI's Terms and Conditions of Use Agreement.

Protection of Children’s Information:

The Sites do not publish content or collect data that is targeted at children.

Links:

Sites can contain links to external sites. Please be aware that DDI is not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our Sites and to read the privacy policies of every web site that collects personally identifiable information.

How to Contact Us:

Please contact DDI at:

• By email at: DataProtectionOfficer@ddiworld.com;
• Or by postal mail sent to:

Attn: DDI Data Protection Officer

Development Dimensions International, Inc.

1225 Washington Pike

Bridgeville, PA 15017 USA

To report a privacy or security incident, email DataProtectionOfficer@ddiworld.com.[WN1] 

Further Resources:

• Explore how DDI secures data
• Visit this page to select the type of marketing emails you would like to receive from us or to unsubscribe

Need Extra Help?

If you would like this notice in another format (e.g., audio, large print, braille) please contact us (see: “How to Contact Us” above).