Terms of Service

Privacy Policy – Universal Measures

Universal Measures Aktiebolag (corporate registration number 559559–9027) respects your privacy and wants you to feel safe about how your personal data is processed by us. Universal Measures Aktiebolag, operating under the product brand Lobe-Insights, respects your privacy and wants you to feel confident about how your personal data is processed. References to 'Lobe' in this Privacy Policy refer to the same service. Below you will find information about the data we process about you, for what purposes, the legal basis for processing, how long the data is retained, and your rights.

Data controller and Data Protection Officer

Universal Measures Aktiebolag (corporate registration number 559559–9027) is the data controller for the processing of your personal data.

If you have questions regarding the processing of your personal data, or if you would like erasure, rectification, or a copy of your personal data (data subject access request), please email: privacy@lobe-insights.com

Universal Measures Aktiebolag develops and operates the Lobe-Insights platform and related services. “Lobe-Insights” is the trading name and product brand under which Universal Measures Aktiebolag provides its services. Any reference to “Lobe-Insights,” “we,” “us,” or “our” in this Privacy Policy refers to Universal Measures Aktiebolag as the legal entity responsible for your data.

Lobe-Insights is a product of Universal Measures Aktiebolag, your data controller. We collect only what we need to provide our personality assessment service. We never sell, rent or trade your personal data, and you are always in control.

Whose data do we process?

In a company, personal data is processed for various stakeholders. The stakeholder groups of Universal Measures Aktiebolag (the “Company”) have been identified as follows:

  1. Users: Individuals who use the Company’s services, such as personality testing. This group includes those who take a personality test; those who compare their test with other users; and those who have registered in our member database without having used the service.

  2. Potential users: Individuals who have visited our website and viewed the service, and potential users identified through outreach activities.

  3. Customers: Contact persons at companies purchasing the Company’s services.

  4. Potential customers: Contact persons at companies that we approach for marketing purposes.

  5. Suppliers: Contact persons at companies from which we purchase services and products.

  6. Recruitment applicants: individuals who apply for positions at the Company

  7. Employees: Persons who are employed, or have been employed, in our business and at our offices.

  8. Shareholders: persons registered in the Company’s share register.

  9. Other stakeholders: Persons who do not belong to any of the categories above, but with whom the Company has contact for various reasons (e.g. professional network contacts, media contacts, etc.).

Summary by stakeholder group (overview)

The table below provides a simplified overview. For full details, see the sections further down in this Privacy Policy.

Table

How do we use and protect your personal data?

Depending on the stakeholder group you belong to, the Company processes personal data for varying lengths of time and for different reasons.

What do we use your personal data for?

 

Public Figure Personality Profiles

Lobe may display personality profiles of public figures on the platform. These profiles are not self-reported. They are created by aggregating observer ratings collected from independent volunteer raters recruited through external survey platforms.

Each rater is presented with a selection of public figures and asked to assess those they feel they know well on the six HEXACO personality dimensions. Individual raters’ responses are stored internally for quality control and aggregation purposes only. Individual ratings are never displayed publicly, shared with third parties, or linked to any specific public figure profile on the platform.

Only aggregated average scores, derived from multiple independent raters, are displayed on the platform. These profiles reflect how the public perceives the individual and do not represent the public figure’s own self-reported personality.

The legal basis for processing rater data is consent, obtained at the time of participation in the survey. Rater data is retained for as long as the corresponding public figure profile is displayed on the platform, or until the rater requests erasure. If a rater requests erasure of their individual responses, the aggregated profile may be recalculated or removed if the remaining number of ratings is insufficient.

Public figure profiles are clearly labelled on the platform to distinguish them from self-reported user profiles. Users who compare their own profile with a public figure profile are informed that the comparison involves two different measurement methods: self-report and observer rating.

Profiling and automated decision-making

We may use information from personality assessments and other inputs to create a profile of an individual’s characteristics and preferences (profiling) for the purposes described in this Privacy Policy (e.g. providing the service and, where applicable, supporting relevant matches or insights as part of a customer’s process).

We do not make decisions about you that produce legal effects or similarly significant effects solely by automated means. The service is designed to support human assessment. Where assessments are shared with customers, the customer remains responsible for final decision-making and will typically involve human review and oversight.

Where the service is used in an employment context (e.g. recruitment/selection or monitoring/assessment of workers), such use may fall within the EU AI Act category of high-risk AI systems. In those cases, the customer (as deployer) is responsible for complying with applicable requirements, including human oversight, required notices to affected individuals (and where applicable workers and their representatives), and retaining automatically generated logs for at least six months to the extent such logs are under the deployer’s control, unless other applicable law requires otherwise. These customer responsibilities are further described in our customer terms and instructions for use.

You can contact us at any time to request more information about any profiling we carry out and to exercise your rights (see “Your rights”). Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

What personal data may we collect?

“Personal data” means any information that directly or indirectly relates to a natural, living person. Accordingly, personal data is information about you, e.g. your name, your contact details, pictures of you, and your IP address.

“Processing” means any operation performed on personal data, such as collection, storage, use, adaptation, or disclosure.

Processing of special categories of personal data

Lobe-Insights doesn’t process special categories of personal data (regulated in Art. 9 GDPR). The personality test data is therefore not treated as special category data under GDPR Article 9.

Customers, suppliers and partners

The Company collects and stores the information about you that the Company needs to contact you and to fulfil its undertakings toward you as a customer, supplier or partner.

The personal data we process regarding our suppliers is the data we need to maintain our professional relationship. This may include personal data relating to account managers, support functions, service staff, finance departments, or other key persons, such as:

Potential customers, suppliers and partners and company representatives

The Company collects and stores the following information about you in your role as a potential customer of the Company, or in your role as a representative of a company that is a potential customer of the Company, for example:

How have we collected this personal data?

Where we collect personal data from sources other than you (e.g. public company websites or professional networking platforms), we will provide the information required under Article 14 GDPR within the applicable timeframe, unless an exemption applies.

Please note that the list above is not exhaustive.

To offer our services to companies that do not already know us, we collect contact details of key persons at companies we wish to contact and approach for marketing purposes.

Visitors of the Company’s website

In connection with visits to the Company’s website, the Company collects the following information that the Company needs to improve, streamline, simplify and develop our website, for example:

Recruitment applicants (job applicants)

Unless you consent to a longer retention period, we typically retain recruitment-related personal data for up to 24 months after the recruitment process has ended (counted from the date the position is filled/closed), to handle follow-up questions and to document a fair recruitment process. If required to defend or establish legal claims, we may retain relevant information for a longer period.

The Company collects and stores the following information about you that the Company needs to recruit suitable persons for positions at the Company, for example:

The Company advises you not to share sensitive personal data with us regarding ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or data concerning sex life or sexual orientation. We therefore reserve the right, without your consent, to delete any data of a sensitive nature as described above, as well as personal data relating to persons other than yourself.

Unless you consent to a longer retention period, we typically retain recruitment-related personal data for a limited period after the recruitment process ends, to handle potential follow-up questions and to document a fair recruitment process. Exact periods may vary depending on the circumstances and applicable law.

Employees

When you become employed by us, you enter into an agreement with us as your employer. In this relationship, we as an employer need to process a larger amount of personal data because we must comply with numerous legal obligations applicable to employers in Sweden. Examples include occupational health and safety legislation, anti-discrimination legislation, the Sick Pay Act, the Annual Leave Act, and tax legislation.

How have we collected your personal data?

Please note that the list above is not exhaustive.

Shareholders

The Company collects and stores the following information about you in your role as a shareholder:

Website Visitors

When you visit our website, we collect technical and usage data including:

How have we collected your personal data?

With respect to customers, suppliers and partners and company representatives, as well as potential customers, suppliers and partners and company representatives, your personal data is usually collected from the company or organization you represent, but in some cases also directly from you, e.g. by email, via our social media, other channels of communication, or in connection with events or meetings. The Company may also receive personal data about you from other partners. The Company also uses external information services to supplement existing data, e.g. with your position and contact details.

With respect to visitors to our website and job applicants, your personal data may be provided directly by you or by the staffing agency, recruitment company, or hiring company through which you apply.

How have we collected your personal data?

Please note that the list above is not exhaustive.

Repeated testing and data aggregation

Lobe retains your responses from all previous personality tests and aggregates them to produce a more accurate personality profile over time. Each new test you take is stored alongside your earlier responses. If you delete your account, all historical test responses and your aggregated profile are permanently removed.

Sign-in via LinkedIn

Lobe uses LinkedIn OAuth for user registration and authentication. When you sign in with LinkedIn, we receive and store the following data from your LinkedIn account:

This data is used to create and maintain your Lobe account, display your name and photo within the platform, and enable other users to find and compare with you (if you have enabled this in your privacy settings). We do not access your LinkedIn connections, posts, messages, or any other LinkedIn data beyond what is listed above. We never post to LinkedIn on your behalf.

The legal basis for processing this data is contract (Article 6(1)(b) GDPR) — the data is necessary to provide the service you have registered for.

Add Lobe Card/sharing mechanics

Your Insight Card displays your name, your personality archetype, and your Lobe ID. It does not include your trait scores or percentile values. You can share your Insight Card with others at any time — sharing the card does not reveal your underlying personality data.

Your personality data is private by default. You control what others can see through two settings on your Settings page. When you enable 'Allow recruiters to see my personality profile,' recruiters can view your full personality profile for matching purposes. When you enable 'Allow anyone to compare my personality profile,' other users can compare with you — they see only the overall similarity percentage and which traits you share most and least, never your actual scores. Both settings are off by default and can be changed at any time.

With whom do we share the information?

Typical categories of recipients/processors may include:

Your personal data is used within our organization to maintain, or create the conditions to establish, a business relationship. We may also share information with our sister companies.

We share your personal data with third-party suppliers engaged to perform services on our behalf (such as technical, administrative, marketing-related, or other services) when required in order to manage our cooperation or to approach you as a potential customer. All third-party suppliers engaged to process personal data on our behalf are bound by data processing agreements that prohibit them from using your data for their own purposes.

Since we work with personality tests, this means we may share your information with our customers (however, not without your consent).

We distinguish between persons who are in contact with us as private individuals and persons who are in contact with us on behalf of a company. In the first case, we are more restrictive and generally do not share such data externally. Regarding personal data relating to professionals, we are not as restrictive, as sharing contacts within professional networks supports business and company growth. We also consider personal data where you represent a company to be less privacy-sensitive than personal data relating to private individuals.

Your personal data may also be disclosed where required by law, for example under anti-discrimination legislation, or to a data protection authority.

Transfer of personal data to third countries

The Company may transfer your personal data to countries outside the EU/EEA. If personal data is transferred to a country outside the EU/EEA, the Company will take measures to ensure that the personal data remains protected and will implement the necessary safeguards to ensure a lawful transfer.

Where we use IT suppliers that process personal data in the United States, transfers may, depending on the circumstances, take place on the basis of an adequacy decision (e.g. the EU–U.S. Data Privacy Framework, where applicable) or on the basis of appropriate safeguards such as Standard Contractual Clauses (SCCs), together with any required supplementary measures. For reference, the Court of Justice of the European Union invalidated the EU–U.S. Privacy Shield in 2020 (Schrems II).

If you would like more information about the safeguards we use for transfers outside the EU/EEA, please contact us at privacy@lobe-insights.com

Legal basis under the GDPR

Our role (controller/processor) and customer roles

Whether we act as a controller or a processor depends on the specific situation and which service is used.

If you have questions about which entity is the controller for a particular processing activity, please contact us and we will clarify.

The Company’s legal bases for processing personal data are consent (Article 6(1)(a)), contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), and legitimate interests (Article 6(1)(f)).

Social media

Regarding personal data that occurs and is processed on social media, such as Facebook, Instagram, X, YouTube and LinkedIn, we refer users to the policies provided by the respective service providers for information on how each service provider processes personal data. In the Company’s view, the purpose of the processing is that representatives of existing and potential customers and partners shall be able to interact and maintain contact with the Company via social media, to contribute to good relationships and to make the Company’s customer service and product widely accessible through several different channels. The processing is necessary for the purposes of the Company’s legitimate interest to market its brand and products to existing and potential customers and to partners.

Security of your personal data

You should always feel safe when you provide us with your personal data. Therefore, the Company has implemented necessary security measures to protect your personal data against unauthorized access, alteration, and destruction. The Company will not disclose your personal data, other than as expressly provided by this Privacy Policy.

Cookies

What Are Cookies?

Cookies are small files stored on your device that allow websites to recognise your device, remember your preferences, and collect information about how you use the site. Some cookies are essential for the website to function; others are optional and used for analytics or marketing.

Cookie lifetimes vary depending on type and purpose. Strictly necessary cookies are typically session-based or retained for up to 12 months. Where analytics cookies are enabled (based on consent), analytics identifiers and related usage data are typically retained for up to 24 months (or another period shown in our cookie settings), after which they are deleted or anonymized.

The Company uses cookie-like techniques on the Company’s website to allow customers to save their login information and to the extent necessary for the website’s functionality. The information is stored in the form of a file comprising session data.

What are cookies used for?

Cookies are used to store or access information stored on your device, such as your computer or mobile phone. Cookies can remember what you do on a website. Some cookies are necessary for the website to function, e.g. language settings or login details.

Why do we use cookies?

Personal data may be collected when you use our website, and information about your use and which pages are visited may be stored. This may include technical information about your device and internet connection, such as operating system, browser version, IP address, cookies, and unique identifiers.

We use strictly necessary cookies to enable core website functionality (e.g. security, load balancing, and saving your preferences). Where we use analytics or marketing cookies, these are set only after you have provided consent via our cookie banner/settings, and you can withdraw or change your consent at any time.

To use the website fully, you must accept cookies, which you do via your browser settings. If you do not want to accept cookies, you can disable cookies via your browser security settings. However, this means that the website (https://lobe-insights.com) will not function as intended.

You can read more about cookies on the Swedish Post and Telecom Authority’s website: https://pts.se/internet-och-telefoni/kakor-cookies/#vad-används-kakor-till?

If you do not share your personal data with the Company

If you do not share your personal data with the Company, the Company will not be able to fulfil its legal or contractual obligations towards you. For shareholders, this means you will not be able to exercise your rights as a shareholder, including attending and voting at general meetings.

Your rights

As the data controller, the Company is responsible for ensuring that your personal data is processed in accordance with applicable legislation.

The Company will, at your request or on its own initiative, rectify, erase, or complete any information found to be inaccurate, incomplete, or misleading.

We will respond to your request without undue delay and in any event within one month of receiving it. If necessary, this period may be extended by two further months depending on the complexity and number of requests.

You have the right to request access to, and rectification or erasure of, your personal data, to request restriction of processing, and to object to processing, as permitted by applicable data protection legislation. The Company will notify each recipient to whom personal data has been disclosed regarding rectifications or erasures as well as restriction of processing.

Erasure of personal data

If you have registered your personality profile (for example when you took a personality test), you can end your membership at any time by having your profile erased by us. You do this by contacting us and requesting that we erase all personal data we have collected about you, including your personality profile. When your profile is erased, your profile and all information in our systems will be removed.

Under certain conditions, you have the right to data portability, i.e. the right to receive your personal data in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller.

If you do not want the Company to process your personal data for direct marketing purposes, you have the right to object to such processing at any time. When the Company has received your objection, the Company will cease the processing of your personal data for such marketing purposes.

In general, you have the right to obtain a copy (a register extract) of the personal data we process about you, free of charge. However, where requests are manifestly unfounded or excessive (in particular because of their repetitive character), we may either charge a reasonable fee (considering the administrative costs of providing the information) or refuse to act on the request.

We welcome you to contact us if you have complaints regarding the Company’s processing of your personal data, so we can correct our processing if necessary. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) regarding the Company’s processing of your personal data.

How long do we retain the information?

The Company does not retain personal data longer than necessary in relation to the purposes of the processing, in accordance with Article 5(1)(e) (the storage limitation principle). When the purposes of a specific processing activity have been fulfilled, the Company’s main rule is that the data in question is anonymized or erased as part of our regular retention review routine. The Company also automatically deletes personal data after a certain period.

Further information

Users

Your account will be retained while it is active. For the purposes of this Policy, 'activity' means logging in, taking a test, updating your profile, or otherwise using the service in a way that updates your account.

You own the data registered in your profile and decide whether you want to be erased, in whole or in part.

If you have not updated your personality profile or used the Company’s services during a period of five (5) years, your account will be automatically deleted. We will notify you before this deadline to give you the opportunity to reactivate your account if you wish to remain registered.

If you contact us and request that your data be erased, we will do so unless we are legally required to retain the information.

We reserve the right to delete user accounts, including the personality profile, if we see that the account is misused in any way, if the account is created for purposes other than those offered by the service, or if the user has otherwise behaved improperly. Each user may only hold one account, which is tied to a verified LinkedIn identity. Creating multiple accounts is grounds for account termination.

Customers and potential customers

For business-to-business marketing and relationship management, we typically retain contact data for up to 24 months after the last meaningful interaction with you (e.g. a meeting, call, or email exchange). We periodically review and delete or anonymize inactive records.

If you opt out of marketing communications, we may retain limited information (e.g. your email address) in a suppression list for up to 3 years to honour your opt-out and avoid contacting you again unintentionally.

We continuously update this database, meaning we work to maintain an up-to-date and accurate database with current and correct contacts. This takes place through contact with you by phone, email, and in personal meetings, but also through monitoring external information sources. If you do not want to be included in our system as a potential customer, you can either inform us or unsubscribe from mailings and further contact. To avoid contacting you after your unsubscribe request, we must still store either your name or email address in a so-called suppression list. If you request to be completely forgotten, there is a risk that we may find your contact details again and contact you anew.

Customers and suppliers

If you, as a representative of a company, have ordered a service from us and your name has been used as the reference for the assignment, we will retain your personal data for seven (7) years to comply with the retention period for accounting records under the Swedish Accounting Act (Bokföringslagen). If we have ordered a service or product from you, we will retain any customer data in invoices and supporting documentation for seven (7) years to comply with the same retention period.

If a customer contract expires, we must, under Swedish law still process certain information relating to the ordering party for an additional seven (7) years after the service has been performed, based on a legal obligation due to statutory accounting retention requirements.

Recruitment applicants (job applicants)

We typically retain recruitment-related personal data for up to 24 months after the position has been filled or the recruitment process has closed (counted from the date the position is filled/closed). Please note that exact periods may vary depending on the circumstances and applicable law. This period allows us to handle follow-up questions and to document that the process was conducted fairly. If you give consent to a longer retention period (e.g. to be considered for future roles), we will retain your data for the period agreed. If we need to retain data to establish, exercise, or defend a legal claim, we may do so for the duration of the relevant proceedings.

Employees

We process personal data throughout your employment. When your employment ends, a large part of your personal data will be automatically deleted. Please note that after your employment ends, we will continue to process certain personal data (the parts needed for accounting) under Swedish law for a further seven (7) years, on the legal basis of legal obligation.

Please note the following:

 

Shareholders

Share register data is retained for as long as required by Swedish company law and applicable share register regulations.

 

Effective date of This Privacy Policy

Effective date of This Privacy Policy is 2026-04-21.

Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be published on our website at https://lobe-insights.com, with a clear notice of the effective date of the updated version. We will also notify customers and partners in an appropriate manner. The current version of this Privacy Policy is always available at https://lobe-insights.com.

Our contact details

Do not hesitate to contact the Company if you have any questions about this Privacy Policy, the processing of your personal data, or if you wish to exercise your rights under this Privacy Policy or applicable legislation.

If you would like to contact the Company regarding your personal data, you may email: privacy@lobe-insights.com

At the same address you can:

We also accept telephone calls at 0736 89 53 09.

If you prefer to contact us by post:

Contact Information

Universal Measures Aktiebolag

Corporate registration number: 559559-9027

Postal address: Vretgränd 4a, 753 22 Uppsala, Sweden

Email address: privacy@lobe-insights.com

 

Supervisory authority

If you believe that we have in any way breached our handling of your personal data, you may file a complaint with Integritetsskyddsmyndigheten (IMY), which is the supervisory authority for personal data processing and data protection.

Contact details:

Telephone: 08-657 61 00

Email: imy@imy.se

Integritetsskyddsmyndigheten

Box 8114

104 20 Stockholm

More information: https://www.imy.se