Universal Measures Aktiebolag (corporate registration number 559559–9027) respects your privacy and wants you to feel safe about how your personal data is processed by us. Universal Measures Aktiebolag, operating under the product brand Lobe-Insights, respects your privacy and wants you to feel confident about how your personal data is processed. References to 'Lobe' in this Privacy Policy refer to the same service. Below you will find information about the data we process about you, for what purposes, the legal basis for processing, how long the data is retained, and your rights.
Universal Measures Aktiebolag (corporate registration number 559559–9027) is the data controller for the processing of your personal data.
If you have questions regarding the processing of your personal data, or if you would like erasure, rectification, or a copy of your personal data (data subject access request), please email: privacy@lobe-insights.com
Universal Measures Aktiebolag develops and operates the Lobe-Insights platform and related services. “Lobe-Insights” is the trading name and product brand under which Universal Measures Aktiebolag provides its services. Any reference to “Lobe-Insights,” “we,” “us,” or “our” in this Privacy Policy refers to Universal Measures Aktiebolag as the legal entity responsible for your data.
Lobe-Insights is a product of Universal Measures Aktiebolag, your data controller. We collect only what we need to provide our personality assessment service. We never sell, rent or trade your personal data, and you are always in control.
In a company, personal data is processed for various stakeholders. The stakeholder groups of Universal Measures Aktiebolag (the “Company”) have been identified as follows:
Users: Individuals who use the Company’s services, such as personality testing. This group includes those who take a personality test; those who compare their test with other users; and those who have registered in our member database without having used the service.
Potential users: Individuals who have visited our website and viewed the service, and potential users identified through outreach activities.
Customers: Contact persons at companies purchasing the Company’s services.
Potential customers: Contact persons at companies that we approach for marketing purposes.
Suppliers: Contact persons at companies from which we purchase services and products.
Recruitment applicants: individuals who apply for positions at the Company
Employees: Persons who are employed, or have been employed, in our business and at our offices.
Shareholders: persons registered in the Company’s share register.
Other stakeholders: Persons who do not belong to any of the categories above, but with whom the Company has contact for various reasons (e.g. professional network contacts, media contacts, etc.).
The table below provides a simplified overview. For full details, see the sections further down in this Privacy Policy.

Depending on the stakeholder group you belong to, the Company processes personal data for varying lengths of time and for different reasons.
The Company assesses users’ personality and, in some cases, logical ability.
The Company may, as a data processor, compare and assess users’ personality on behalf of customers.
The Company may provide you with personalized offers, information, or invitations that we consider interesting to you via email, digital and/or social media, and/or present you as a candidate based on customers’ requests and/or your personality-related competencies and, in some cases, logical ability.
Ongoing communication regarding your use of the Company’s services.
Other statistical purposes, for example, to maintain and develop the quality of our services.
Lobe may display personality profiles of public figures on the platform. These profiles are not self-reported. They are created by aggregating observer ratings collected from independent volunteer raters recruited through external survey platforms.
Each rater is presented with a selection of public figures and asked to assess those they feel they know well on the six HEXACO personality dimensions. Individual raters’ responses are stored internally for quality control and aggregation purposes only. Individual ratings are never displayed publicly, shared with third parties, or linked to any specific public figure profile on the platform.
Only aggregated average scores, derived from multiple independent raters, are displayed on the platform. These profiles reflect how the public perceives the individual and do not represent the public figure’s own self-reported personality.
The legal basis for processing rater data is consent, obtained at the time of participation in the survey. Rater data is retained for as long as the corresponding public figure profile is displayed on the platform, or until the rater requests erasure. If a rater requests erasure of their individual responses, the aggregated profile may be recalculated or removed if the remaining number of ratings is insufficient.
Public figure profiles are clearly labelled on the platform to distinguish them from self-reported user profiles. Users who compare their own profile with a public figure profile are informed that the comparison involves two different measurement methods: self-report and observer rating.
We may use information from personality assessments and other inputs to create a profile of an individual’s characteristics and preferences (profiling) for the purposes described in this Privacy Policy (e.g. providing the service and, where applicable, supporting relevant matches or insights as part of a customer’s process).
We do not make decisions about you that produce legal effects or similarly significant effects solely by automated means. The service is designed to support human assessment. Where assessments are shared with customers, the customer remains responsible for final decision-making and will typically involve human review and oversight.
Where the service is used in an employment context (e.g. recruitment/selection or monitoring/assessment of workers), such use may fall within the EU AI Act category of high-risk AI systems. In those cases, the customer (as deployer) is responsible for complying with applicable requirements, including human oversight, required notices to affected individuals (and where applicable workers and their representatives), and retaining automatically generated logs for at least six months to the extent such logs are under the deployer’s control, unless other applicable law requires otherwise. These customer responsibilities are further described in our customer terms and instructions for use.
You can contact us at any time to request more information about any profiling we carry out and to exercise your rights (see “Your rights”). Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
“Personal data” means any information that directly or indirectly relates to a natural, living person. Accordingly, personal data is information about you, e.g. your name, your contact details, pictures of you, and your IP address.
“Processing” means any operation performed on personal data, such as collection, storage, use, adaptation, or disclosure.
Lobe-Insights doesn’t process special categories of personal data (regulated in Art. 9 GDPR). The personality test data is therefore not treated as special category data under GDPR Article 9.
The Company collects and stores the information about you that the Company needs to contact you and to fulfil its undertakings toward you as a customer, supplier or partner.
The personal data we process regarding our suppliers is the data we need to maintain our professional relationship. This may include personal data relating to account managers, support functions, service staff, finance departments, or other key persons, such as:
Personal information and contact information, such as name, address, telephone number, email address, title, position, employer, photos, and personal identity numbers (if you choose to provide them).
Information that you provide to the Company by email, via the Company’s social media, or through other channels of communication.
Where applicable, information regarding phone calls with the Company’s switchboard or customer service.
Where applicable, information regarding dietary preferences, potential allergies and/or disabilities (e.g. in connection with corporate events or meetings).
The Company collects and stores the following information about you in your role as a potential customer of the Company, or in your role as a representative of a company that is a potential customer of the Company, for example:
Personal information and contact information, such as name, address, telephone number, email address, title, position, and employer.
How have we collected this personal data?
We have received it from you.
We have received it from your employer or colleague.
We have received it because you visited our website, registered for and attended one of our events, expressed interest in being contacted, or subscribe to our newsletter.
We have sourced the information online. This may be from the company’s website or from job sites such as LinkedIn.
Where we collect personal data from sources other than you (e.g. public company websites or professional networking platforms), we will provide the information required under Article 14 GDPR within the applicable timeframe, unless an exemption applies.
We have received personal data from sister companies.
We have purchased information from external parties.
Please note that the list above is not exhaustive.
To offer our services to companies that do not already know us, we collect contact details of key persons at companies we wish to contact and approach for marketing purposes.
In connection with visits to the Company’s website, the Company collects the following information that the Company needs to improve, streamline, simplify and develop our website, for example:
Technical data, such as IP address, URL, unique device ID, network and device performance, browser, language and identification settings, geographic location, operating system, and other information from cookies or similar mechanisms (device information).
Unless you consent to a longer retention period, we typically retain recruitment-related personal data for up to 24 months after the recruitment process has ended (counted from the date the position is filled/closed), to handle follow-up questions and to document a fair recruitment process. If required to defend or establish legal claims, we may retain relevant information for a longer period.
The Company collects and stores the following information about you that the Company needs to recruit suitable persons for positions at the Company, for example:
Personal information and contact information, such as name, address, telephone number, email address, title, position, and employer.
Information in cover letter and CV.
Where applicable, your picture.
Other information that you provide to the Company in connection with recruitment.
The Company advises you not to share sensitive personal data with us regarding ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or data concerning sex life or sexual orientation. We therefore reserve the right, without your consent, to delete any data of a sensitive nature as described above, as well as personal data relating to persons other than yourself.
Unless you consent to a longer retention period, we typically retain recruitment-related personal data for a limited period after the recruitment process ends, to handle potential follow-up questions and to document a fair recruitment process. Exact periods may vary depending on the circumstances and applicable law.
When you become employed by us, you enter into an agreement with us as your employer. In this relationship, we as an employer need to process a larger amount of personal data because we must comply with numerous legal obligations applicable to employers in Sweden. Examples include occupational health and safety legislation, anti-discrimination legislation, the Sick Pay Act, the Annual Leave Act, and tax legislation.
How have we collected your personal data?
You have provided this yourself during the recruitment process and in connection with the start of your employment.
The data has been generated during your employment.
The data has come from other sources such as authorities, third-party providers performing services for us (e.g. payroll), and from references and customers.
Please note that the list above is not exhaustive.
The Company collects and stores the following information about you in your role as a shareholder:
Personal information and contact information, such as personal identity number, name, address, telephone number, email address, and position.
Holdings of shares or other financial instruments.
Financial instruments, e.g., information regarding voting rights at general meetings, shareholding, and rights relating to ownership.
Information regarding proxies representing shareholders, where applicable.
Information regarding trustees, pledges and pledgees, where applicable, and other notes in the share register.
Other information provided by you or the organization you represent.
When you visit our website, we collect technical and usage data including:
IP address and unique device identifiers.
Browser type, language settings, and operating system.
Pages visited, timestamps, and referral URLs.
Cookie identifiers and similar tracking data, subject to your consent preferences (see Section Cookies).
With respect to customers, suppliers and partners and company representatives, as well as potential customers, suppliers and partners and company representatives, your personal data is usually collected from the company or organization you represent, but in some cases also directly from you, e.g. by email, via our social media, other channels of communication, or in connection with events or meetings. The Company may also receive personal data about you from other partners. The Company also uses external information services to supplement existing data, e.g. with your position and contact details.
With respect to visitors to our website and job applicants, your personal data may be provided directly by you or by the staffing agency, recruitment company, or hiring company through which you apply.
How have we collected your personal data?
We have received the data from you.
We have collected it from others—e.g. references, customers, and job sites such as LinkedIn and Monster.
We have collected it when you have emailed or called us about a matter, or provided contact details in, for example, a survey we conducted where you requested to be contacted.
Please note that the list above is not exhaustive.
Repeated testing and data aggregation
Lobe retains your responses from all previous personality tests and aggregates them to produce a more accurate personality profile over time. Each new test you take is stored alongside your earlier responses. If you delete your account, all historical test responses and your aggregated profile are permanently removed.
Lobe uses LinkedIn OAuth for user registration and authentication. When you sign in with LinkedIn, we receive and store the following data from your LinkedIn account:
Your name (first and last name)
Your email address
Your profile photo (copied to our own storage)
Your LinkedIn profile link
This data is used to create and maintain your Lobe account, display your name and photo within the platform, and enable other users to find and compare with you (if you have enabled this in your privacy settings). We do not access your LinkedIn connections, posts, messages, or any other LinkedIn data beyond what is listed above. We never post to LinkedIn on your behalf.
The legal basis for processing this data is contract (Article 6(1)(b) GDPR) — the data is necessary to provide the service you have registered for.
Your Insight Card displays your name, your personality archetype, and your Lobe ID. It does not include your trait scores or percentile values. You can share your Insight Card with others at any time — sharing the card does not reveal your underlying personality data.
Your personality data is private by default. You control what others can see through two settings on your Settings page. When you enable 'Allow recruiters to see my personality profile,' recruiters can view your full personality profile for matching purposes. When you enable 'Allow anyone to compare my personality profile,' other users can compare with you — they see only the overall similarity percentage and which traits you share most and least, never your actual scores. Both settings are off by default and can be changed at any time.
Typical categories of recipients/processors may include:
IT hosting and infrastructure providers
Customer support tools providers
Email and communication platform providers
Analytics and consent-management providers (where enabled)
Professional advisors, including auditors and legal counsel, where necessary
Your personal data is used within our organization to maintain, or create the conditions to establish, a business relationship. We may also share information with our sister companies.
We share your personal data with third-party suppliers engaged to perform services on our behalf (such as technical, administrative, marketing-related, or other services) when required in order to manage our cooperation or to approach you as a potential customer. All third-party suppliers engaged to process personal data on our behalf are bound by data processing agreements that prohibit them from using your data for their own purposes.
Since we work with personality tests, this means we may share your information with our customers (however, not without your consent).
We distinguish between persons who are in contact with us as private individuals and persons who are in contact with us on behalf of a company. In the first case, we are more restrictive and generally do not share such data externally. Regarding personal data relating to professionals, we are not as restrictive, as sharing contacts within professional networks supports business and company growth. We also consider personal data where you represent a company to be less privacy-sensitive than personal data relating to private individuals.
Your personal data may also be disclosed where required by law, for example under anti-discrimination legislation, or to a data protection authority.
The Company may transfer your personal data to countries outside the EU/EEA. If personal data is transferred to a country outside the EU/EEA, the Company will take measures to ensure that the personal data remains protected and will implement the necessary safeguards to ensure a lawful transfer.
Where we use IT suppliers that process personal data in the United States, transfers may, depending on the circumstances, take place on the basis of an adequacy decision (e.g. the EU–U.S. Data Privacy Framework, where applicable) or on the basis of appropriate safeguards such as Standard Contractual Clauses (SCCs), together with any required supplementary measures. For reference, the Court of Justice of the European Union invalidated the EU–U.S. Privacy Shield in 2020 (Schrems II).
If you would like more information about the safeguards we use for transfers outside the EU/EEA, please contact us at privacy@lobe-insights.com
Whether we act as a controller or a processor depends on the specific situation and which service is used.
When a customer uses our services to assess its employees/candidates (e.g. as part of a recruitment or HR process), the customer typically acts as the controller and we act as the processor, processing personal data on the customer’s documented instructions under a data processing agreement (DPA).
When you create and use an account directly with us (without a customer instructing the processing), we typically act as the controller for the processing necessary to provide and administer the service to you.
For our own website, security logging, product development, and B2B marketing/relationship management, we act as the controller.
Where a customer receives assessment outputs from us and uses them in its decision-making (e.g. recruitment decisions), the customer is responsible for its own processing and for providing relevant privacy information to data subjects.
If you have questions about which entity is the controller for a particular processing activity, please contact us and we will clarify.
The Company’s legal bases for processing personal data are consent (Article 6(1)(a)), contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), and legitimate interests (Article 6(1)(f)).
Consent – you have given us your explicit permission to process your personal data for certain purposes about which you have received clear written information, for example on our website.
Contract – you have entered into an agreement with us. We may process your personal data to fulfil the terms of that agreement.
Legal obligation – the Company must process your personal data to comply with other legislation.
Legitimate interests – the Company’s legitimate interest in processing your personal data outweighs your interest, based on an assessment of the circumstances (a balancing test).
Users – processing is based on contract and/or consent. Before you carry out a personality test, you provide specific consent to this.
Potential users – processing is based on legitimate interests.
Customers, potential customers and suppliers – in contractual relationships (e.g. purchase of a service or product), processing is based on contract. For potential customers (e.g. marketing), processing may be based on legitimate interests.
Employees – employment is governed by an employment contract; the legal basis is contract.
Other stakeholder groups – the legal basis may vary depending on how the contact arose. In most cases, we will initially rely on legitimate interests. If we later determine that the individual falls within another stakeholder group, the legal basis applicable to that group will apply.
Regarding personal data that occurs and is processed on social media, such as Facebook, Instagram, X, YouTube and LinkedIn, we refer users to the policies provided by the respective service providers for information on how each service provider processes personal data. In the Company’s view, the purpose of the processing is that representatives of existing and potential customers and partners shall be able to interact and maintain contact with the Company via social media, to contribute to good relationships and to make the Company’s customer service and product widely accessible through several different channels. The processing is necessary for the purposes of the Company’s legitimate interest to market its brand and products to existing and potential customers and to partners.
You should always feel safe when you provide us with your personal data. Therefore, the Company has implemented necessary security measures to protect your personal data against unauthorized access, alteration, and destruction. The Company will not disclose your personal data, other than as expressly provided by this Privacy Policy.
Cookies are small files stored on your device that allow websites to recognise your device, remember your preferences, and collect information about how you use the site. Some cookies are essential for the website to function; others are optional and used for analytics or marketing.
Cookie lifetimes vary depending on type and purpose. Strictly necessary cookies are typically session-based or retained for up to 12 months. Where analytics cookies are enabled (based on consent), analytics identifiers and related usage data are typically retained for up to 24 months (or another period shown in our cookie settings), after which they are deleted or anonymized.
The Company uses cookie-like techniques on the Company’s website to allow customers to save their login information and to the extent necessary for the website’s functionality. The information is stored in the form of a file comprising session data.
Cookies are used to store or access information stored on your device, such as your computer or mobile phone. Cookies can remember what you do on a website. Some cookies are necessary for the website to function, e.g. language settings or login details.
Personal data may be collected when you use our website, and information about your use and which pages are visited may be stored. This may include technical information about your device and internet connection, such as operating system, browser version, IP address, cookies, and unique identifiers.
We use strictly necessary cookies to enable core website functionality (e.g. security, load balancing, and saving your preferences). Where we use analytics or marketing cookies, these are set only after you have provided consent via our cookie banner/settings, and you can withdraw or change your consent at any time.
To use the website fully, you must accept cookies, which you do via your browser settings. If you do not want to accept cookies, you can disable cookies via your browser security settings. However, this means that the website (https://lobe-insights.com) will not function as intended.
You can read more about cookies on the Swedish Post and Telecom Authority’s website: https://pts.se/internet-och-telefoni/kakor-cookies/#vad-används-kakor-till?
If you do not share your personal data with the Company, the Company will not be able to fulfil its legal or contractual obligations towards you. For shareholders, this means you will not be able to exercise your rights as a shareholder, including attending and voting at general meetings.
As the data controller, the Company is responsible for ensuring that your personal data is processed in accordance with applicable legislation.
The Company will, at your request or on its own initiative, rectify, erase, or complete any information found to be inaccurate, incomplete, or misleading.
We will respond to your request without undue delay and in any event within one month of receiving it. If necessary, this period may be extended by two further months depending on the complexity and number of requests.
You have the right to request access to, and rectification or erasure of, your personal data, to request restriction of processing, and to object to processing, as permitted by applicable data protection legislation. The Company will notify each recipient to whom personal data has been disclosed regarding rectifications or erasures as well as restriction of processing.
If you have registered your personality profile (for example when you took a personality test), you can end your membership at any time by having your profile erased by us. You do this by contacting us and requesting that we erase all personal data we have collected about you, including your personality profile. When your profile is erased, your profile and all information in our systems will be removed.
Under certain conditions, you have the right to data portability, i.e. the right to receive your personal data in a structured, commonly used, and machine-readable format and the right to transmit those data to another controller.
If you do not want the Company to process your personal data for direct marketing purposes, you have the right to object to such processing at any time. When the Company has received your objection, the Company will cease the processing of your personal data for such marketing purposes.
In general, you have the right to obtain a copy (a register extract) of the personal data we process about you, free of charge. However, where requests are manifestly unfounded or excessive (in particular because of their repetitive character), we may either charge a reasonable fee (considering the administrative costs of providing the information) or refuse to act on the request.
We welcome you to contact us if you have complaints regarding the Company’s processing of your personal data, so we can correct our processing if necessary. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) regarding the Company’s processing of your personal data.
The Company does not retain personal data longer than necessary in relation to the purposes of the processing, in accordance with Article 5(1)(e) (the storage limitation principle). When the purposes of a specific processing activity have been fulfilled, the Company’s main rule is that the data in question is anonymized or erased as part of our regular retention review routine. The Company also automatically deletes personal data after a certain period.
Your account will be retained while it is active. For the purposes of this Policy, 'activity' means logging in, taking a test, updating your profile, or otherwise using the service in a way that updates your account.
You own the data registered in your profile and decide whether you want to be erased, in whole or in part.
If you have not updated your personality profile or used the Company’s services during a period of five (5) years, your account will be automatically deleted. We will notify you before this deadline to give you the opportunity to reactivate your account if you wish to remain registered.
If you contact us and request that your data be erased, we will do so unless we are legally required to retain the information.
We reserve the right to delete user accounts, including the personality profile, if we see that the account is misused in any way, if the account is created for purposes other than those offered by the service, or if the user has otherwise behaved improperly. Each user may only hold one account, which is tied to a verified LinkedIn identity. Creating multiple accounts is grounds for account termination.
For business-to-business marketing and relationship management, we typically retain contact data for up to 24 months after the last meaningful interaction with you (e.g. a meeting, call, or email exchange). We periodically review and delete or anonymize inactive records.
If you opt out of marketing communications, we may retain limited information (e.g. your email address) in a suppression list for up to 3 years to honour your opt-out and avoid contacting you again unintentionally.
We continuously update this database, meaning we work to maintain an up-to-date and accurate database with current and correct contacts. This takes place through contact with you by phone, email, and in personal meetings, but also through monitoring external information sources. If you do not want to be included in our system as a potential customer, you can either inform us or unsubscribe from mailings and further contact. To avoid contacting you after your unsubscribe request, we must still store either your name or email address in a so-called suppression list. If you request to be completely forgotten, there is a risk that we may find your contact details again and contact you anew.
If you, as a representative of a company, have ordered a service from us and your name has been used as the reference for the assignment, we will retain your personal data for seven (7) years to comply with the retention period for accounting records under the Swedish Accounting Act (Bokföringslagen). If we have ordered a service or product from you, we will retain any customer data in invoices and supporting documentation for seven (7) years to comply with the same retention period.
If a customer contract expires, we must, under Swedish law still process certain information relating to the ordering party for an additional seven (7) years after the service has been performed, based on a legal obligation due to statutory accounting retention requirements.
We typically retain recruitment-related personal data for up to 24 months after the position has been filled or the recruitment process has closed (counted from the date the position is filled/closed). Please note that exact periods may vary depending on the circumstances and applicable law. This period allows us to handle follow-up questions and to document that the process was conducted fairly. If you give consent to a longer retention period (e.g. to be considered for future roles), we will retain your data for the period agreed. If we need to retain data to establish, exercise, or defend a legal claim, we may do so for the duration of the relevant proceedings.
We process personal data throughout your employment. When your employment ends, a large part of your personal data will be automatically deleted. Please note that after your employment ends, we will continue to process certain personal data (the parts needed for accounting) under Swedish law for a further seven (7) years, on the legal basis of legal obligation.
Please note the following:
Your personal data may also be disclosed where required by law.
You do not have a right to be erased during your employment, nor within seven (7) years after your employment has ended, to the extent we are legally required to retain certain information (e.g. under the Swedish Accounting Act). When you end your employment, personal data that is no longer needed will be erased; other data will be retained and automatically erased once applicable retention periods have elapsed.
Share register data is retained for as long as required by Swedish company law and applicable share register regulations.
Effective date of This Privacy Policy is 2026-04-21.
We reserve the right to update this Privacy Policy at any time. Any changes will be published on our website at https://lobe-insights.com, with a clear notice of the effective date of the updated version. We will also notify customers and partners in an appropriate manner. The current version of this Privacy Policy is always available at https://lobe-insights.com.
Do not hesitate to contact the Company if you have any questions about this Privacy Policy, the processing of your personal data, or if you wish to exercise your rights under this Privacy Policy or applicable legislation.
If you would like to contact the Company regarding your personal data, you may email: privacy@lobe-insights.com
At the same address you can:
request a register extract, request rectification, or request erasure of your personal data etc.
report if you suspect that your personal data has in any way been accessed by unauthorized parties through our processing or through our third-party suppliers’ processing.
submit comments or suggestions regarding our Privacy Policy.
ask questions about our processing of your personal data.
We also accept telephone calls at 0736 89 53 09.
If you prefer to contact us by post:
Universal Measures Aktiebolag
Corporate registration number: 559559-9027
Postal address: Vretgränd 4a, 753 22 Uppsala, Sweden
Email address: privacy@lobe-insights.com
Supervisory authority
If you believe that we have in any way breached our handling of your personal data, you may file a complaint with Integritetsskyddsmyndigheten (IMY), which is the supervisory authority for personal data processing and data protection.
Contact details:
Telephone: 08-657 61 00
Email: imy@imy.se
Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm
More information: https://www.imy.se