This Privacy Policy explains how MASTER Risk Model, operated by Yilian B.V. ("MASTER Risk", "we", "us" or "our"), collects, uses, shares, protects and retains personal data when you use masterriskmodel.com, our accounts, assessments, tools, company programmes, lead magnets, email communications, learning resources, purchases and related services.

We process personal data in accordance with applicable data-protection law, including the EU General Data Protection Regulation (GDPR) where it applies.

Yilian B.V., trading as MASTER Risk Model, is the controller for processing for which it determines the purposes and means. Responsibilities for a particular employer or university programme are addressed in the relevant programme information and contractual arrangements.

• Yilian B.V., trading as MASTER Risk Model
• Rombout Hogerbeetstraat 1, 1052 VM Amsterdam, The Netherlands
• Chamber of Commerce (KvK): 34288202
• VAT: NL 818750996B01
• Email: [email protected]

• Contact and account data, such as your name, email address, account status, verification information, communication preferences and, where relevant, your relationship to an organisation.
• Assessment and tool data, such as answers you provide, assessment version, scores, pillar results, Risk Zone, Risk Profile, goals or motivation fields, generated recommendations and Blueprint or other output information.
• Professional and profile information, such as company, role, industry, country and other profile information you provide. Optional demographic information is reviewed under our data-minimisation rules and should only be collected where there is a documented purpose.
• Organisation-programme data, such as invitations, assessment credits and assignments, organisation membership, participation or completion status, and programme-administration information.
• Lead-magnet and subscription data, such as the resource requested, source or form, campaign, consent status, consent wording or version, double opt-in status, unsubscribe status and related preference history.
• Website, attribution and cookie data, such as page visits, referral source, UTM parameters, browser or device information and similar technical information, subject to the applicable cookie choices.
• Email-service data, such as delivery, bounce, unsubscribe and spam-complaint events and, where supported and lawfully enabled, campaign interaction information
• Purchase and payment-related data, such as product, order, capture or transaction identifiers, amount, currency, transaction status and necessary billing information. Payment-card credentials are handled by the payment provider rather than stored by MASTER Risk as card data.
• Communications you send to us, including support requests, feedback and other correspondence.
• Security and administrative data needed to protect the service, investigate incidents, prevent abuse and keep important privileged or model changes traceable

Where necessary to protect public forms or account access, we may use anti-abuse and security services. We identify the actual providers and relevant data flows in our service-provider and cookie information.

• To provide a service or resource you request, including account functionality, assessments, tool results, Blueprints, downloads, purchases and support. The legal basis is generally performance of a contract or taking steps at your request before entering into a contract.
• To operate and secure MASTER Risk, authenticate users, prevent abuse, maintain proportionate technical logs, troubleshoot errors, investigate incidents and improve reliability. The legal basis is our legitimate interests in operating a secure and effective service, subject to your rights.
• To administer employer and university programmes, including invitations, credits, organisation relationships, participation status and permitted aggregate reporting. The applicable lawful basis and controller/processor responsibilities depend on the documented programme arrangement.
• To send ongoing marketing emails only where you have given the required consent or where another lawful basis is clearly permitted by applicable law. Where consent is used, you may withdraw it at any time.
• To maintain consent, suppression, unsubscribe, bounce and complaint records so that we respect your communication choices and can demonstrate relevant consent history. The legal basis may include legal obligations and our legitimate interests in responsible communications.
• To manage purchases, accounting, tax and legal obligations. The legal bases are performance of a contract and compliance with legal obligations.
• To understand website and service use through analytics or attribution where applicable cookie and data-protection rules allow this. Non-essential tracking is activated only after the required consent.
• To respond to legal claims, protect rights and prevent fraud or misuse where necessary. The legal basis is our legitimate interests and, where relevant, legal obligations.

MASTER Risk assessments and tools can generate results automatically from the answers you provide and the applicable assessment or version configuration. These outputs may include scores, Risk Zones, Risk Profiles, recommendations and personalised Blueprint content.

The core MASTER assessment uses defined scoring rules rather than a generative-AI decision to calculate its results. Its purpose is reflection, learning and development. It is not a medical, psychological or psychiatric diagnosis or a validated clinical assessment.

MASTER Risk does not use assessment outputs to make solely automated decisions with legal or similarly significant effects on individuals. Outputs must not be used as an autonomous basis for hiring, dismissal, promotion, performance-rating or comparable employment decisions.

If you take part through an employer, university or another organisation, that organisation may arrange or fund access, assign an assessment credit, and administer participation. Roles and responsibilities for personal data depend on the specific programme and agreement.

In the standard organisation and university service, your answers, individual scores, Risk Zones, Risk Profiles, recommendations and Blueprint are not disclosed to the sponsoring organisation. Programme administrators may see only the participant and administration information needed to manage invitations, credits and participation.

Organisation-level assessment reports use aggregates from at least five eligible participants. Reports, filters, comparisons and exports must also be designed to prevent identification of smaller groups or individuals.

Any future service that shares individual assessment information with a sponsoring organisation requires a separate approved product design, clear prior notice, and an appropriate legal and contractual basis. Such sharing is not part of the standard service described here.

Receiving a resource, assessment result or requested tool output is separate from subscribing to ongoing marketing communications.

Where a form offers both, the marketing choice is optional and unticked by default. You can receive the requested resource or result without agreeing to ongoing marketing.

When marketing consent is requested, we explain what communications are offered and who sends them. This is a separate, voluntary choice from receiving the assessment or resource.

Where double opt-in is used, the marketing subscription becomes active only after you confirm the subscription request.

MASTER Risk uses technologies needed to operate and secure the website and may use analytics or attribution technologies. Necessary technologies may operate where legally permitted without consent.

We do not activate non-essential tracking cookies or equivalent tracking technology before obtaining the required consent. You may refuse non-essential tracking without losing core service access and can change your choice later.

Our cookie information explains the technologies in use, their purposes, providers, and retention or lifetime. Where legally permitted, referrals and campaign parameters may be used for attribution.

We use service providers only as needed to operate the service. Depending on the services enabled, relevant categories may include:

• Hosting, cloud infrastructure and backup services;
• Transactional and marketing-email delivery services;
• Domain, content-delivery and website security services;
• Authentication, analytics and anti-abuse services, where enabled;
• Payment processors, including PayPal where used;
• Cookie-preference and consent-management services, where used;
• Professional advisers such as legal, tax or accounting advisers where reasonably necessary.

We limit the personal data shared with service providers to what is necessary for their tasks and apply the contractual safeguards required by law. We do not sell personal data to advertisers. The current provider list and data flows are maintained separately and reviewed when services change.

Some service providers may process personal data outside the European Economic Area. Any such transfer must be covered by a legally valid mechanism, such as an adequacy decision or appropriate contractual safeguards, where applicable. Information about relevant safeguards can be requested through our privacy contact.

We retain personal data only for the applicable purpose and legal requirements. Subject to deletion rights and justified exceptions, the following periods or criteria apply:

• Ordinary account and assessment information: generally no longer than 24 months following account or service closure or the defined point of account inactivity. Earlier deletion may apply upon a valid request, unless retention is required for a specific legal or contractual reason.
• Waitlist and ordinary enquiry data: generally up to 12 months after the last meaningful interaction where the person does not become a customer and there is no continuing marketing consent.
• Marketing data: while you remain subscribed, plus only the minimal suppression or consent evidence reasonably needed after withdrawal, unsubscribe, bounce or complaint.
• Security logs: normally up to 12 months, with longer retention only where an incident, investigation or legal need justifies it.
• Privileged-access and model-change evidence: generally at least 24 months where necessary for accountability; assessment version information may be retained longer where needed to explain historical results.
• Accounting and transaction records: for the period required by applicable tax and accounting law.

When information is no longer needed, it is deleted or irreversibly anonymised as appropriate. Backups operate on a finite retention cycle; if deleted information is restored from backup, deletion controls are reapplied as appropriate.

The current MASTER Risk assessment service is intended for adults aged 18 and over. We do not knowingly offer assessments to children or collect their assessment data.

We will not introduce assessment programmes for minors without separately reviewing the legal, consent, information and safeguarding requirements and approving suitable controls.

Subject to applicable law, you may have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability and objection to certain processing. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

We normally respond to privacy-rights requests within one month. Where a request is complex or numerous requests are received, the period may be extended where the GDPR permits this; if so, we will inform you within the first month.

You may also lodge a complaint with a supervisory authority. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.

To exercise your rights, contact us at [email protected]. We may need to verify your identity proportionately before completing a request.

We maintain technical and organisational safeguards appropriate to the personal data and risks involved. Measures are reviewed and improved as necessary, including access management, authentication, secure changes, incident handling and backup arrangements. No internet-based service can guarantee absolute security.

We may update this Privacy Policy when our services, providers, processing or legal obligations change. The current version will show its effective date. Where a change is material and applicable law requires additional notice or consent, we will provide it.

Questions about privacy or personal data can be sent to [email protected].

These Terms apply to the current MASTER Risk website, accounts, assessment services, Blueprints, learning resources, digital products and organisation programmes provided by Yilian B.V.

MASTER Risk is designed for education, reflection and professional or personal development. Content and tool outputs do not constitute medical, psychological, legal, financial, investment or other regulated professional advice.

MASTER Risk results reflect the information a participant provides and the version of the assessment used. They support reflection and development and are not guarantees, diagnoses or predictions. They must not be used as the sole or autonomous basis for employment decisions with significant effects on an individual.

You must provide accurate information where reasonably necessary for the service, keep account credentials secure, avoid unauthorised access or interference with the service, and not use MASTER Risk content or tools for unlawful, deceptive or abusive purposes. Use professional judgement when applying MASTER Risk ideas to real decisions.

Where an account is required, you are responsible for keeping your credentials confidential and for activity conducted through your account. Please notify us promptly if you reasonably believe your account has been compromised.

Prices, applicable assessment-credit validity, reassessment eligibility, payment terms and any cancellation or refund conditions are stated before purchase or in the relevant organisation agreement. Unused or assigned credits are managed under the terms of the offer. Nothing in these Terms limits mandatory consumer rights that cannot lawfully be excluded.

Unless otherwise stated, MASTER Risk content, frameworks, text, graphics, tools, assessments, templates, branding and related materials are owned by or licensed to Yilian B.V. You may use purchased or freely provided materials for your own personal or internal professional use, subject to any specific licence accompanying the material. You may not reproduce, republish, sell, sublicense, systematically extract, reverse engineer or commercially exploit substantial parts of MASTER Risk materials without written permission, except where applicable law allows otherwise.

You retain ownership of content you submit. You grant us the limited rights necessary to process that content to provide the requested service. If you voluntarily provide feedback or suggestions, we may use them to improve MASTER Risk without an obligation to compensate you, provided we do not identify you publicly without permission.

MASTER Risk may link to or integrate third-party services. Those services may have their own terms and privacy practices. We are not responsible for third-party services that we do not control, subject to any responsibilities we have under applicable law for the providers we select.

We may improve, modify, suspend or discontinue parts of the service. We aim to operate MASTER Risk reliably but do not guarantee uninterrupted or error-free availability.

To the maximum extent permitted by law, MASTER Risk services are provided without guarantees that a particular decision, business outcome, career outcome or other result will occur. You remain responsible for decisions you make using the information provided. Nothing in these Terms excludes or limits liability where doing so would be unlawful, including liability that cannot be excluded under applicable consumer law.

We may suspend or terminate access where reasonably necessary to protect the service, other users, our rights or comply with law, including in cases of serious misuse. You may stop using the service at any time, subject to any separate paid-service terms.

These Terms are governed by the laws of the Netherlands, without prejudice to mandatory consumer protections that may apply in your country of residence. Disputes will be submitted to the competent courts in the Netherlands unless mandatory law provides otherwise.

Questions about these Terms can be sent to [email protected].