Testerup Privacy Policy
Effective from 2 October 2026
This Privacy Policy explains how Aestimium GmbH registered at Rödingsmarkt 39, 20459 Hamburg, Germany (“we”, “us”, or “our”), uses and protects your personal information when you use the https://www.testerup.com task and rewards platform (the “Platform”) and the related services we offer (the “Services”).
We are committed to protecting your privacy and complying with all applicable data protection laws, including but not limited to the GDPR and U.S. federal and state data privacy laws.
1. WHAT INFORMATION WE COLLECT
We collect different types of information depending on how you use the Platform and the Services. Some of this information is provided directly by you, some is collected automatically when you access and use the Platform, and in limited cases, we receive information from others (for example, gaming partners). Below, we set out the categories of personal data we collect about you.
Data you provide directly
- Account data – your profile name, email address, password, and country (collected from your device, see Usage Data below). We use this information to create and manage your account.
- Profile data – details such as your age range, gender, and task preferences. We use this information to match you with tasks and surveys that fit your profile.
- Payout data – depending on the payout method you choose, this may include full name, payout method, IBAN, and email address. We use this information to process payouts and rewards to you.
- Verification data – we may request a facial scan to verify your identity for fraud prevention purposes before releasing payouts. We may also ask for additional information, such as receipts, bank statements, or payment confirmations to validate a purchase.
- Communication & support data – information you send through contact forms, helpdesk tickets, or other communication channels. These are used to handle your requests and maintain service quality.
Data we collect automatically
- Usage data – this includes the following types of information:
- Technical data – for example, your IP address, browser type, operating system, device identifiers, language settings, and timestamps. This helps us ensure the Platform works correctly across devices and detect suspicious or automated activity. We may also collect information about the applications installed on your device to help match you with suitable tasks.
- Usage and performance data – for example, information about how you navigate and interact with the Platform, such as page visits, response rates, or session duration. This also includes survey metadata, such as completion status, eligibility results, and time spent. We use this to e.g. troubleshoot issues, improve user experience, monitor platform performance, and calculate rewards.
Data we receive from others
In some cases, we receive limited information from trusted third parties to help us provide and maintain the Services. For example:
- Authentication partners – if you register for, or log into the Service using another service, such as Google or Apple, that service may share your Account data with us. This information helps us create your account.
- Task partners – when you are invited to a task hosted by a partner, they may share certain Usage data with us. This information helps us provide the Service to you and credit your account.
- Payout partners – if you choose to redeem a payout or reward, the Payout partner will send us a payout confirmation.
- Review platforms - if you leave a public review of our Service on a third-party review platform, we may display your name and star rating within our Platform. This helps us build trust in our Service.
California mapping table
The table below maps the categories defined under California law to the types of personal data we collect as described above.
| CCPA category of personal information | Categories or personal as described above |
| Identifiers – such as your profile name, email address, device identifiers or IP address | Account data Usage data Payout data |
| Protected classification characteristics under California or federal law – such as your age and gender | Profile data |
| Commercial information – such as your survey participation, payouts and rewards | Usage data Payout data |
| Biometric information – such as facial scans | Verification data |
| Sensitive personal information – such as biometric data | Verification data |
| Internet or other electronic network activity information – such as interactions with our Services | Usage data |
| Geolocation data – such as non-precise location derived from your IP address | Usage data |
| Other information you share | Communication & Support data |
2. HOW AND WHY WE USE YOUR INFORMATION
The table below sets out our purpose for processing your personal data, our legal basis for each purpose, and the categories of personal data we use for each purpose.
| Purpose | Why we do it / Legal basis | Categories of personal data used |
| To provide the Service to you in accordance with our contract with you. For example, create and manage your account, give you access to tasks, and calculate your rewards | To perform our contract with you | Account data Profile data Payout data Verification data Communication & Support data Usage data |
| Match you with suitable tasks and surveys | To perform our contract with you | Account data Profile data Usage data |
| Improve and develop the Platform and Services | Our legitimate interest in improving user experience | Usage data Communication & Support data |
| To diagnose, troubleshoot and fix issues with the Service | To perform our contract with you | Account data Profile data Usage data Communication & Support data |
| For marketing and advertising purposes. For example, sending you marketing updates via email | Our legitimate interest in promoting our Service Consent (where applicable) | Account data Usage data |
| Verify identity and prevent fraud or misuse on our Platform | Our legitimate interest in keeping the Platform safe Consent (where applicable) | Account data Profile data Verification data Usage data Communication & Support data |
| To process your payout | To perform our contract with you | Account data Payout data Verification data |
| Meet our legal, tax, and accounting obligations | Compliance with legal obligation | Account data Profile data Payout data Verification data Communication & Support data Usage data |
| To comply with a request from law enforcement, courts, or other competent authorities | Compliance with legal obligation Our legitimate interest in assisting law enforcement authorities to prevent or detect serious crime | Account data Profile data Payout data Verification data Communication & Support data Usage data |
| To fulfil contractual obligations with third parties. For example, providing pseudonymised information to our survey partners | Our legitimate interest in maintaining our relationships with survey partners so that we can provide the Service to you. | Account data Profile data Payout data Verification data Usage data |
| To establish, exercise, or defend legal claims | Our legitimate interest in protecting ourselves, our users or other in legal proceedings | Account data Profile data Payout data Verification data Communication & Support data Usage data |
3. WHO WE SHARE INFORMATION WITH
We share your personal data only when it’s necessary to operate the Platform, deliver the Services, or meet our legal obligations.
Your profile name may be displayed on the Platform and visible to other users if you participate in the leaderboard.
Depending on the activity, certain data may be shared with:
- Service providers – to provide and maintain the service to you. For example, operate the technical infrastructure, provide customer support, assist in protecting and securing our systems and services, and help market our product and services.
- Payout partners – to process your payout or reward, and for anti-fraud purposes
- Marketing partners - to promote our Service on other online platforms and help us and our partners to measure the effectiveness of such promotions.
- Task partners – to enable us and our partners to verify task performance and completion status.
- Group companies – we may share limited information with other companies in our group where necessary to carry out our daily business operations or to protect the safety and integrity of our platforms.
- Law enforcement and other authorities – to comply with legal obligations, respond to a valid legal process, or for our own or a third party’s justifiable interest
- Purchaser of our business – to sell or negotiate to sell our business to a buyer or potential buyer
When you choose to participate in a survey hosted by an external partner, you’re redirected to their platform. That partner determines how your responses are processed and acts as the data controller under their own privacy policy.
4. INTERNATIONAL TRANSFERS
Some of our technology partners and service providers are located outside the European Economic Area (EEA) or the United Kingdom. This means that your personal information may be transferred to and stored in countries that have different data-protection laws.
Whenever this happens, we make sure your information remains protected to the same high standard required under European data protection law. We do this by:
- Using adequacy decisions — where the European Commission (or UK government) has confirmed that the country in question provides a similar level of protection for personal data; or
- Signing Standard Contractual Clauses approved by the European Commission (and the UK Addendum where applicable), which legally oblige our partners to keep your data secure and handle it only under our instructions.
We also assess our international partners’ security practices and, where needed, apply additional technical safeguards such as encryption or access restrictions.
5. HOW LONG WE KEEP YOUR INFORMATION
We keep your information only as long as necessary to provide you with the Service and for our legitimate business purposes, such as complying with our legal obligations, resolving disputes, maintaining the performance of our Service, and making data-driven business decisions. Here are a few examples of the categories of our retention periods:
- User removal – you may request deletion of your data or remove certain information directly within the Service. Such data is retained until you choose to delete it, unless an extended retention period applies as further explained below.
- Periodical removal – some data is automatically deleted after a set period. For example, we typically remove Payout data after 7 years for tax and legal compliance purposes.
- Account removal – certain data is kept for as long as you have an account, for example your Account data and Profile data. When your account is deleted, this data is deleted or anonymised, unless an extended retention period applies as further explained below.
- Extended retention period – some data may be retained for longer where necessary to comply with legal obligations, resolve disputes, maintain platform safety and integrity, or for other legitimate business purposes.
6. YOUR RIGHTS
Under certain data protection law, you have the right to:
- Access the personal information we hold about you
- Ask us to correct inaccurate or incomplete information
- Request deletion of your information when it’s no longer needed
- Limit how we use your information, in certain cases
- Receive your information in a portable format
- Object to processing based on legitimate interests
- Withdraw your consent (for example, for marketing)
- Request to not be subject to a “sale” or a “share” under U.S state law
Please note that we do not carry out automated decision-making that produces legal or similarly significant effects (please see Section 9 for more information), and we only process sensitive personal data for purposes permitted under the CCPA. As a result, the rights to opt out of such automated decision-making and to limit the use of sensitive personal data do not apply to our processing.
We may need to verify your identity before responding. You can contact us at our contact form, and we’ll respond within the required timeframe.
You also have the right to complain to your local data-protection authority if you believe we’ve handled your data unlawfully.
7. CHILDREN’S PRIVACY
The Platform and Services are designed for adults aged 18 and over. We don’t knowingly collect or process personal information from anyone under this age.
If we learn that we’ve accidentally collected information from a minor, we’ll delete it immediately and take steps to prevent it from happening again.
If you believe a child has used the Platform or provided information without permission, please contact us at our contact form, so we can investigate and remove the data if necessary.
8. COOKIES AND TRACKING
We use cookies and similar technologies to make the Platform work properly, improve performance, and enhance your experience.
Non-essential cookies are activated only when you provide consent through the cookie banner. You can manage your cookie preferences at any time. For more details, check our Cookie Policy available on the Platform.
9. AUTOMATED DECISIONS
We do not carry out automated decision-making, i.e. decisions without human involvement, that produces legal or similar significant effects on you. However, we do use certain automated tools and systems to operate, secure, and improve the Platform. These tools analyse limited information about your profile, activity, and device to support certain functions.
For example, we use automated systems to:
- Match surveys to users – systems compare your profile data (such as age, gender, and country), and participation history with eligibility criteria provided by surveys providers to match surveys that may be relevant to you
- Detect and prevent fraud - for example, by identifying duplicate accounts, automated scripts, or unusual login patterns
- Maintain platform quality – for example, by identifying responses that appear inconsistent or technically invalid
- Ensure fairness - by helping distribute survey opportunities evenly among eligible users.
Where automated systems flag potential issues (for example suspected fraud or technical irregularities), this may lead to temporary restrictions or additional checks. Where appropriate, such situations may be reviewed internally by our team.
10. HOW WE PROTECT YOUR INFORMATION
We take the security of your personal information very seriously. We use a combination of technical and organisational measures to protect it from unauthorised access, loss, misuse, or disclosure.
These measures include encryption of data in transit and at rest, multi-factor authentication for administrative access, role-based permissions, and regular security reviews and testing of our systems. Access to personal information is limited to authorised staff and service providers who need it to operate the Platform and are bound by confidentiality obligations.
We also maintain procedures for monitoring, detecting, and responding to potential incidents. If we ever identify a data breach that could pose a high risk to your rights or freedoms, we’ll promptly notify the relevant data-protection authority and, where required, contact you directly with information on what happened and how to protect yourself.
11. UPDATES TO THIS POLICY
We may update this Privacy Policy occasionally to reflect changes in our services or legal requirements.
The most current version is always available on the Platform.
If we make major changes, we’ll let you know by email or in-app notice before they take effect.
12. CONTACT US
If you have questions about this Privacy Policy or how your information is used, you can reach us at:
our contact form,
Aestimium GmbH, Rödingsmarkt 39, 20459 Hamburg, Germany.