Hi Marie,
Yes, we do keep test taker's IP addresses, but we only use those for creating visualisations of where people are taking tests from - it looks nice in Google maps, basically. We don't correlate test taking proficiency to geographic areas, or anything creepy like that. If we did that we may find that British test takers do badly across most of the test languages, and we wouldn't want that kind of exposure :)
We keep test taker's responses to items, but they are anonymised. They are detached from the IP addresses and we don't associate any of the optional questionnaire data with the test responses. The responses are literally just used for research purposes during item response analysis.
We don't have a policy statement online and we should have. Conversations like this are helping to formulate that and it will happen.
Cheers,
Adrian.