What you are signing off on.

The table is the answer. The documents under it are the evidence.

What we collect

Answers, the role a person answers in, and their account details. A few questions take a short written remark. We buy nothing in and infer nothing from elsewhere.

Our role

Processor. The organization running the scan is the controller. A person buying their own scan contracts with us directly.

Where it sits

The EU. We lock the database to the EU and switch off copying to other regions. What we store stays in the EU.

Sub-processors

Cloudflare, who host the service, store its data and send its email. Nobody else. We do not sell data and we do not share it for advertising.

Retention

We delete unfinished drafts 48 hours after they start. After 24 months without activity we ask whether to keep the account or close it. Silence closes it. We delete on request at any point.

Who sees what

Employee results combine answers from at least five people. Employee results can combine three or four answers in scans of up to 20 people. Leaders' and managers' answers can show even when only one person answered.

Automated decisions

None. We fixed the scoring before anyone answered. Your scores come from fixed rules, not from an AI model or anyone's judgement. We store answers encrypted; a database query returns ciphertext.

The one exception

Your organization can choose to include leaders' written answers. Each quote carries the leader's role, and colleagues will know it is theirs.

The documents

• The participant privacy noticeWhat we show everyone answering. Live, and the one this table summarises.Open →
• Data-processing agreementSent with the quote.On request
• Security summaryEncryption at rest, the EU lock, the release test on the hiding rule.On request
• Records of processing, our sideArticle 30 register for the scan.On request