How Zenshin Kaishi handles employee data

Respondents are invited individually by email, naming their group and role. Accepting that invitation requires signing in — this is how the system routes each person to the right questions and counts them toward completion.

Signing in identifies a respondent to your organisation's roster. It does not identify their answers to your organisation — that is a separate guarantee, held regardless of whether someone signed in to answer. See clause 02.

Individual answers are never shown to anyone at your organisation, at any role level (owner, admin, or analyst).

This is not a display setting that could be turned off. The software has no code path that lets an org-side view trace an aggregate result back to one person's answers — identity is walled off at the point results are calculated, not merely hidden afterward, and that wall holds whether or not the respondent was signed in to answer.

By default, a result for any group is shown only once at least 5 people have answered — a smaller group is withheld entirely, never shown with a caveat attached.

A sponsoring organisation with fewer than roughly 20 people may lower this to 3, but only as an explicit, disclosed decision — never silently. Certain “about your own role” questions are held to the 5-person floor regardless of any other setting, and can never be shown individually.

A single leader's own answers — a CEO is inherently “a group of one” — can be shown as an identified response. But only after that specific person has been shown a disclosure stating their answer will be on the record, and has explicitly acknowledged it, tied to their own session.

Missing either the disclosure or the acknowledgement, the system withholds the answer. It does not default to showing it.

There are two different situations, and they behave differently:

A person invited directly into this round(clause 01's normal path) can ask, at any point, to have everything we hold about them deleted — we do it on request, no conditions. What doesn't exist yet is a lighter-weight option: withdrawing just this round's answers while keeping the account for future use. Today it's all-or-nothing.

A person who took a personal, standalone assessment earlier and separately chose to link that existing result into your organisation's aggregate did so through an explicit, revocable consent, scoped to that link alone. They can withdraw it at any time without touching their account; withdrawing stops it contributing to future recalculations.

Neither path rewrites a report already published from an earlier calculation — we say this plainly rather than implying full erasure reaches issued results.

An assessment in progress is stored against the respondent's account until they finish it; there is no automatic deletion of an incomplete round. After 24 months of no activity on an account, we write to ask whether to keep it or close it — closing (or not replying) deletes personal details and keeps answers only in a form no longer linked to anyone, for benchmarking and instrument improvement, and only where your organisation agreed to benchmarking (clause 07). A person can ask us to delete everything instead, at any point, rather than wait for that reminder.

The record of who signed your organisation's declarations in clause 07, and when, is kept as evidence the step was taken — even after that signer's other data is deleted.

An administrator must answer three questions, each recorded with the exact wording shown and a timestamp:

This page describes Zenshin Kaishi's own mechanism. It does not tell you whether your works council has a consultation right in this case, what that consultation must contain, or how to run it. That is a determination for your own works council and legal counsel.

For the full legal notice — including the legal-basis table this briefing leaves out — see the Article 13 privacy notice. Where the two differ, the published notice governs.