Privacy notice

Who is responsible

The controller is Steven Partridge, trading as Janovis.

Schönenbuchstrasse 94, 4123 Allschwil, Switzerland.

Enquiries and data requests: contact@itxf.com

Which law applies

This site is subject to both the Swiss Federal Act on Data Protection and the General Data Protection Regulation.

What is collected

• Your answers to the diagnostic, stored as integers. There is no free-text field for anything you type about your organisation.
• If you ask for the full breakdown: your first name, last name, email address, and optionally your organisation and role.
• Technical information needed to run the assessment: the source you arrived from, a country code, and timestamps.

There is no free-text column anywhere in the database for respondent input. This is enforced by the schema rather than by policy.

When you ask for the full breakdown, a notification is sent to the site owner. It contains your name and email address, your organisation and role where you gave them, your overall stage and score, the factor most in need of attention, and when you finished. It never contains your individual answers.

Consent

Three separate consents are recorded, never bundled together. Each is stored with a timestamp and the exact wording you were shown.

1. Consent to process your answers to produce your result. Without this the assessment cannot run.
2. Consent to retain your result so it can be compared with a later assessment. Optional.
3. Consent to marketing contact. Separate, unticked by default, and confirmed by a second email before anything is sent.

Sub-processors

The list is deliberately short.

• Vercel: application hosting, compute in Frankfurt.
• Supabase: database hosting, data at rest in Zurich.
• Scaleway: transactional email delivery.

International transfers

Vercel is certified under the EU-U.S. Data Privacy Framework. Vercel's documentation states that this certification covers transfers from Switzerland under the Federal Act on Data Protection as well as from the EU and the UK. That is the transfer mechanism relied on, and it is named here rather than left implied.

Vercel Inc. and Supabase Inc. are both incorporated in the United States. Data residency in Europe does not remove the reach of United States law over the control plane, environment variables, build logs and support access.

How long it is kept

Personal details are purged 24 months after your last activity. Answers and scores are retained beyond that in a form that is no longer linked to you, for research aggregation.

Cookies

One strictly necessary first-party cookie holds your session together so a dropped assessment can be resumed. It is not used for advertising or profiling. Analytics, where used, are cookieless. On that basis no cookie banner is shown.

Analytics

Visitor numbers are measured with Plausible, which is hosted in the European Union and sets no cookies. It records no personal data and does not follow you to other sites, so there is nothing here that identifies you individually. This is why the cookie notice above remains a single strictly necessary cookie, and why no consent banner is shown.

Your rights

You may ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted.

Write to the address below and say what you would like done. Requests are actioned by hand and answered by a person.

contact@itxf.com