Privacy notice

Last updated 14 August 2026

Who is responsible

The controller is Steven Partridge, trading as Janovis.

Schönenbuchstrasse 94, 4123 Allschwil, Switzerland.

Enquiries and data requests: contact@itxf.com

Which law applies

This site is subject to both the Swiss Federal Act on Data Protection and the General Data Protection Regulation.

What is collected

There is no free-text column anywhere in the database for respondent input. This is enforced by the schema rather than by policy.

When you ask for the full breakdown, a notification is sent to the site owner. It contains your name and email address, your organisation and role where you gave them, your overall stage and score, the dimension identified as your priority, and the time you finished. It does not contain your individual answers.

Consent

Three separate consents are recorded, never bundled together. Each is stored with a timestamp and the exact wording you were shown.

  1. Consent to process your answers to produce your result. Without this the assessment cannot run.
  2. Consent to retain your result so it can be compared with a later assessment. Optional.
  3. Consent to marketing contact. Separate, unticked by default, and confirmed by a second email before anything is sent.

Sub-processors

The list is deliberately short.

International transfers

Vercel is certified under the EU-U.S. Data Privacy Framework. Vercel's documentation states that this certification covers transfers from Switzerland under the Federal Act on Data Protection as well as from the EU and the UK. That is the transfer mechanism relied on, and it is named here rather than left implied.

Vercel Inc. and Supabase Inc. are both incorporated in the United States. Data residency in Europe does not remove the reach of United States law over the control plane, environment variables, build logs and support access.

How long it is kept

Your name, email address, organisation and role are purged 24 months after your last activity. Answers and scores are kept beyond that in a form that is no longer linked to you, for research aggregation.

Two records are kept beyond your assessment, and they are listed here rather than left out. One is a counter that limits how often a request can be made from a single internet connection: it holds a keyed hash of that connection's address and never the address itself, and it is deleted once it has been unused long enough to have no effect on anybody, which is at most a day and usually minutes. The other is a log of when a purge ran and how many rows it removed, which is kept without a time limit and describes no person. Neither holds a name, an email address or an answer.

Cookies

One strictly necessary first-party cookie holds your session together so a dropped assessment can be resumed. It lasts seven days and is then deleted. It is not used for advertising or profiling, and it does not follow you to other sites.

Analytics

Analytics are not currently enabled on this site.

Your rights

You may ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted.

Where an assessment runs on your consent, you may withdraw that consent. Withdrawing is as easy as giving it: write to the address below and say so. Withdrawing stops any further use of your answers. It does not undo processing already carried out while the consent stood.

Write to the address below, say what you would like done, and include the email address you used here. Some of what is held is stored as a keyed hash of that address so that it cannot be searched by name, which means the address is the only thing that finds it. Requests are actioned by hand and answered by a person.

contact@itxf.com