Privacy Policy

1. Who is responsible for your data

The data controller for personal data collected through this assessment is [Neuro Group legal entity], registered at [registered office address](“Neuro Group”, “we”, “us”).

If your organisation commissioned the workshop you are taking this assessment as part of, your employer is a joint controller for the aggregate, anonymised results of your cohort. Individual results (your personal scores linked to your email) are controlled only by Neuro Group.

2. What we collect

We collect the following personal data when you complete the assessment:

• Email address — you provide it before submitting (required).
• Display name — you provide it before submitting (optional).
• Workshop passcode — supplied by your facilitator.
• 25 primary assessment responses (0–4 each).
• 10 sense-check responses (0–2 each).
• Timestamps (start and completion).
• Consent timestamp — automatic when you tick the consent box.

We do not use tracking cookies, collect IP addresses for analytics, or profile you beyond the five negotiation-style scores that the assessment produces.

3. Why we collect it

• To generate and display your personal result page.
• To email your result to you and give you a durable link to revisit it.
• To provide your workshop facilitator with aggregate cohort analytics (e.g. average scores for the group) so they can tailor the workshop.
• To retain anonymisedcohort scores as part of Neuro Group's longer-term organisational-level dataset for the client organisation.

4. Our lawful basis

We rely on your consent (UK/EU GDPR Article 6(1)(a)) to collect and process your email, display name, and assessment responses. Consent is captured via the explicit checkbox shown next to the email field before you submit the assessment; the time of consent is recorded in our database.

You can withdraw your consent at any time — see “Your rights”. Withdrawing consent does not affect processing that took place before you withdrew it.

We rely on our legitimate interests (Article 6(1)(f)) to retain anonymised cohort scores after the retention window closes, so our client organisations can see how their cohorts evolve over time. Once anonymised, these records no longer identify you and fall outside GDPR.

5. Who sees your data

• Your workshop facilitator — a Neuro Group consultant running your cohort. They can see your email, name, completion status, and individual scores.
• Neuro Group staff with a need to administer the platform, on a least-privilege basis.
• Our sub-processors, listed below, who host or transmit the data strictly on our instructions.

Your individual responses are not shared with your employer. Your employer receives only anonymised cohort aggregates. We do not sell your personal data, ever.

6. Sub-processors

We use the following data processors, each bound by a data processing agreement under GDPR Article 28:

• Supabase — database and authentication hosting (EU region).
• Vercel — application hosting and Cron execution (EU functions).
• Resend — transactional email delivery (EU/US).

7. How long we keep it

By default we retain your personal data (email, display name, and the link token that lets you re-open your results page) for 24 months from the date you complete the assessment. Your facilitator may set a shorter retention period for your cohort.

• Your email address, display name, and results-page link are permanently deleted.
• Your individual results page will no longer be accessible.
• Your response scores are retained in anonymised form — they are no longer linked to you personally, and contribute only to cohort-level and organisation-level statistics.

Deletion happens automatically through a nightly scheduled job. You can also request earlier deletion at any time.

8. Your rights

• Access, rectification, erasure, restriction, portability, and objection to processing.
• Withdraw consent at any time, with no effect on earlier processing.
• Not be subject to solely automated decisions with legal or similarly significant effects — we do not make any such decisions.
• Email privacy@neuro.group to exercise any right. We will respond within one month.

9. Cookies & tracking

The participant-facing assessment does not set any analytics, marketing, or tracking cookies. A short-lived session cookie preserves your progress through the questions on the same device — it is cleared when you complete the assessment. The facilitator area uses an authentication cookie required to keep facilitators signed in.

10. Contact & complaints

For any privacy question, request, or complaint, contact privacy@neuro.group. If you are not satisfied with our response, you can lodge a complaint with the ICO (ico.org.uk) or your local EU data protection authority.