Privacy notice
Last updated 14 August 2026
Who is responsible
The controller is Steven Partridge, trading as Janovis.
Schönenbuchstrasse 94, 4123 Allschwil, Switzerland.
Enquiries and data requests: contact@itxf.com
Which law applies
This site is subject to both the Swiss Federal Act on Data Protection and the General Data Protection Regulation.
What is collected
- Your answers to the diagnostic, stored as integers. There is no free-text field for anything you type about your organisation.
- If you ask for the full breakdown: your first name, last name, email address, and optionally your organisation and role.
- Technical information needed to run the assessment: the source you arrived from, a country code, and timestamps.
There is no free-text column anywhere in the database for respondent input. This is enforced by the schema rather than by policy.
When you ask for the full breakdown, a notification is sent to the site owner. It contains your name and email address, your organisation and role where you gave them, your overall stage and score, the dimension identified as your priority, and the time you finished. It does not contain your individual answers.
Consent
One consent is recorded, and it is the only basis this assessment runs on. It is stored with a timestamp and the exact wording you were shown.
Consent to process your answers to produce your result, and for Steven Partridge to see that result. Where your code belongs to a group assessment, it also covers your answers being combined with other people's into a report that names nobody, for the person who commissioned it. Without this the assessment cannot run.
Sub-processors
The list is deliberately short.
- Vercel: application hosting, compute in Frankfurt.
- Supabase: database hosting, data at rest in Zurich.
- Scaleway: transactional email delivery.
International transfers
Vercel is certified under the EU-U.S. Data Privacy Framework. Vercel's documentation states that this certification covers transfers from Switzerland under the Federal Act on Data Protection as well as from the EU and the UK. That is the transfer mechanism relied on, and it is named here rather than left implied.
Vercel Inc. and Supabase Inc. are both incorporated in the United States. Data residency in Europe does not remove the reach of United States law over the control plane, environment variables, build logs and support access.
How long it is kept
Personal details are purged 24 months after your last activity. Answers and scores are retained beyond that in a form that is no longer linked to you, for research aggregation.
Cookies
One strictly necessary first-party cookie holds your session together so a dropped assessment can be resumed. It lasts seven days and is then deleted. It is not used for advertising or profiling, and it does not follow you to other sites.
Analytics
Analytics are not currently enabled on this site.
Your rights
You may ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted.
Where an assessment runs on your consent, you may withdraw that consent. Withdrawing is as easy as giving it: write to the address below and say so. Withdrawing stops any further use of your answers. It does not undo processing already carried out while the consent stood.
Write to the address below and say what you would like done. Requests are actioned by hand and answered by a person.