Privacy notice
Last updated 28 September 2026
Who is responsible
The controller is Steven Partridge, trading as Janovis.
Schönenbuchstrasse 94, 4123 Allschwil, Switzerland.
Enquiries and data requests: contact@itxf.com
Which law applies
This site is subject to both the Swiss Federal Act on Data Protection and the General Data Protection Regulation.
What is collected
- Your answers to the 35 statements, stored as whole numbers from 1 to 5, and your answers to the seven questions about which areas your work has brought you into contact with, stored as yes or no.
- Technical information needed to run the assessment: timestamps.
- If you ask for an assessment code to be emailed to you: your email address. It is used to send the code and is not kept. What is kept is a keyed hash of it, so that one address cannot draw a second code within thirty days, and that is deleted after thirty days. This is not consent and there is nothing to withdraw: you asked for a code and it was sent.
- A work address is needed. Codes are not sent to free email accounts, because the assessment asks about the organisation you work in.
Nothing you write in your own words is stored. The only things you type are your code, which is checked and not kept, and, if you ask for a code, your email address, which is handled as set out above.
Consent
One consent is recorded, and it is the only basis this assessment runs on. It is stored with a timestamp and the exact wording you were shown.
Consent to process your answers to produce your result, and for Steven Partridge to see that result. Where your code belongs to a group assessment, it also covers your answers being combined with other people's into a report that names nobody, for the person who commissioned it. Without this the assessment cannot run.
Sub-processors
The list is deliberately short.
- Vercel: application hosting, compute in Frankfurt.
- Supabase: database hosting, data at rest in Zurich.
- Scaleway: transactional email delivery.
International transfers
Vercel is certified under the EU-U.S. Data Privacy Framework. Vercel's documentation states that this certification covers transfers from Switzerland under the Federal Act on Data Protection as well as from the EU and the UK. That is the transfer mechanism relied on, and it is named here rather than left implied.
Vercel Inc. and Supabase Inc. are both incorporated in the United States. Data residency in Europe does not remove the reach of United States law over the control plane, environment variables, build logs and support access.
How long it is kept
This assessment holds no name, organisation or role, and your email address only as the keyed hash described above. Your answers are linked to your code for 24 months after your last activity. After that the link is removed, and your answers are kept for research aggregation in a form that is no longer linked to you.
Two records are kept beyond your assessment, and they are listed here rather than left out. One is a counter that limits how often a request can be made from a single internet connection: it holds a keyed hash of that connection's address and never the address itself, and it is deleted within two days of its last use. The other is a log of when a purge ran and how many rows it removed, which is kept without a time limit and describes no person. Neither holds a name, an email address or an answer.
Cookies
Two strictly necessary first-party cookies are used. One holds your session together so a dropped assessment can be resumed; it lasts seven days and is then deleted. The other is set only when the executive code for a group assessment is entered: it records which assessment's report may be read, and it is deleted when the browser closes. Neither is used for advertising or profiling, and neither follows you to other sites.
Analytics
Analytics are not currently enabled on this site.
Your rights
You may ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted.
Where an assessment runs on your consent, you may withdraw that consent. Withdrawing is as easy as giving it: write to the address below and say so. Withdrawing stops any further use of your answers. It does not undo processing already carried out while the consent stood.
Write to the address below and say what you would like done. Include your code if you still have it: it finds your answers for 24 months after your last activity. If you asked for your code by email, the address you used also finds them for thirty days after the request. Its keyed hash is deleted within a day after that, and the address then finds nothing. Requests are actioned by hand and answered by a person.