Privacy Policy — EnCircle Leadership & Culture Diagnostic
[PLACEHOLDER — finalise before publishing] This document contains placeholder legal entity details, marked clearly below, pending completion of EnCircle's GmbH registration. Do not publish this page until every bracketed placeholder has been replaced with confirmed legal details. Once the GmbH is registered, replace the placeholders and remove this notice.
 
Last updated: [DATE]
 
 
Who we are
This Privacy Policy explains how [EnCircle GmbH — entity name to be confirmed] ("EnCircle", "we", "us") collects, uses, and protects personal data when you use the EnCircle Leadership and Culture Diagnostic (the "Diagnostic"), available at diagnostic.encircle.be and embedded within encircle.be.
 
Data controller: [EnCircle GmbH — full legal name] Kopenhagener Str. 2, 10437 Berlin [Commercial register number, e.g. HRB XXXXX, Amtsgericht Berlin] [VAT number, if applicable]
 
Contact for privacy matters: isabelle@encircle.be
 
 
What data we collect
When you use the Diagnostic, we collect the following:
 
Information you provide directly. This includes your responses to the diagnostic's reflective prompts, and, if you choose to receive your reflection, your first name, organisation name, and email address.
 
Information collected automatically. We do not use tracking cookies or analytics scripts within the Diagnostic itself. Standard technical information (such as IP address and browser type) may be logged temporarily by our hosting provider for security and operational purposes, in line with their own privacy practices.
 
You are not required to provide your name, organisation, or email to complete the Diagnostic and read your reflection on screen. These details are only requested if you choose to receive a copy by email.
 
 
Why we process this data, and our legal basis [needs to be checked]
Purpose
Data used
Legal basis (GDPR Art. 6)
Generating your personalised reflection
Your written responses
Consent (Art. 6(1)(a)) — by submitting your responses, you ask us to process them to generate a reflection
Sending you your reflection by email
Name, email, your responses
Consent (Art. 6(1)(a)) — given when you submit the contact form
Internal review of submissions, to understand patterns and improve the Diagnostic
Your responses, organisation name
Legitimate interest (Art. 6(1)(f)) — improving a free tool we offer, and identifying potential client conversations
Following up with you about EnCircle's services, if you've indicated interest
Name, email, organisation
Legitimate interest (Art. 6(1)(f)) / Consent, depending on how contact is made
 
We do not use your responses for automated decision-making or profiling that produces legal or similarly significant effects.
 
 
How your information is processed
To generate your reflection and deliver it to you, we use the following third-party processors, each acting under a data processing agreement:
 
Anthropic (the AI provider powering the reflection). Your written responses are sent to Anthropic's API to generate your personalised reflection text. Anthropic processes this data as our processor and does not use it to train its models. [Confirm current Anthropic API data retention and training terms before publishing — terms may have changed.]
 
Resend (email delivery). If you choose to receive your reflection by email, your name and email address are passed to Resend to send that email.
 
Google Sheets (internal record-keeping). Your name, organisation, email, and the content of your responses are logged to a private Google Sheet accessible only to EnCircle team members, so we can review submissions and, where appropriate, follow up.
 
We do not sell your data, and we do not share it with any third party for their own marketing purposes.
 
 
Where your data is stored
Our hosting provider (Vercel) runs the Diagnostic's application functions from a European region (Frankfurt). However, Vercel, Anthropic, and Resend, the processors we rely on (see "How your information is processed" above), are US-based companies. Where personal data is transferred outside the European Economic Area, we rely on the EU Standard Contractual Clauses as our safeguard, the standard, legally recognised mechanism for such transfers.
 
 
How long we keep your data
Diagnostic responses and contact details submitted via the contact form are retained for 24 months from the date of submission, after which they are deleted, unless you have an ongoing relationship with EnCircle (for example, as a client), in which case your details continue to be held under the terms that govern that relationship.
 
You may request earlier deletion at any time — see "Your rights" below.
 
 
Your rights
Under the GDPR, you have the right to:
 

• Access the personal data we hold about you

• Correct inaccurate data

• Request deletion of your data ("right to be forgotten")

• Restrict or object to certain processing

• Receive your data in a portable format

• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal

• Lodge a complaint with a supervisory authority — in Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)

 
To exercise any of these rights, contact us at isabelle@encircle.be.
 
 
Children's privacy
The Diagnostic is intended for use by working professionals and is not directed at, nor knowingly used to collect data from, children.
 
 
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be reflected here before taking effect.
 
 
 
[END OF PLACEHOLDER DOCUMENT — replace all bracketed sections, confirm Anthropic's current data processing terms, confirm hosting region, and have this reviewed by a lawyer or Steuerberater familiar with German GDPR implementation (the BDSG) before publishing live.]