Privacy Policy — EnCircle Leadership & Culture Diagnostic

 
Last updated: 2nd November 2026
 
 
Who we are
 
This Privacy Policy explains how EnCircle GmbH ("EnCircle", "we", "us") collects, uses and protects personal data on encircle.be and when you use the EnCircle Leadership and Culture Diagnostic (the "Diagnostic"). You can access the Diagnostic from encircle.be. It opens separately at encircle-diagnostic.vercel.app.
Data controller: EnCircle GmbH, Kopenhagener Straße 2, 10437 Berlin, HRB 291139 B, Amtsgericht Charlottenburg.

Contact for privacy matters: isabelle@encircle.be
 
 
What data we collect
When you use the Diagnostic. We collect your responses to the reflective prompts, and which situations you chose to look at so that your reflection can be written. You can complete the Diagnostic and read your reflection on screen without giving us your name or any contact details.
 
Each time a reflection is generated, we log a basic record with no name or email: the team type you chose, whether physical safety is a significant part of the work, how many situations you responded to, and the level of attention you chose at the start. We do not store your written responses or your reflection in that record.
If you ask for your reflection by email, we collect your first name, organisation name and email address. At that point you can choose whether to share your written responses with us. If you choose to share, we store your answers (including your answers to the optional “A little more” questions, with a note of which sentences you selected as written, which you edited and which you wrote yourself) and your reflection. If you choose not to share, we store your name, organisation and email address and the basic details above, and nothing you wrote. You can also tick two optional boxes: one to say you’d like to talk to us about a full diagnostic, and one to say you are happy for us to email you about our work and services. We record whether each box is ticked. Neither is ticked unless you tick it.

 If you ask for a fresh reflection, what you change or add, and the part of your earlier reflection you are responding to, are sent to Anthropic to write the new one. We do not store this.
When you ask for your reflection by email, EnCircle also receives an email notification with your name, email address, organisation and the basic details above. If you chose to share, that email includes your responses and your reflection.

Please do not include names of other people, or sensitive personal information such as health details, in your answers
 
When you contact us through the website. If you use the contact form, we collect the name, email address, phone number (optional) and message you enter. We use them to reply to you.
Collected automatically. We do not use tracking cookies or analytics scripts within the Diagnostic. Our hosting providers may log standard technical information, such as IP address and browser type, for a short time for security and operational reasons, under their own privacy practices. Cookies on encircle.be are covered in the Cookie Policy below.


Why we process this data, and our legal basis 

Generating your reflection: your written responses. Legal basis: consent (Art. 6(1)(a) GDPR). By submitting your responses, you ask us to process them to generate a reflection.
Sending your reflection by email: name, email address and your reflection. Legal basis: consent (Art. 6(1)(a) GDPR), given when you request the email.
 
Reviewing submissions to understand patterns and improve the Diagnostic: responses you chose to share, and organisation name. Legal basis: consent where you opted in to share, and legitimate interest (Art. 6(1)(f) GDPR) in improving a free tool we offer.
 

Emailing you about EnCircle’s work and services: name, email and organisation. Legal basis: consent (Art. 6(1)(a) GDPR), given by ticking the box on the email form. We keep a record of the tick. You can withdraw consent at any time and we will stop.
 

Replying to your request to talk about a full diagnostic: name, email and organisation. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering your enquiry (Art. 6(1)(f)).

Keeping a record that your reflection was requested and sent: name, organisation, email and the basic details. Legal basis: our legitimate interest in running and supporting the Diagnostic (Art. 6(1)(f)).

How your information is processed
 
We use the following service providers to run the Diagnostic and the website. Each acts as our processor under a data processing agreement.
 
Anthropic provides the AI that writes your reflection. Your written responses are sent to Anthropic's API for this purpose, whether or not you later choose to share them with us. The reflection is labelled as written by AI, guided by EnCircle's way of seeing organisations.
 
Resend delivers email. If you choose to receive your reflection by email, your name, email address and the text of your reflection are passed to Resend. Emails are sent from an EU region (Ireland). We do not use open or click tracking in our emails. Resend also delivers the notification email to EnCircle described above.
Google Sheets, with a small Google script connected to it, is our internal record is our internal record. The basic record for each reflection is logged there. If you ask for your reflection by email, your name, organisation and email address are logged too, and your responses and reflection are logged only if you chose to share them. The Sheet is private and only EnCircle team members can open it.
Vercel hosts the Diagnostic.
 
Wix hosts encircle.be and its contact form.
 
We do not sell your data. We do not share it with any third party for their own marketing.

 
Where your data is stored

Our hosting provider (Vercel) runs the Diagnostic's application functions from a European region (Frankfurt). However, Vercel, Anthropic, Google and Resend, the processors we rely on (see "How your information is processed" above), are US-based companies. Where personal data is transferred outside the European Economic Area, we rely on the EU Standard Contractual Clauses as our safeguard, the standard, legally recognised mechanism for such transfers.
 
 
How long we keep your data
Diagnostic responses and contact details submitted via the contact form are retained for 24 months from the date of submission, after which they are deleted, unless you have an ongoing relationship with EnCircle (for example, as a client), in which case your details continue to be held under the terms that govern that relationship.
Emails we send or receive about the Diagnostic are deleted from our mailboxes on the same 24-month schedule. Our email provider keeps delivery records for a short time under its own practices.
You may request earlier deletion at any time: see "Your rights" below.
 
 
Your rights
Under the GDPR, you have the right to:

• Access the personal data we hold about you

• Correct inaccurate data

• Request deletion of your data ("right to be forgotten")

• Restrict or object to certain processing

• Receive your data in a portable format

• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal

• Lodge a complaint with a supervisory authority — in Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)

 
To exercise any of these rights, contact us at isabelle@encircle.be.
 
 
Children's privacy
The Diagnostic is intended for use by working professionals and is not directed at, nor knowingly used to collect data from, children.
 
 
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be reflected here before taking effect.