Illumetis

Privacy Policy

This is a draft prepared for review by qualified counsel and should be reviewed before publication.

Who We Are

This Privacy Policy explains how [LEGAL ENTITY NAME] (“we”, “us”, or “our”) collects, uses, and protects your personal information when you use Illumetis — The Leadership Blind Spot Diagnostic (the “diagnostic”), a free online self-assessment tool created by Andrea Slingsby.

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Australian Privacy Principles (APPs), [LEGAL ENTITY NAME] is the data controller responsible for your personal information. Our registered address is [REGISTERED ADDRESS].

What Information We Collect

We collect only the information needed to provide your diagnostic result and to send the correspondence you have agreed to receive:

your first name and last name;
your email address;
your approximate location (city, region, and country), derived from your IP address; and
your diagnostic responses, comprising your multiple-choice answers and any text you choose to enter in the optional free-text field describing the decision in front of you.

The free-text field is entirely optional. Please do not enter sensitive personal information (for example, health information or other special-category data) into it, as it is not required for the diagnostic and is not intended to hold such content.

We do not collect payment-card data, financial-account details, or special-category or health data.

How We Collect It

We collect most of this information directly from you when you complete and submit the diagnostic form. Your approximate location is derived from your IP address: when you use the diagnostic, our own server-side endpoint performs a lookup to a third-party IP-geolocation provider (currently ipapi.co) to translate your IP address into an approximate city, region, and country. We do not store your full IP address as part of your diagnostic record beyond what is necessary to perform this lookup.

Your diagnostic progress and details may also be held temporarily in your browser’s local storage on your own device so that you can resume the diagnostic; this is described in our Cookie Policy.

How We Use Your Information

We use your personal information to:

generate and send you your diagnostic result;
send occasional correspondence from Andrea Slingsby that we believe may be of interest to you;
operate, maintain, and improve the diagnostic; and
comply with our legal and regulatory obligations.

We do not sell your personal information, and we do not send unsolicited marketing (“spam”). You can unsubscribe from correspondence at any time.

Legal Bases for Processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Consent — for sending you correspondence from Andrea, and for any processing that requires consent. You may withdraw your consent at any time.
Legitimate interests — to provide the diagnostic you have requested, to derive your approximate location for context, and to operate and improve our service, where these interests are not overridden by your rights and freedoms.

Where the Australian Privacy Principles apply, we collect and handle your information for the purposes described above and consistent with the APPs.

Sharing & Third-Party Processors

We share personal information only with trusted service providers who help us operate the diagnostic, and only as needed:

an IP-geolocation provider (currently ipapi.co), to derive your approximate location;
email and hosting providers, to store leads and deliver your result and correspondence.

These providers process personal information only on our instructions and are bound by confidentiality obligations and, where applicable, a data-processing agreement. We may also disclose information where required by law or to protect our legal rights.

International Transfers

Some of our service providers may process personal information in countries outside your own, including outside the EEA, the UK, or Australia. Where personal information is transferred internationally, we take steps to ensure it is protected by appropriate safeguards, such as standard contractual clauses or an equivalent lawful transfer mechanism recognised under applicable law.

Data Retention

We retain your personal information only for as long as necessary for the purposes described in this policy, or as required to meet legal, accounting, or regulatory obligations. When it is no longer required, we securely delete or anonymise it. Information held in your browser’s local storage remains on your device until you or your browser clears it.

Your Rights

Subject to applicable law, you may have the right to:

access the personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of your information;
object to or restrict certain processing;
withdraw consent at any time, without affecting processing carried out before withdrawal;
request portability of information you provided to us, where applicable; and
lodge a complaint with a supervisory authority — in the EEA or UK, your local data-protection authority; in Australia, the Office of the Australian Information Commissioner (OAIC).

To exercise any of these rights, please contact us using the details below.

Children

The diagnostic is intended for senior executives and other professional adults. It is not directed at, or intended for use by, anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

Security

We apply technical and organisational measures designed to protect your personal information against loss, misuse, and unauthorised access, disclosure, or alteration. Further detail is set out in our Information Security Policy, which should be read together with this Privacy Policy.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will publish the updated version on this website and revise the effective date below. Where a change requires your consent, we will seek it.

Contact

If you have any questions about this policy or wish to exercise your rights, please contact:

Privacy contact: [DPO / PRIVACY CONTACT]
Email: [CONTACT EMAIL]
Postal address: [REGISTERED ADDRESS]

This policy is governed by [GOVERNING LAW / JURISDICTION].