Achieve X privacy notice

Who we are and who is responsible for your data

Achieve X is a leadership development app run by [Achieve CTC legal entity name], company number [number], registered at [address] ("we", "us"). This notice explains how personal information is collected and used in Achieve X, and the choices you have about it.

Who is responsible for your information depends on how you use Achieve X:

• If your organisation gives you access, your organisation decides who takes part and what its HR team can see, so it is responsible for your information as the "controller". We look after your information on its behalf, under an agreement with your organisation, and your organisation's own privacy notice also applies.
• If you signed up on your own, we are responsible for your information, and no organisation or HR team can see it.

This notice also covers the colleagues a leader invites to give 360 feedback or to complete the team survey.

If you have any questions, contact us at [privacy email].

The information we collect

We collect only what Achieve X needs to work and to improve.

• Account details: your name, email address and the language you use the app in. If your organisation invites you, HR may also add your job title, department and start date, and record whether you are a leader or work in HR.
• Invitation details: whether you have been invited, have joined or have been removed, with the dates, who invited you and when a reminder was sent.
• Organisation details: your organisation's name and the email domains its people use, so that invitations are not sent to private addresses by mistake.
• Your development activity: your self-assessment answers and results, and in Practise which activities you finish, your answers to quizzes and exercises, and your scores.
• Usage information: how many minutes a day you actively use Achieve X, and which modules, activities, team exercises and library items you open and finish, and when, so we can see how Achieve X is used and improve it. It never includes what you write.
• 360 feedback and the team survey: the names and email addresses of the colleagues a leader invites, their ratings, comments and written answers, and the organisation the survey ran under.
• Team exercises: the team needs a leader chooses to work on, and the experiments their team agrees.
• Technical information: basic details about your device and browser, and the records our systems keep to run securely. Achieve X uses only the cookies needed to keep you signed in. [Add any analytics tools, if used.]

How we use it and our lawful bases

Your information is used to run Achieve X for you and to make it better. Data protection law requires a lawful basis for each use.

We do not sell personal information or use it for marketing. Achieve X is for development, so we do not use it for decisions about anyone's pay, promotion or performance rating, and our agreements limit organisations to development use too [confirm]. We make no automated decisions with legal or similarly significant effects.

Research and validation

We use anonymised, grouped ratings to check and improve the questionnaires in Achieve X, including the team survey, the 360 statements and the self-ratings. For example, we test whether each statement measures what it is meant to, and whether results relate to outcomes over time.

If your organisation gives you access to Achieve X, we include your answers only where our agreement with your organisation allows it.

This is how we protect you:

• Before any analysis, we remove names, email addresses and anything else that could identify you, your team or your organisation.
• We use ratings only, and never your comments or written answers. [confirm]
• We report results only for groups of at least [10] people, and never for one person, team or organisation.
• We may publish findings, for example in a white paper, but only in this anonymised, grouped form.

Once information is anonymised, it no longer identifies anyone, so we may keep it after your account is closed.

If you would prefer your answers not to be included, tell us at [privacy email], and we will leave them out of future analysis. Answers that have already been anonymised and combined cannot be removed, because we can no longer tell which ones are yours.

What your organisation and its HR team can see

This section applies only if your organisation gives you access to Achieve X. If you signed up on your own, no organisation can see anything about you.

Your organisation chooses, in its agreement with us, how much its HR team can see. You are told which applies before HR can see anything about you, in your invitation, its reminder and the page where you join.

In every case, HR can see the people invited to Achieve X in your organisation, with the details listed above and whether they have joined. HR can invite, update and remove people in their own organisation only.

[Publish with the HR dashboard.] Beyond that, your organisation chooses one of two levels:

• Overview only. HR sees results combined across groups of at least [5] leaders, such as common strengths and development areas, and how much Achieve X is used. Your individual results stay with you.
• Individual results. HR also sees each leader's progress: self-assessment results, the growth plan and how much of it is done, and activity and time spent in Practise. HR sees the results of any 360 or team survey a leader ran while in the organisation at this level, in the same view the leader sees, including comments and written answers without names, and can filter, download and report on them.

Overview only applies unless your organisation's agreement says otherwise. [confirm] If your organisation changes to Individual results, you are told by email and in the app at least 14 days before the change takes effect, and HR sees your individual progress only from that date. You can choose to share what you did before then. Each 360 and team survey keeps the level that applied when its invitations were sent.

HR never sees:

• who gave which rating, comment or written answer in a 360 or team survey
• results with too few responses, which stay hidden for everyone
• surveys a leader ran before joining the organisation, or while signed up on their own
• anything about people in other organisations

Achieve CTC administrators can see the list of organisations and their people, with each person's status, so they can set up and support clients. They do not see results on these pages.

If you leave your organisation or HR removes you, your invitation link stops working and HR can no longer see your progress. You keep your own account and development history as a private user, unless you ask us to delete them. [confirm]

Anonymity in 360 feedback and the team survey

In 360 feedback, the leader sees colleagues' ratings only once at least three people have responded, and only combined. Where at least five people rated a statement, the leader also sees the lowest and highest rating given; with fewer, this is hidden, because individual answers could then be worked out. If the leader's organisation has chosen to give its HR team individual results, HR sees the same results. Nobody, including HR, can see who gave which rating, comment or written answer.

In the team survey, the team's view appears only once at least three team members besides the leader have responded. The leader sees their own answers beside the average of the others, never anyone else's individual answers, and the same rules apply to HR.

Comments and answers to open questions are shown word for word, without names, in random order. In a small group, people may still recognise how someone writes, so we suggest writing comments as you would say them to the person directly.

Everyone is told in advance who can see the results. Before a leader sends a 360 or team survey, the invite page says what HR at their organisation can see. Invited colleagues are told the same in the invitation, the reminders and on the first page of the survey.

A survey records the organisation it ran under, and what HR could see there, when the invitations go out, and this cannot be changed later. A leader who joins an organisation afterwards therefore never exposes earlier surveys to its HR team.

Once you submit your answers, they cannot be linked back to your name or email address. We use your name and email address only to send the invitation and up to two reminders, and we delete them 30 days after the survey closes.

Emails we send

• Invitations to join an organisation come from the Achieve X sending address and name the person who invited you. If you have not joined after 7 days, we send one reminder.
• 360 feedback and team survey invitations show the leader's name as the sender ("[leader] via Achieve X"). If you have not responded, we send up to two reminders: 7 days after the invitation and 2 days before the survey closes. Every one of these emails has a link to stop the reminders.
• Team experiment check-ins: when a leader records an experiment their team agreed, we email the leader 14 days later to ask how it went.
• Changes to what HR can see: if your organisation changes its level, we email you about it.

Each email says why you received it, and that you can ignore it if you were not expecting it. We do not track whether you open our emails or click their links.

Who we share information with

We use a small number of suppliers to run Achieve X. They act only on our instructions and may not use your information for their own purposes. If your organisation gives you access, they are listed as our sub-processors in our agreement with your organisation.

If your organisation gives you access, we share information with its HR team as described above. We may also share information with our professional advisers, or when the law requires it. We share it with no one else, and we never sell it.

If a supplier processes information outside the UK or the European Economic Area, we make sure it is protected by an approved safeguard, such as an adequacy decision or standard contractual clauses. [Name the safeguard for each supplier.]

How long we keep information

We keep information only as long as we need it, then delete it or make it anonymous.

Keeping information secure

We use encryption and limit access to the people who need it. [Confirm encryption in transit and at rest.] Test data is kept apart from live data.

• HR can reach only their own organisation's data. Our server checks this on every page and every action.
• Invitation links are private, work only once and expire after 14 days, and we store only a scrambled copy of them.
• Lists of people uploaded by HR are read once to check them and are not stored.
• An invited person can create an account only with the email address they were invited with.
• 360 feedback and team survey answers are held in locked tables that only our server can read.

No system is completely secure. If a breach affects your information, you and the regulator will be told where the law requires it, by us or, where it is responsible, by your organisation.

Your rights

You have the right to:

• see the information held about you and get a copy of it
• correct information that is wrong
• ask for your information to be deleted
• ask for its use to be limited, or object to a use, including research
• receive the information you gave in a format you can reuse

If your organisation gives you access, it is responsible for your information, so requests about what HR can see go to your organisation, and we help it respond. You can see your own data in the app and correct your details through HR. To stop using Achieve X through your organisation, ask HR to remove you or contact us. [confirm]

If you signed up on your own, contact us at [privacy email]. We will reply within one month.

If you gave 360 feedback or answered a team survey, your submitted answers cannot be picked out from the others, so they cannot be shown or deleted one by one.

If you are unhappy with how your information is handled, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office in the UK (ico.org.uk), to Datatilsynet in Norway (datatilsynet.no), or to the data protection authority where you live.

Children, changes and contact

Achieve X is for adults at work and is not intended for anyone under 18.

We will update this notice when Achieve X changes, for example when the HR dashboard or AI coaching is launched. We will tell you about significant changes in the app or by email. This version is dated [date].

Contact: [Achieve CTC legal entity name], [address], [privacy email].