Privacy Policy

For our website, sales, support, events, security, administration, and communications, Untangle Lab is normally the controller of your personal data.

For Basecamp campaigns where an organisation invites respondents, the inviting organisation is normally the controller. That organisation decides to run the campaign and determines the main purpose: understanding AI readiness, learning needs, organisational friction, and workshop priorities at group level.

Untangle Lab is normally the processor for that Basecamp campaign. We operate Basecamp, process responses, generate reports, maintain the platform, support the campaign, and help prepare aggregate insights under our agreement with the client organisation.

• Contact details, such as name, email address, phone number, organisation, role, and message content when you contact us or join a programme.
• Website and communication data, such as pages visited, form submissions, newsletter preferences, email delivery data, and basic device/browser information.
• Programme and workshop data, such as registration details, attendance, feedback, and operational notes needed to deliver our services.
• Basecamp campaign and invitation data, such as organisation, campaign name, language, unique link, invited/completed status, and campaign dates.
• Basecamp context data, such as role, seniority, function, industry, organisation type, and organisation size where configured for a campaign.
• Basecamp assessment answers about AI mindset, confidence, knowledge, behaviour, workflow reality, organisational context, and reflection prompts.
• Optional free-text responses where a Basecamp question invites you to write in your own words.
• Derived Basecamp outputs, such as persona, knowledge tier, confidence calibration, growth direction, personal report, and PDF report.
• Technical and security data, such as session IDs, signed resume cookies, timestamps, IP address, logs, admin actions, and security events.

Basecamp is not intended to ask for special-category data such as health, religion, ethnicity, political opinions, trade-union membership, sexual orientation, or biometric data. Please do not include sensitive personal information about yourself or others in free-text answers.

• Respond to enquiries and provide information about our services.
• Plan, deliver, and improve expeditions, workshops, and other client programmes.
• Send newsletters or updates where you have signed up or where we may lawfully contact you.
• Operate, secure, maintain, and improve our website and systems.
• Let Basecamp respondents complete the assessment, resume it in the same browser, and receive a personal report.
• Create privacy-safe aggregate Basecamp insights for the organisation that invited the respondent.
• Help Untangle Lab facilitators prepare workshop themes and recommendations.
• Maintain audit logs for privileged actions, exports, and support requests.
• Improve and validate Basecamp, and create de-identified aggregate benchmarks, research, education materials, and approved case-study material subject to the safeguards in this policy.

If you complete Basecamp through an employer or organisation, your organisation receives aggregate insights only.

Your organisation does not receive your individual answers, your individual scores or persona as an individual record, per-question correctness, raw free-text reflections, or your personal report unless you choose to share it yourself.

Basecamp dashboards and exports show group-level results only when the privacy threshold is met. The default threshold is N>=7 for cohort outputs, and sensitive slices may require a higher threshold. If a group or filter is too small, Basecamp shows insufficient data rather than the result.

Basecamp processes response-level personal data to save the assessment and create personal reports. Organisation-facing results are aggregated and designed not to identify respondents; underlying response-level data is only anonymous once re-identification is no longer reasonably possible.

Free-text responses require stricter treatment than multiple-choice or scale answers.

• Free-text responses are stored with additional safeguards.
• They are visible only to authorised Untangle Lab facilitators and operations staff who need access.
• They are used for theme-coding, sensemaking, quality review, support, and workshop preparation.
• Raw free text is not shown in client management dashboards.
• Raw free text is not included in client CSV exports.
• Organisation-facing materials use coded themes, counts, and carefully anonymised or synthetic examples.
• Respondent quotes are not published without explicit permission.

For website, sales, support, service delivery, security, and administration, we rely on legal bases such as contract performance, legitimate interests, consent where required, and legal obligations.

For employer-invited Basecamp campaigns, the required assessment processing should not rely primarily on employee consent, because consent in an employment or employer-invited context may not always be freely given.

The expected lawful basis for the client organisation is legitimate interests under Article 6(1)(f) GDPR, such as understanding AI readiness and training needs at organisation or team level, provided those interests are balanced against respondent rights and expectations.

Untangle Lab processes Basecamp campaign data as processor under the client organisation’s documented instructions and the data processing agreement.

The required Basecamp checkbox should therefore say "I have read and understood" rather than "I consent". Optional research, story, quote, or recognisable case-study use should be separate and not required to complete the assessment.

Untangle Lab may use Basecamp data for research, validation, benchmarks, and education only in privacy-safe forms.

• Allowed with disclosure and safeguards: de-identified and aggregated data to improve Basecamp, validate scoring patterns, develop cross-client benchmarks, and create statistical or educational material.
• Requires extra approval: naming a client in a case study, publishing client-specific results in a recognisable way, publishing a respondent quote, using a respondent story that could identify the person, or using raw free text outside facilitation and theme-coding.
• Public research and education may require stronger thresholds than the internal N>=7 dashboard threshold where the subject matter, client size, role filters, or unique response patterns could make people identifiable.

We do not sell personal data. We share data only where needed to operate our website and services, deliver client work, comply with legal obligations, or protect our systems.

Subprocessors and service providers may include hosting, email, authentication, database, analytics, object storage, error monitoring, and operational tools. For Basecamp, the intended setup is EU-first processing, including EU-region database, hosting, email sending, and storage where available.

Client campaign data is governed by the relevant data processing agreement and subprocessor commitments.

We keep personal data only for as long as needed for the purpose for which it was collected, unless a longer period is required for legal, security, accounting, or contractual reasons.

For Basecamp campaigns, active campaign and report data is retained for the campaign, programme, and any agreed re-measurement period. Identifiable respondent data is deleted or anonymised after the agreed retention period in the client agreement or data processing agreement.

Irreversibly anonymised aggregate statistics may be retained for longer where individuals and clients can no longer reasonably be identified.

Our website and Basecamp may use strictly necessary cookies to provide core functionality, remember language preferences, keep sessions secure, save assessment progress, and prevent misuse.

Analytics cookies or product analytics that are not strictly necessary are used only where permitted and explained. For respondent assessment flows, non-essential analytics should be disabled by default unless the privacy notice and cookie layer clearly explain the use and any required opt-in is obtained.

Depending on the situation, you may have the right to access, correct, delete, restrict, object to, or receive a copy of your personal data.

For employer- or organisation-invited Basecamp campaigns, requests may need to be handled by or coordinated with the client organisation as controller. Untangle Lab will provide a direct contact route and forward or support requests as required under the data processing agreement.

Once data has been irreversibly anonymised, it may no longer be possible to identify, correct, or delete a specific respondent record from the aggregate dataset.

For privacy questions or rights requests, contact us at privacy@untanglelab.com.

For Dutch and EU matters, you may also have the right to contact the Autoriteit Persoonsgegevens or another competent supervisory authority.