Privacy Policy

1. Who we are and what this policy covers

Dean Malpass Consulting Limited is the data controller for personal data collected through the PULSE and COMPASS diagnostic tools. This privacy policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.

We are registered with the Information Commissioner's Office (ICO) as required under UK data protection law.

2. What personal data we collect

When you use PULSE or COMPASS, we may collect the following personal data:

Data	When collected
Full name	When you create an account
Email address	When you pay or create an account
Organisation name	When you define your assessment scope
Your role or job title	When you complete the assessment scoping step
Assessment responses	Your answers to the 25 or 42 diagnostic questions
Dimension scores and reports	Generated from your assessment responses
Payment information	Processed by Stripe — we do not store card details
IP address	Automatically collected for security and rate limiting purposes

3. How we use your personal data

We use your personal data for the following purposes:

• To deliver the service: processing your assessment, generating your report, and storing your results so you can access them in future sessions
• To manage your account: creating and maintaining your account, authenticating you when you sign in
• To process payment: verifying that payment has been made before generating your report
• To improve our services: understanding how our diagnostic tools are used so we can improve them
• To communicate with you: responding to support requests or queries you send us
• To comply with legal obligations: maintaining records as required by law

4. Our lawful basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract: processing necessary to deliver the service you have purchased
• Legitimate interests: improving our services, maintaining security, and preventing fraud
• Legal obligation: maintaining records required by UK law

5. Who we share your data with

We do not sell your personal data. We share data only with the following third parties who help us deliver our services:

• Supabase: database and authentication provider. Your account data and assessment results are stored on Supabase's infrastructure. Supabase is hosted in the EU.
• Stripe: payment processing. Stripe handles your payment securely. We receive confirmation of payment but do not receive or store your card details.
• Anthropic: AI report generation. Your assessment scores and role information are sent to Anthropic's API to generate your personalised report. We do not send your name or email address to Anthropic.
• Netlify: website hosting. Our tools are hosted on Netlify's infrastructure.

All third-party providers are contractually required to handle your data securely and in accordance with applicable data protection law.

6. How long we keep your data

We retain your account data and assessment results for as long as you maintain an active account with us. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Payment records are retained for seven years as required by UK tax law.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can ask us to correct inaccurate data
• Right to erasure: you can ask us to delete your personal data in certain circumstances
• Right to restriction: you can ask us to restrict how we use your data
• Right to data portability: you can ask for your data in a machine-readable format
• Right to object: you can object to processing based on legitimate interests

To exercise any of these rights, please contact us at Dean@DeanMalpass.co.uk. We will respond within one month.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

8. Cookies and tracking

Our diagnostic tools use essential cookies and browser storage to maintain your session and save your assessment progress. We do not use advertising cookies or track you across other websites.

9. Security

We take the security of your personal data seriously. We use industry-standard measures including encrypted connections (HTTPS), secure authentication via Supabase, and server-side API key management to protect your data.

Assessment responses are transmitted securely and stored in an encrypted database with row-level security policies that ensure only you can access your own data.

10. Confidentiality of your assessment data

Your assessment responses, dimension scores, and AI-generated reports are confidential. Only you can access your results through your secure account. No other user of our services can view your data.

As the data controller, Dean Malpass Consulting Limited has administrative access to assessment data stored in our database. This access exists solely for the purpose of maintaining and improving the service, resolving technical issues, and fulfilling our legal obligations as a data controller.

We will never:

• Share your assessment responses or reports with any third party without your explicit consent
• Use your assessment data to identify or make judgements about your organisation to others
• Use your data for marketing or commercial purposes beyond delivering the service you have purchased
• Sell your data to any party under any circumstances

If you have concerns about the confidentiality of your data, please contact us at Dean@DeanMalpass.co.uk.

11. International data transfers

Some of our third-party providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK data protection law, including standard contractual clauses where required.

12. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by email. The date at the top of this page shows when the policy was last updated.

13. Contact us

If you have any questions about this privacy policy or how we handle your personal data, please contact us at Dean@DeanMalpass.co.uk.