Privacy Policy

The Polarity Profiler collects scenario-based point allocations and produces a personal leadership-style repertoire report, with an optional session comparison, for use in executive education.

Controller

The controller within the meaning of Art. 4(7) GDPR is
Urs Müller, Gotenstr. 21, 10829 Berlin, Germany — info@polarity-profiler.org.

Who is responsible for what. For educator and administrator accounts, for security and abuse prevention, and for the retained analysis data — anonymous counters in some tools, pseudonymous rows in others; each tool's retention section says which — we are the controller. Where an institution has contracted us to run this tool for its own programme, the institution is the controller for the identifiable data of that cohort, and we process it on the institution's behalf (Art. 28 GDPR). In practice: for a request concerning your cohort's identifiable data, please approach your educator or institution first; for anything concerning accounts, security or the retained analysis data, contact us. We assist the institution in answering requests in either case (Art. 28(3)(e) GDPR).

Data protection officer: no data protection officer is appointed. § 38 BDSG has three separate triggers and we have assessed all three: headcount (at least 20 persons constantly engaged in automated processing — this service is operated by one person), processing that requires a data protection impact assessment under Art. 35 GDPR, and commercial processing for the purpose of transfer, anonymised transfer, or market or opinion research. The last two apply regardless of headcount. Our assessment is recorded in DPIA-DETERMINATION.md and is revisited whenever the scope or purpose of processing changes — in particular if cross-session research use becomes a purpose in its own right rather than support for the individual course.

What data we process

From participants

• E-mail address — required to take part. It is used to send your PDF report, to include you in the session comparison, and to give you a withdrawal link.
• Questionnaire responses — point allocations, context answers, derived style scores.
• Optional demographics — only fields you fill in; used for aggregate analysis only.
• Submission timestamp.
• Two access tokens — one that opens your report link and one that opens your withdrawal link. They are what let those links work without a password; anyone holding a link can use it, so treat them as private.
• A record of what you were shown and what you chose — when you acknowledged this notice, and, if you answered the research question on your results page, your answer with the date and the version of the wording you saw. This is how we can demonstrate what you agreed to, which the law requires of us.

From educators and administrators

• E-mail address — for backoffice sign-in.
• Password — stored only as a bcrypt hash.
• Session data — names and codes of sessions you create.
• Passkeys — only if you add one: the public key and identifier your device created, the name you gave it, and when it was added and last used. Your fingerprint, face or device PIN never leave your device; we never see them.

Legal bases

• Running the profiler, generating the session aggregate, sending the PDF report — Art. 6(1)(f) GDPR, our legitimate interest in supporting the executive-education programme in which participants are enrolled.
• Research and cross-session benchmark use — your consent (Art. 6(1)(a)), offered on your results page once you have seen what your answers produced. It is entirely optional and separate from taking part: declining changes nothing about your report or your place in the session comparison, and you can give or withdraw it at any time from that page. The tick-box on the first page is a different thing — it confirms you have read this notice, and is not a consent to research use.
• Educator accounts — Art. 6(1)(b) GDPR.
• Security, rate-limiting and abuse prevention — Art. 6(1)(f) GDPR.

Recipients and third-country transfers

We use no third parties for advertising, analytics or tracking, and we do not sell or share personal data for marketing purposes. The following providers process data on our behalf as processors under a data processing agreement pursuant to Art. 28 GDPR:

• IONOS SE (Germany) — hosting and outgoing e-mail.
• Microsoft Ireland Operations Ltd. (OneDrive) — storage of the weekly off-site backup copies. Those backups are encrypted before they leave the server, and the private key exists only on the operator's own machine — never at the provider. So Microsoft holds ciphertext it cannot read.
• healthchecks.io — monitoring that the backup run happened. Only status pings are sent ("run succeeded / failed"); no content and no participant data.

Transfers outside the EU/EEA: processing takes place in the EU; the servers and databases are in Germany. Two things are worth stating in full. Microsoft (OneDrive) provides for transfers outside the EEA under Art. 46 GDPR safeguards (EU standard contractual clauses) — what reaches it is only the backup copies, encrypted before they leave the server, whose key we do not hand over. And healthchecks.io runs infrastructure in the EU and the US, but receives only backup-run status pings: no participant data and no content.

What this means for erasure: when a record is deleted, a copy may remain inside backups until those expire: up to 14 days in the backups held on the server, and up to 30 days in the encrypted off-site copies. Backups are used only to restore the service after a failure, never for ordinary processing.

How long we keep data

• Live-session mode: your report stays available, and your response can be withdrawn, for 30 days after the session is first closed. Reopening a session does not restart that clock. Educators are warned 14 days before the deadline and can postpone it by 30 days, up to three times; participants with an e-mail address are warned 7 days before. At the deadline your e-mail address, name and session linkage are removed and your report link stops working. What happens to the answers themselves depends on the research choice on your results page: if you consented, the pseudonymised answers, scores and demographics are kept for aggregate analysis and research, and the deletion link from your confirmation e-mail keeps working against them (see below); if you did not, the entire response — answers, scores and demographics — is deleted at that deadline. Not choosing counts as not consenting.
• Self-guided mode: the same 30-day window, counted from submission. Educators are warned 14 days before and participants with an e-mail address 7 days before; because deadlines are individual rather than session-wide, they cannot be postponed.
• Responses anonymised before 1 August 2026: the research choice above only became reachable on 31 July 2026 — before that the control existed but nothing in the interface called it, so nobody could give or decline it. Responses already anonymised at that point were kept in pseudonymised form under the older rule and are not retrospectively deleted. They carry no e-mail address, name, withdrawal token or session link. If you took part before that date and want yours removed, write to us and we will delete the whole set for the period you name.
• Educator accounts: retained until deleted by the administrator.

Who can see your data

• Educators see a completion list for their session (e-mail address and submission time). They do not see individual scores. Session averages, and averages for a demographic group, are shown to them only over at least five people; a group with fewer is neither averaged nor counted.
• The administrator has technical access for maintenance and security only, and sees pooled averages across all sessions under the same five-person rule.

Data security

• The server is located in Germany.
• All transmission is encrypted using HTTPS/TLS.
• Passwords are stored only as bcrypt hashes, never in plain text.
• Session cookies are signed and HTTP-only.
• Web fonts are served from our own server — no third-party CDNs, so no data flows to third parties when fonts load.
• IP addresses processed for rate-limiting are held in memory only and never written to the database.

Server log files

Our web server records standard access log entries: IP address, date and time, the resource requested, HTTP status, referrer and browser identifier. These logs are used solely to operate and secure the service, are not combined with other data, are not used to identify individuals or build profiles, and are rotated and deleted after 14 days. IP addresses processed for rate-limiting are held in memory only and never written to the database.

Administrative audit trail. If you use an educator account, we record security-relevant actions — successful and failed sign-ins, password changes and resets, creating, changing and deleting accounts, and deleting or anonymising session data — each with the time, the account's e-mail address and the IP address. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in being able to reconstruct unauthorised access to an account. These entries are deleted after 12 months. Participants are not affected.

Your rights

You have the following rights:

• Access (Art. 15 GDPR) — what data we hold about you.
• Rectification (Art. 16 GDPR) — correction of inaccurate data.
• Erasure (Art. 17 GDPR) — deletion of your personal data.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — your data in a structured, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future, as easily as it was given.

Response time. We aim to respond to enquiries promptly. Requests concerning your personal data are answered within the period required by Art. 12(3) GDPR (one month at the latest).

Erasure and withdrawal on this tool

You can delete your own response. Your confirmation e-mail carries a personal deletion link. Opening it shows what would be removed and asks you to type a word to confirm; nothing happens until you do. Your report link is only a report link — it cannot delete anything, so forwarding it is safe.

If you no longer have your deletion link, ask for a new one at /withdrawal-link with the session code and the e-mail address you took part with. We send it to that address and nowhere else, and we answer the same way whether or not we hold it, so the page cannot be used to find out who took part. The new link replaces any earlier one, which stops working at that moment. We keep only a one-way fingerprint of these links, never the link itself, so a copy of our database gives nobody the power to delete your data — which is also why we cannot re-send the one you had.

The link keeps working after the anonymisation deadline if you agreed to research use, because the pseudonymous record kept for research carries the same fingerprint; it deletes that record too. If you did not agree, your response is deleted outright at the deadline and there is nothing left to withdraw.

Whether you must provide data

Providing data is neither a statutory nor a contractual requirement, but an e-mail address is technically required to start the profiler — without it a response cannot be recorded. The demographic questions are genuinely optional.

Supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for our location is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
www.datenschutz-berlin.de

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Diese Datenschutzerklärung ist auch auf Deutsch verfügbar.