Privacy Policy

Last updated: January 12, 2026

Data Controller

The data controller responsible for your personal data is:

Company Name: Global Work Innovation Reports

Email: insights@globalworkinnovationreports.com

Data Protection Officer: insights@globalworkinnovationreports.com

If you have any questions about how we process your personal data, please contact our Data Protection Officer at insights@globalworkinnovationreports.com.

Global Work Innovation Reports ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our assessment platform. Please read this privacy policy carefully.

1. Information We Collect

1.1 Personal Information

When you register for our service, we collect:

Email address
Company name
Company sector/industry
Company size
Password (encrypted)

1.2 Assessment Data

We collect and store your responses to assessment questions, calculated scores across five pillars (Governance, Culture, Talent, Performance, Process), and overall maturity level results.

1.3 Technical Data

We automatically collect:

IP address
Browser type and version
Device information
Pages visited and time spent
Analytics data via Vercel Analytics

1.4 Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

Contractual Necessity: Processing your account information, authentication data, and assessment results is necessary to provide our service (GDPR Article 6(1)(b))
Legitimate Interest: We process technical data and analytics for platform improvement and security (GDPR Article 6(1)(f))
Legal Obligation: We process data to comply with legal requirements, including data protection laws (GDPR Article 6(1)(c))
Consent: For any optional features or communications, we will ask for your explicit consent (GDPR Article 6(1)(a))

2. How We Use Your Information

We use the collected information to:

Create and manage your account
Process and store your assessment results
Generate personalized reports and recommendations
Provide comparative analytics (anonymized)
Improve our platform and user experience
Communicate important updates about the service
Ensure platform security and prevent fraud
Comply with legal obligations

3. Data Storage and Security

3.1 Storage

All data is securely stored on Supabase infrastructure, which uses industry-standard encryption and security measures. Passwords are hashed using bcrypt before storage.

3.2 Hosting

Our application is hosted on Vercel's secure infrastructure with automatic SSL/TLS encryption for all data in transit.

3.3 Access Control

Access to your data is restricted to authorized personnel only and requires admin approval. We implement role-based access control to ensure data protection.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share information only in the following circumstances:

Service Providers: Supabase (database), Vercel (hosting and analytics) - only to the extent necessary to provide our services
Aggregated Data: We may share anonymized, aggregated statistics for benchmarking purposes
Legal Requirements: When required by law or to protect our legal rights

5. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right to Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restriction: Request limitation of data processing
Right to Data Portability: Receive your data in a structured format
Right to Object: Object to certain types of processing
Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, please contact us using the information provided below.

6. Cookies and Tracking

We use essential cookies for authentication and session management. Vercel Analytics collects anonymized usage data. For more details, please see our Cookie Policy.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

Active Accounts: We retain your account and assessment data for as long as your account remains active
Inactive Accounts: If you don't log in for 3 years, we will send a reminder and may delete your account after 3.5 years unless you reactivate it
Assessment Data: Retained for the lifetime of your account to enable historical comparison and trend analysis
Deleted Accounts: Upon account deletion, all personal data is permanently deleted within 30 days, except where retention is legally required
Backup Systems: Data in backups is retained for 90 days and then permanently deleted
Legal Requirements: We may retain data longer if required by law or for legitimate legal purposes (e.g., disputes, investigations)

You may request account deletion at any time by contacting insights@globalworkinnovationreports.com.

8. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.

9. Children's Privacy

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Your Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority:

EU Data Protection Authorities:

Find your local authority at: https://edpb.europa.eu/about-edpb/board/members_en

However, we encourage you to contact us first at insights@globalworkinnovationreports.com so we can try to resolve your concern.

12. Exporting Your Data

Under GDPR Article 20 (Right to Data Portability), you have the right to receive your personal data in a structured, machine-readable format.

To export all your data, log in to your account and visit the export data page, or contact us at insights@globalworkinnovationreports.com. We will provide your data in JSON format within 30 days.

Export includes:

Account information
All assessment results and answers
Assessment history
Account creation and activity dates

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: insights@globalworkinnovationreports.com

Data Protection Officer: insights@globalworkinnovationreports.com

← Back to Home

Data Controller

The data controller responsible for your personal data is:

Company Name: Global Work Innovation Reports

Email: insights@globalworkinnovationreports.com

Data Protection Officer: insights@globalworkinnovationreports.com

If you have any questions about how we process your personal data, please contact our Data Protection Officer at insights@globalworkinnovationreports.com.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

Active Accounts: We retain your account and assessment data for as long as your account remains active
Inactive Accounts: If you don't log in for 3 years, we will send a reminder and may delete your account after 3.5 years unless you reactivate it
Assessment Data: Retained for the lifetime of your account to enable historical comparison and trend analysis
Deleted Accounts: Upon account deletion, all personal data is permanently deleted within 30 days, except where retention is legally required
Backup Systems: Data in backups is retained for 90 days and then permanently deleted
Legal Requirements: We may retain data longer if required by law or for legitimate legal purposes (e.g., disputes, investigations)

You may request account deletion at any time by contacting insights@globalworkinnovationreports.com.

11. Your Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority:

EU Data Protection Authorities:

Find your local authority at: https://edpb.europa.eu/about-edpb/board/members_en

However, we encourage you to contact us first at insights@globalworkinnovationreports.com so we can try to resolve your concern.

12. Exporting Your Data

Under GDPR Article 20 (Right to Data Portability), you have the right to receive your personal data in a structured, machine-readable format.

To export all your data, log in to your account and visit the export data page, or contact us at insights@globalworkinnovationreports.com. We will provide your data in JSON format within 30 days.

Export includes:

Account information
All assessment results and answers
Assessment history
Account creation and activity dates