Information collected
Contact fields, assessment responses, technical metadata, cookies, analytics, and communications.
Legal placeholder
Privacy Notice
The production Privacy Notice must reflect the actual website, assessment, CRM, analytics, email, hosting, and workflow-scoping practices in each applicable jurisdiction.
Draft notice
Legal review required before publication.
This page is a structured placeholder, not legal advice or an approved privacy notice.
Do not publish as final
Counsel and the operational data owner must confirm the company identity, jurisdictions, data categories, vendors, retention, rights, security, and contact process.
Topics the final notice must cover
Match the website and assessment data flows.
The final notice should describe actual practices, not aspirational controls.
Purpose and legal basis
Routing, service delivery, assessment output, security, analytics, marketing, and legal obligations.
Sharing and processors
CRM, email, analytics, hosting, assessment, support, and other approved service providers.
Retention and deletion
Operational retention periods, backup handling, legal holds, and deletion process.
Individual rights
Applicable access, correction, deletion, restriction, objection, and appeal rights.
Sensitive data limits
The public site should not collect PHI, employee case data, production credentials, or confidential workflow records.
Assessment-specific disclosures
Explain what happens to responses and outputs.
The production notice and consent experience should state who receives the Scorecard, whether responses enter CRM, how long they are retained, and whether follow-up marketing occurs.
- Assessment purpose and basis
- Required versus optional fields
- Result display and email delivery
- CRM and sales routing
- Analytics and ad attribution
- Retention and deletion
- No audit or certification conclusion
- Contact route for privacy requests