Privacy notice

The short version

We ask for as little as we can. You control your answers: you can see them, correct them or delete them. Your answers are stored in Australia. We only publish aggregates of many firms' answers, and never before a cut holds enough comparable firms. We don't sell your answers, we don't add you to lists you didn't ask for, and nobody contacts you unless you press "I need some help".

What we collect, and why

• Your email address, only if you ask for a copy of your report. Your result opens on screen without one. If you give it, it is the only direct identifier we hold for you, and it is how you find the report again. We join it to your earlier reports only after you confirm it from the email we send. Until then it stays with that one report, and it is deleted with it.
• A retake reminder, only if you tick the box on your report. One email about ninety days after you took the check, with a fresh link to your report and a link to take the check again, so you can see what moved. It goes once, to the address you gave, after you confirm it, and you can cancel it from the report until then.
• A few facts about you and your business: country, industry, revenue band and employee band, and your level and function in the firm, so your results can be compared with firms like yours. Never your company name. Even without an email, these facts and your answers could point to you in a small market or a small team, so we treat every record as personal information.
• Your answers: which sentence you picked for each practice, and any free-text answer you chose to write. Free text is shown back to you in your report and read by us; it is never shown to anyone else and never used in benchmarks. We ask you not to name other people in a free-text answer, because someone written about there has given us nothing and has no way of knowing we hold it. If it happens anyway, tell us at contact@onestepright.com and we will remove it; we may also remove such an answer ourselves when we see one. Free text is never quoted, benchmarked or used as an example.
• How the check was answered, if you tell us. The last question asks whether you answered it yourself, with help from an AI assistant, or whether an AI assistant answered it. You can skip it. A check an assistant answered is kept out of the benchmarks for now. If that changes, this notice will say so first.
• When each step of the check happened. We note when you start a check, finish each part of it and see your result. We use the times in totals, to see where people stop. We also use them, with the order you answered in, to help judge whether a person or an AI assistant answered the check. They never hold your answers or your email. If you stop before the last step, your answers are used only in counts of how far people get, never in benchmarks.
• The first of our pages you visited, the page you started a check from, and which of our ads brought you. When you start a check, we note the first of our pages you visited, and the page you started from. If you arrived from one of our ads, we also note the ad campaign's name. Your browser holds the first page and the campaign's name in the tab until you start the check. If you are in the United Kingdom, the European Economic Area, Canada or New Zealand, those two are kept only if you agree to the tags, as the association's name is. The same applies when we cannot tell where you are. All of it is kept with your answers, and holds nothing else about you.
• A daily count of page views and tool use. Our own server counts how many times each of our pages is viewed each day. It also counts how often each calculator, download, two-minute test, picker and quiz is used. For the tests, the picker and the quiz, it counts how often each verdict, choice or result comes up. Nothing typed into a calculator is sent. Each count is a name, a day and a number. The counts use no cookie, keep no IP address and hold nothing that could identify a visitor. No one outside onestepright sees them.
• If you set up a team poll: your email address and the name of the organisation being polled. A poll sends one link to colleagues; each of them takes the check and keeps their own report. As the organiser you see either, with individual answers visible, each person's answers against their level and function, with no names asked for, or, with totals only, how the answers spread once it closes. Everyone is told which before their first question. The Team polls section below says more.
• If you ask to hear when a check opens, or when another service we are considering becomes available: your email address and what you asked about. Nothing else, and it is used for nothing but that one email.
• If you ask for a handbook: your email address and which handbook. We send it to you by email. The address is used for nothing else, and it is not added to any list.
• If you arrive from an association's link: which association. We use it only to count the checks its members take. It comes with the link you followed, and your browser may hold it in that tab until you start a check. Then it is stored with your answers. It never tells the association who you are. If you are in the United Kingdom, the European Economic Area, Canada or New Zealand, it is kept only if you agree to the tags. The same applies when we cannot tell where you are.
• A help request, only if you press "I need some help" on your report. Nothing is recorded there unless you do.
• A record of changes. When something in your record changes, our database notes what changed and when, so a mistake can be found and put right. The note keeps the earlier value for up to 90 days. It never holds your email, your free text or a name. If you delete your record, those values go with it.
• Ordinary web logs (IP address, browser, pages visited), kept by our hosting providers for security and to keep the site working, for no longer than 90 days.
• Advertising and analytics tags, on our public pages only. Our public pages, such as the home page, the theme pages, the articles, the data pages and the tools, carry Google Analytics, linked to our Google Ads account. They let us see which pages and ads bring people in. They collect the pages you visit, a cookie identifier and your browser type, and Google may hold that in the United States and elsewhere. They never load on a check, on your report, on a poll or on a private data-request page. If you are in the United Kingdom, the European Economic Area, Canada or New Zealand, the tags stay off until you agree. The same applies when we cannot tell where you are. Elsewhere they run unless you choose No in the footer, and that choice is honoured wherever you are. When you start or complete a check, our server tells Google Analytics that a check in a theme was started or completed, and when. It also tells it, with the theme or topic only, when you share or download your report, set up a team poll, choose a first action on your report, come back to your report, or register interest in a check or service. Each of these carries the cookie identifier the tags set and nothing from your answers. Each is sent only if your choice allows the tags, and none is sent for an answer to a team poll. We use the completions to see which of our pages and ads lead to a completed check. If we add another platform's tag, this notice will say so first.

What we use it for

• To give you your report, and to send it to you if you ask. In the United Kingdom and the European Economic Area our legal basis is that this is the service you asked for.
• To build benchmarks, so your result can be compared with similar firms and theirs with yours. This is the point of the service, so it is a purpose of the service and not a separate consent. When you start a check, you accept the terms of use and acknowledge this notice. In the UK and the EEA our legal basis is our legitimate interest in running that comparison. You can object, and deleting your record takes you out of it. In Canada, a box shown with your business facts, just before your report, adds your answers to the benchmarks. Outside Quebec it starts ticked, and you can untick it. In Quebec it starts unticked. You can add your answers or take them out from your report page, while we can still tell which record is yours.
• To send a handbook you asked for. In the United Kingdom and the European Economic Area our legal basis is that this is the service you asked for.
• To send the one reminder or the one email you ticked a box for. Our basis is your consent, and you can withdraw it at any time.
• To run the tags on our public pages. In the UK, the EEA, Canada and New Zealand, only with your consent.
• To keep the site secure and working, which is our legitimate interest.

Your report is worked out by software from the answers you chose. We do not use it, or anything else here, to make a decision about you.

Who receives it

• Supabase, which runs our database in its Sydney region, Australia.
• Vercel, which runs the website, with its server functions in Sydney. Vercel is a US company, and its logs may be held in the United States.
• Resend, which sends our emails from its Tokyo region, Japan. An email holds your address and your private report link, never your answers.
• Microsoft 365, which holds our mailbox, where help requests and messages to us arrive.
• Google, from the tags on our public pages and the events our server sends, as above.
• The organiser of a team poll, as described above, if you answer one.
• A buyer of the business, on the terms below.
• Anyone the law requires us to tell, such as a court or a regulator.

Where your data is stored

Your answers, your profile and your email are stored in Australia, in our database in Sydney, encrypted at rest and in transit. The suppliers above handle some data outside Australia: emails in Japan, and website logs and tag data in the United States and elsewhere. Australian privacy law applies to how we handle it.

Processing outside Australia. Our database is in Sydney. Some of the suppliers named above process data in other countries. Resend sends our emails from Japan. Vercel serves the site through a worldwide network and builds it in the United States. Google processes the tag data worldwide. The courts and authorities of those countries may be able to reach data held there. We stay accountable for your data, and each supplier handles it under data protection terms it has agreed with us.

If you are in the United Kingdom or the European Economic Area: you give your data directly to us, an Australian business, and we store it in Australia. We do not market the site in the European Union, but if you use it from the European Economic Area, these protections apply to you. Where a supplier handles it outside Australia, it does so under that supplier's own data protection terms. You keep the rights described below wherever the data sits.

If you are in Canada: your data is stored outside Canada, in Australia, and may be accessed under Australian law. We apply the same safeguards to Canadian residents' data as to anyone else's.

If you are in the United States: we hold your data in Australia under the safeguards above; you have the rights described below.

Benchmarks

Benchmarks are built only from aggregated answers. A comparison is shown only once enough comparable firms are in that cut, marked with a band such as 30+ rather than an exact count. We build them, and check them, so that they do not identify a business or a person. Before we sell any report built from them, we check that it cannot be used to single out a firm, for example by comparing two overlapping cuts. Your results are private to you, except that in a team poll with individual answers visible, the person who set it up sees each answer against level and function, never a name.

Team polls

A team poll sends one link to the people an organiser invites. Each of them takes the check and keeps their own report. The organiser chooses one of two modes before the poll starts, and everyone is told which before their first question.

• Individual answers visible, the default. No names are asked for. The organiser sees each person's answers against their level and function, and can open each person's report and download the answers as a spreadsheet. In a small team, or in a role one person holds, level and function can be enough to identify someone. You are told this before your first question.
• Totals only. The organiser sees nothing while the poll is open. When it closes, they see how the answers spread across each question, if at least five people have answered. They never see who said what, and they cannot open anyone's report. This stops anyone reading one person's answers from a single poll. It cannot stop an organiser who runs two polls on nearly the same people from comparing them.

In either mode, the organiser never sees your email or your free text.

Who is responsible for what. Revoir and the organiser each control the poll data for their own purposes. Revoir holds the answers to run the service and build benchmarks, under this notice. The organiser decides why to run the poll and what to do with what it shows, and answers for that under the law that applies to them. Organisers agree to tell the people they invite how their answers will be used, and not to use the results as the only basis for a decision about a person's pay, promotion, discipline or similar.

What we don't do

We don't sell or rent your answers. We may use anonymised, aggregated benchmark data in reports and products that we sell. Those reports and products never name or single out a person or a business. We don't add you to a mailing list unless you tick a box asking for one. We don't call you. Pressing "I need some help" is the only way a conversation starts, and if you ask for more help, we will suggest someone who may be suited to help you.

If the business is ever sold: your record would pass to the buyer with the rest of the business. We will only sell to a buyer who agrees to keep to this notice as it stood when you agreed to it. If you gave us an email, we will tell you before it happens; this page will say so too, and you can delete your record first. Apart from a sale of the whole business on these terms, we never sell individual answers.

How long we keep it

Your report stays live while you use it. Twenty-four months after its last visit, we de-identify it. We remove its report link, anything you wrote and the record of changes, so the link stops working. Once none of your reports is live, we also remove your email and any reminders you asked for. Where a group of similar businesses is small, we then make your business facts less specific. Your answers stay in the set the benchmarks are built from, no longer linked to you. We review this rule every year.

If you stop before the last step, your answers are deleted thirty days after you started. Only the counts stay.

You can delete your record sooner, and you do not need an account or an email to do it.

• If you gave us your email, ask us at any time. There is a link on the privacy page and on your report. We will send you everything we hold about you, or delete it.
• If you did not give us your email, your report link is the key to your own record. It opens your report, and it carries a delete control that removes that report. Without an email we have no way to tell which record is yours, so we act on a deletion only through that link. Keep the link if you want to keep the option.

Each report's own delete control removes that report only. To delete everything held against your email address, use the data request on this page.

If you asked for a retake reminder, we hold the address you gave for it until the reminder has been sent, or until you tell us not to send it.

If you ask us to stop emailing you, we keep your address on a stop list so the stop holds, even after we delete your record. We use it for nothing else. A STOP reply takes effect within five working days.

A team poll has two ends, and neither of them deletes anybody's answers. A poll is a snapshot, so it closes within ninety days — answers arriving months apart are not one reading of an organisation. Ninety days after it closes, the organiser's results page stops working, their links to any named report are cancelled, and we erase their email address and the organisation's name. We tell the organiser the date and say to save what they need before it. Everyone who answered keeps their own report and their own delete control, exactly as if they had taken the check alone. Your report is about you, and it stays yours on the same terms as any other report. A poll's results are about somebody else's organisation, and that access ends.

If you asked to hear when a check opens, or when another service we are considering becomes available, we keep your address and what you asked about for twelve months from the day you asked, and then delete them. If it becomes available in that time, we send you the one email you asked for.

If you asked for a handbook, we keep your address and which handbook you asked for until ninety days after we send it, and then delete them. We keep a count of requests for each handbook, with no address.

Web logs: no longer than 90 days. The record of changes: earlier values for up to 90 days, then only the note that a change happened. Aggregates are kept indefinitely. They are built, and checked, so that they do not identify anyone.

Your rights

Ask us and we will send you everything we hold about you, correct it, or delete it, wherever you are. Deleting removes your email, your answers, your free text and the earlier values in the record of changes. The aggregates your answers contributed to cannot be unpicked, and they do not identify you. Email contact@onestepright.com; a person replies.

If you are in the United Kingdom or the European Economic Area, you can also ask us to limit how we use your data. You can object to our using it for benchmarks, or ask for a copy in a common file format. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it.

If something goes wrong

If a breach of your data is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as Australian law requires. If you are in New Zealand, we also tell the Office of the Privacy Commissioner. If we hold your email, we tell you directly. If we do not, we post a notice on this site.

If you want to complain

Email contact@onestepright.com and say what went wrong. A person replies within two business days, and we aim to settle it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the United Kingdom you can complain to the Information Commissioner's Office at ico.org.uk, and in the European Economic Area to the data protection authority where you live. In New Zealand you can complain to the Office of the Privacy Commissioner at privacy.org.nz. In Canada you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Who we are

onestepright is a business of Revoir Pty Ltd (ABN 37 611 713 930), Sydney, Australia. Our privacy officer is Andrew Wilson. For anything about your privacy, write to contact@onestepright.com and mark it for the privacy officer.

Our representatives in the UK and the EU (Article 27)

If you are in the European Union, the European Economic Area or the United Kingdom, you can contact our appointed representative about your personal data, instead of us or as well as us.

EU representative: Euverify Limited (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. Email: gdpr@euverify.com.

UK representative: Euverify Ltd (UK), 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom. Email: gdpr@euverify.com.

To ask for a copy of your data, ask us to delete it, or make any other request under the GDPR, you can use our representative's secure portal: https://gdpr.euverify.com/verify/6e252806-fb1b-43c6-8e8e-2cf0b42f9c7e. The same page confirms that the representative is appointed. Requests made there are logged and tracked so they are answered in time.

Changes

If this notice changes in a way that matters, the version and date at the top change and, if you have a live report, we tell you by email.