About this notice
This notice explains how Sea Salt Learning handles personal data collected through the Sketches of the Future Organisation Diagnostic — the short online questionnaire you complete before a facilitated group session, and the session itself.
It is separate from our general website privacy policy, which covers visitors to seasaltlearning.com. If you are taking part in the diagnostic, this is the notice that applies to you.
Last updated: 7 August 2026
Who we are
Sea Salt Learning Ltd (company number 09059565), The Old Exchange, 521 Wimborne Road East, Ferndown, Dorset, BH22 9NH, United Kingdom.
We are the controller for the personal data described here. That means we decide what is collected and why. We are not acting as your employer’s data processor, and this is not a joint arrangement — your employer does not decide how we use this data, and cannot ask us for your individual answers.
If you have any questions, or want to exercise any of the rights below, email us at hello@seasaltlearning.com.
What we collect, and why
Your responses to the diagnostic. Fifteen answers about how your organisation operates, and a word describing how each one makes you feel. These are stored against the unique link you were sent, not against your name. We use them to produce the collective picture your group discusses in the session.
Your name and email address — only in some cases. If your organisation asked us to send the diagnostic links directly, they gave us your name and email address so that we could. We use those details solely to send you the link and administer your participation. If your organisation sent you the link itself, we hold no contact details for you at all.
Technical information. Standard web server records generated when you use the application, which we use to keep the service running and secure.
Our lawful basis
We rely on legitimate interests for all of the above — specifically, running the programme your organisation has asked us to deliver, developing the diagnostic itself, and keeping the service secure.
We have assessed whether those interests are outweighed by your rights, and concluded that they are not, because of how narrowly the data is handled: your responses are never stored against your name, your employer never receives results attributed to any individual, no individual reports are produced, and nothing collected here is used for marketing.
We chose this basis rather than consent deliberately. Consent has to be freely given, and asking for it in a session your employer has arranged would not meet that standard. Relying on legitimate interests is a more honest description of what is happening — and it gives you a right to object, which is set out below.
What we do not do
- We never show your individual answers to your employer. Your facilitator sees only the combined picture across the group.
- We never link your contact details to your responses. They are held separately, so nobody — including us — can produce a report of how you personally answered.
- We do not produce individual reports, and we do not email you anything beyond your access link.
- We do not use anything collected here for marketing, and we will not add you to a mailing list.
- The diagnostic is not an assessment of you. It looks at your organisation, and must not be used to make decisions about individuals.
How long we keep it
- Your name and email address, where we hold them at all — deleted within 30 days of your session.
- Your responses — kept no longer than 2 years after your session, then deleted or fully anonymised.
- Anonymised, aggregated outputs — kept indefinitely. These are not personal data, because nobody and no organisation can be identified from them.
Anonymised reuse
We may reuse anonymised patterns and insights across programmes in our wider research and practice — but only where neither you, nor any individual, nor your organisation can be identified.
Who we share it with
We do not sell your data, and we do not share it for marketing.
The following providers handle this data on our behalf:
- Hetzner — hosting for the diagnostic application and its database. Servers are in Germany.
- Amazon Web Services (SES) — email delivery, used only to send access links. Processed in Ireland.
- Microsoft SharePoint — where we hold participant names and email addresses supplied by your organisation, in the cases where we send the links ourselves. Stored in the United Kingdom.
We use no analytics, monitoring or error-reporting services in this application.
We may disclose data where the law requires it.
Where your data is held
Where we hold your name and email address, they are stored in the United Kingdom.
Your responses are held in Germany, and access-link emails are processed in Ireland. Both are within the European Economic Area, which the UK recognises as providing an adequate level of data protection, so no additional transfer safeguards are required.
None of this data is transferred outside the UK or the European Economic Area.
Taking part is your choice
You do not have to take part. If you would rather not, you can close the page — you do not need to give a reason, and you do not have to tell anyone.
We never give your employer individual results attributed to any individual. Your facilitator sees the combined picture across the group, including how many people have taken part.
Your rights
You have the right to ask us to:
- Give you a copy of the personal data we hold about you;
- Correct it, if it is wrong;
- Delete it;
- Restrict how we use it;
- Provide it in a portable form.
Because we rely on legitimate interests, you also have the right to object to our using your data. If you object before the group results are aggregated, we will remove your responses.
Email hello@seasaltlearning.com and we will respond within one month.
One important limit. Because your responses are stored against your link rather than your name, we may be unable to identify which responses are yours unless you still have that link. If you would like your responses removed, contact us with the link and we will act on it. Once responses have been aggregated and anonymised they can no longer be traced back to you, so they cannot be removed individually.
You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you came to us first so we can put things right.
Cookies
The diagnostic application does not use cookies. It sets nothing on your device — no analytics, no tracking, and no advertising cookies. Your access link is what identifies your session, and nothing is stored in your browser.
Changes to this notice
If we change this notice, we will update the date at the top. Because our participation agreements refer to this notice, we keep previous versions on file.
Contact
If you have any questions about this notice or how we handle your personal data, email us at hello@seasaltlearning.com.