Privacy Policy
Effective Date: August 27, 2026 | UK GDPR & Data Protection Act 2018 | Information Commissioner's Office (ICO)
Privacy by Design Guarantee
OpsMentum is an operational friction intelligence platform, not an employee surveillance tool. Individual weekly check-in responses are permanently decoupled from user identities, hashed, and suppressed whenever fewer than four responses are recorded.
1. Data Controller vs. Data Processor Roles
Under the UK GDPR, our data protection responsibilities depend on the context of the interaction:
| Context | OpsMentum Role | Customer Role | Scope |
|---|---|---|---|
| Account & Billing | Data Controller | Direct Relationship | Admin accounts, billing details, platform security. |
| Team Check-In Telemetry | Data Processor | Data Controller | Processing team responses on behalf of customer. |
| Website Visitors | Data Controller | N/A | Contact inquiries and site usage. |
2. Strict Anonymity Architecture
To ensure psychological safety and honest feedback, OpsMentum enforces architectural protections:
- Minimum Sample Threshold: Whenever a team has fewer than four respondents (n < 4), all scores and breakdowns for that cycle are completely suppressed from the dashboard.
- Identity Decoupling: Survey submissions use one-way salted HMAC hashes. Neither your manager nor OpsMentum staff can link specific answers to an individual contributor.
- Zero Keystroke or Activity Tracking: OpsMentum does not install local daemons, record keystrokes, track idle time, or inspect browser history.
3. Exclusion of Special Category (Health) Data
In compliance with UK MHRA guidance and Article 9 of the UK GDPR, OpsMentum does not collect or process special category data:
- No mental or physical health records or diagnoses.
- No clinical, therapeutic, or occupational health evaluations.
- No biometric, genetic, or sensitive demographic data.
4. Data Retention & Security
All customer data is encrypted in transit using TLS 1.3 and at rest using AES-256. Database instances are hosted within secure UK/EU cloud data centres. Customers may request full deletion of their organisational data at any time upon contract termination.
5. Your Legal Rights
Under the UK General Data Protection Regulation, you have the right to request access to, rectification of, or erasure of your personal data, as well as the right to object to or restrict processing. Contact our Data Protection Officer at:
OpsMentum Data Protection
Email: privacy@opsmentum.com
United Kingdom