Privacy and data

Short version: I collect an email address when you ask me for something, I use it to reply to you, and I do not sell it, share it or add you to anything you did not ask for.

The longer version is below, because you are entitled to it and because a consultancy that advises on data governance should be able to describe its own.

Who is responsible

The Modern Analytics, operating from Bengaluru, India, is responsible for the personal data described here. If you want anything on this page actioned, use the contact form and it will be handled by a person, not a queue.

What I collect, and when

• The seven questions. They run in your browser and your answers stay on your device. You see your reading without giving me anything. At the end you are offered a copy of it by email, and only if you ask for that do your email address, your organisation name and your seven answers reach me, so the note can be written and so I can reply if you ask me something. There is no mailing list.
• The full assessment on this site. Your name, your email address, and optionally your organisation and role. Your answers to the ninety three items are scored in your browser and stay there. What reaches me is the request and your contact details, so I can send the report and follow up once. The report itself is generated on your own device.
• Keeping a baseline, if you choose to. At the end you are offered the option to store your answers so you can come back to them, and a separate option to be reminded in ninety days. Both are unticked, and neither happens unless you tick it. If you do, your answers and scores are stored and you get a private link by email. Untick nothing and nothing is kept.
• The contact form. Whatever you type into it, which is normally your name, email address and a description of the problem.
• Email you send me directly. Held in my mailbox like any other correspondence.

What I do not do

• No advertising trackers, no analytics pixels, no third party cookies, no session recording.
• No selling, renting or sharing your details with anybody for marketing.
• No adding you to a newsletter because you downloaded something. If you want writing from me it is on LinkedIn, where you choose to follow.
• No automated decisions about you, and no profiling.

Why I am allowed to hold it

Because you asked me for something and I need your details to provide it, and because I have a legitimate interest in replying to a business enquiry. If you would rather I did not hold it, say so and it goes.

Who else can see it

This site runs on Amazon Web Services. The pages are served from S3 through CloudFront. When you submit a form it goes to a small function of mine on AWS Lambda, which checks it and emails it to me through Amazon SES. Nothing is written to a database, because nothing needs to be.

AWS is a processor acting on my instructions and does not use your details for its own purposes. The AWS region handling this is in India, and email may cross borders in the ordinary course of being delivered to my mailbox.

If you ask for a copy of your seven questions reading, the one row that holds your email address, your organisation name and those seven answers is kept in a Supabase Postgres database in the Mumbai region. If you create an account to keep your baseline and compare it later, that account and those answers are held in the same database. Supabase is a processor on the same terms. Your answers are readable by you and by me, and by nobody else. Where the site shows how a score compares to others, it uses figures aggregated across at least five organisations, so no individual response can be picked out of it.

No other third party receives anything.

How long it is kept

• Enquiries that do not become work: twelve months, then deleted.
• Client records: for the engagement and six years afterwards, because tax and professional obligations require it.
• A copy of the seven questions reading: kept with the enquiry it belongs to, and removed whenever you ask, which you can do by replying to the email itself.
• Baseline responses: the scored result is kept only if you become a client, so a later review has something to compare against. Otherwise it goes with the enquiry.

What you can ask for

A copy of what I hold, a correction, deletion, or a stop on any further contact. Email me and it will be done inside thirty days, usually the same week. You do not need to give a reason and you will not be asked for one.

If you are in the UK or the EU you can complain to your supervisory authority. If you are in India you may raise it under the Digital Personal Data Protection Act. I would rather you told me first, because I can usually fix it faster than either.

How it is kept safe

The site is served over HTTPS only, and form submissions travel encrypted. Enquiries live in a mailbox with two factor authentication on it, not in a database, because a database I do not need is a breach I do not need either. Nobody but me reads them.

If something did go wrong and your data were affected, I would tell you directly and without being asked, and I would do it in days rather than after a review.

If you are unhappy

Tell me first, through the contact form. I am a one person practice, so the grievance officer under India's Digital Personal Data Protection Act is me, and there is no queue to get through.

You will get a reply within seven days and a resolution inside thirty. If that does not satisfy you, the escalation routes are the Data Protection Board of India, or your own supervisory authority if you are in the UK or the EU.

Children

This is a site for people buying consulting services for their organisation. It is not directed at children, I do not knowingly collect data about anyone under eighteen, and if you believe I have, tell me and it will be deleted.

Client data during an engagement

Different question, and it is answered in the statement of work rather than here. In short: mutual NDA as standard, I do not take copies of client data off site, and I work in your systems where practical. The full position is in the terms.

Changes

If this page changes materially I will date the change here. Last updated August 2026.