How we handle your data
This policy explains what data we collect when you use mini360, what we use it for, how long we keep it, which processors we rely on, and what your rights are. If anything is unclear, write to daniel@y2y.hu.
01Who controls your data
02What data we collect
Subject (the person the 360 is about):
- Name, email address
- Unique private link (token)
- Timestamps (start, responses received)
Evaluator (the person giving feedback):
- Email address (for the invitation and reminder)
- Answers to the 12 statements (Likert 1-5)
- Open comments (max. 2)
Quote request, coaching interest (if you fill them in):
- Name, email address, company, team size, message
Google Analytics (only after your consent):
- Anonymised IP address, page views, device and browser type, approximate region
We do not collect: the evaluator's name or position - the answers are fully anonymous to the subject. Your answers are never sent to Google. For security we log the IP address and time of requests for a short period (abuse prevention).
03What we use it for
From the evaluators' answers we calculate aggregated scores based on the GROUND leadership model, which the subject views on a private page - individual answers are never shown.
Email addresses are used solely to send invitations, reminders and confirmations. Quote requests and coaching interest are used to reply to your enquiry.
Anonymised Google Analytics usage statistics help us understand how the tool is used - without any advertising features.
Never: as a selection criterion in an HR system, shared with your manager, or for performance appraisal.
04Legal basis
Your own voluntary consent - GDPR Art. 6(1)(a). The subject consents via the consent checkbox and by starting the 360, the evaluator by submitting the questionnaire, quote and coaching requests by submitting the form, and analytics via the "Accept analytics" button in the cookie bar.
Security logs (IP address, timestamp) are kept on the basis of Y2Y Ltd.'s legitimate interest - GDPR Art. 6(1)(f) - to prevent abuse.
Consent can be withdrawn at any time at daniel@y2y.hu or by clearing the cookie setting - withdrawal does not affect the lawfulness of earlier processing.
05Where and how long we store it
The 360 data (answers, email addresses) stays within the EU. Transactional emails are processed by Resend and anonymised usage statistics by Google; any transfer to a third country is covered by EU-approved safeguards (standard contractual clauses or the EU-US Data Privacy Framework). The subject can request the immediate deletion of their 360 and all related data at any time.
06Who receives it
Nobody - not the HR team, not your manager, not an external partner. The evaluators' anonymous answers are seen only by the subject (aggregated, after at least 3 responses). Only Y2Y Ltd. staff bound by confidentiality have access, for system operation.
Our processors, needed to run the service: Netlify (hosting, EU CDN), Supabase (database, EU region), Resend (transactional email: invitations, reminders, confirmations), Google Analytics 4 (only after consent; anonymised IP; no advertising features).
One exception: if the subject explicitly asks, the ICF-accredited Y2Y coach may also see the aggregated report for the coaching conversation.
07Automated decision-making
We make no automated decisions about you and there is no profiling with legal effect. Scores are simple arithmetic averages; the final interpretation is done by an ICF-accredited human coach, if you choose to use one.
No live AI model (ChatGPT, Claude etc.) is involved in the questionnaire, the aggregation or the report.
08Your rights
We reply to your request within 30 days. Contact: daniel@y2y.hu
09Complaint to the authority - NAIH
You also have the right to a judicial remedy - at the court competent for your place of residence.