ANOVA EDU PRIVACY POLICY

Effective date: 27 August 2026

​

1. Who is responsible for your data?

Asha Roosberg, trading as Anova Edu, is responsible for personal data processed through www.anovaedu.org and Anova Edu’s services. Legal form: Sole proprietorship/eenmanszaak KVK: 81311532 Location: Rotterdam, the Netherlands Website: www.anovaedu.org

Email: info@anovaedu.org

For account details, enquiries, purchases and direct communications, Anova Edu acts as data controller. Where an organisation enters personal data into the paid toolkit for its own purposes, that organisation is normally the controller and Anova Edu processes the information to provide the service. Additional data-processing terms may apply to organisational customers.

​

2. Information we process

Depending on how you use our services, we may process:

• name, work email, organisation, job title and country or jurisdiction; • account, login, team membership and assessment-permission information; • enquiries, correspondence and support requests; • purchase, invoice, subscription, transaction and assessment-credit records; • policy-assessment responses, notes, evidence references, scores and generated reports; • technical information such as IP address, device, browser, security and activity logs; • cookie and analytics information, subject to applicable consent choices. Payment-card details are processed by Wix and its connected payment providers. Anova Edu does not receive or store complete payment-card numbers.

​

3. How we use information and our legal bases

We process information to:

• create and secure accounts and administer team access; • provide assessments, reports, credits and customer support; • process purchases, invoices and payments; • respond to enquiries and provide requested business support or further assessment; • prevent fraud, misuse, credential sharing and unauthorised access; • maintain, troubleshoot and improve our services; • comply with accounting, tax and other legal obligations; • send marketing only where permitted or consented to.

The legal bases used are performance of a contract or pre-contractual steps, compliance with legal obligations, legitimate interests in operating and securing our services, and consent where required. Consent may be withdrawn at any time without affecting earlier lawful processing.

​

4. Diagnostic and toolkit information

The Business Systems Diagnostic intentionally submits contact details and results to Anova Edu so that the report can be provided and Anova Edu may offer relevant support or further assessment. Google services are used to transmit or store these submissions on Anova Edu’s behalf.

The Policy Foundation Diagnostic and Compliance Review may save unfinished progress locally in the user’s browser. This locally stored progress expires after 90 days of inactivity and can be deleted by the user. It is not automatically transferred to Anova Edu merely because it is stored in the browser.

Reports uploaded to the Pre-Pilot Readiness Engine are processed in the user’s browser unless the interface expressly states otherwise. Users must not upload information they are not authorised to process.

​

5. Sharing and service providers

Anova Edu does not sell personal data or share it with other organisations for their own marketing or commercial purposes.

Information may be processed by providers necessary to operate the service, including Wix for website hosting, accounts, checkout and payments; Google for email and authorised storage or transmission; and other secure hosting, technical, accounting or professional-service providers. Information may also be disclosed where legally required or necessary to establish, exercise or defend legal claims.

Where providers process information outside the European Economic Area, Anova Edu relies on an applicable adequacy decision, approved contractual safeguards or another lawful transfer mechanism.

​

6. Retention

We retain information only as long as reasonably necessary:

• browser-saved assessment progress: 90 days after the last activity; • enquiries and Business Diagnostic submissions: normally up to 24 months after the last meaningful contact, unless an ongoing relationship or legal reason requires longer; • toolkit account and assessment data: while the account remains active and normally up to 90 days after account closure, unless earlier deletion is requested or retention is legally required; • invoices, purchases and required financial records: at least 7 years, or longer where applicable tax rules require; • consent and security records: as necessary to demonstrate compliance and protect the service. Data may be anonymised and retained for statistical or service-improvement purposes where it can no longer identify an individual.

​

7. Security

Anova Edu uses proportionate technical and organisational safeguards, including access restrictions, individual accounts, authentication controls, administrative two-step verification, secure transmission, data minimisation and provider access controls. No online system can be guaranteed completely secure. Suspected privacy or security incidents should be reported promptly to info@anovaedu.org.

​

8. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, restriction of or portability of your personal data, and may object to certain processing. You may withdraw consent at any time and lodge a complaint with the Dutch Autoriteit Persoonsgegevens.

Requests should be sent to info@anovaedu.org. We may request information necessary to verify identity and will normally respond within one month.

​

9. Automated assessments

The toolkit may automatically calculate scores, identify gaps and generate recommendations from user responses. These outputs support human decision-making and do not themselves produce legal or similarly significant decisions about individuals. Users and their organisations remain responsible for reviewing outputs and making final decisions.

​

10. Children

Anova Edu’s professional diagnostic and toolkit services are not intended for children under 18. We do not knowingly request children’s personal data through these services.

​

11. Changes

This policy may be updated when our services, providers or legal obligations change. The current version and effective date will be made available through www.anovaedu.org and the relevant checkout.