Privacy Policy

Echelon Labs is a company registered in the Netherlands (KVK 42145233). Qognexus™ is the product Echelon Labs provides. We are the controller of the personal data described here, except for the assessment data described in section 4, and our details are at the bottom of this page.

This policy covers qognexus.com, the Qognexus platform at app.qognexus.com, and the emails we send as a result. The Qognexus Readiness Snapshot (snapshot.qognexus.com) and echelonlabs.io, including its research questionnaire, have their own privacy policies.

The website is hosted on Cloudflare. To deliver pages and protect the site from abuse, Cloudflare processes technical data about each request, such as your IP address, browser type, the page requested and the time.

The website runs no analytics and contains no tracking pixels. Fonts are served from our own domain, so no font provider receives your IP address.

Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

What you tell us. Your name, work email, organisation and role when you create an account, and anything you add to your profile or workspace settings. Your password is handled by our sign-in service and is never visible to us. If you turn on two-factor authentication, the service stores what it needs to check your codes.

What we record. When you sign in and what changes are made in your workspace, so that access can be audited and misuse detected. These records name the account and the action, not the content of assessments.

Legal basis: providing the platform under your organisation's agreement with us (Art. 6(1)(b) GDPR), and our legitimate interest in keeping accounts and data secure (Art. 6(1)(f) GDPR).

Organisations and practitioners use Qognexus to assess how ready their programmes and groups are for change. For that assessment data, the organisation running the assessment is the controller and Echelon Labs acts as its processor under a data processing agreement. If you answered an assessment, please send requests about your answers to that organisation; we help it respond.

What is collected. Answers to Qognexus instruments and, where the organisation adds them, the names or email addresses of the people it invites to respond.

How answers are used. Scores are calculated by fixed rules published in the Qognexus™ Framework, not by AI, and they are reported for programmes and groups. Readiness and pulse results are never attributed to an individual respondent or used to evaluate one. Answers are not used to train AI models.

Payment happens on a checkout page hosted by Stripe. Your card details go directly to Stripe and never reach us. We receive what we need to activate and invoice your plan: the organisation, billing contact, the plan bought, the amount and the payment status.

Legal basis: performing the purchase (Art. 6(1)(b) GDPR), and our legal obligation to keep invoices and accounting records (Art. 6(1)(c) GDPR).

The platform sends service emails, such as sign-in codes, password resets, invitations to a workspace or an assessment, and summaries you have set up. They are sent through Amazon Web Services from a qognexus.com address. We do not track whether these emails are opened or their links clicked, and the platform does not send marketing email.

If you email or call us directly, we keep the message and your contact details so we can reply. Our mailboxes are hosted by TrekMail, which is a separate service from the one that sends the platform's emails. Section 7 has the details. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

We share personal data only with the service providers below, each acting as a processor on our behalf under a data processing agreement. We do not sell personal data or share it with anyone else unless the law requires it.

Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) hosts the platform, its database and file storage, the sign-in service and service emails, in its Frankfurt region.

Cloudflare (Cloudflare, Inc., United States) hosts qognexus.com and the platform's web pages and protects them from abuse.

Stripe (Stripe Payments Europe, Limited, Ireland) processes payments and holds card details.

TrekMail (TrekGuider Inc., United States) hosts our email mailboxes. It holds the messages you send to us, including requests about your data, and any reply you send to an email the platform has sent you.

Platform data is stored in the European Union, in Amazon Web Services' Frankfurt region. Cloudflare is a US company and may process request data outside the EEA, and Stripe may transfer payment data to Stripe, Inc. in the United States. Both of those transfers rely on the EU-US Data Privacy Framework, under which each of the two is certified, and on the European Commission's Standard Contractual Clauses.

Email is the exception, and we would rather say so plainly than leave it implied. Our mailboxes are hosted by TrekMail, a US company whose own policy describes infrastructure and suppliers in several countries, so a message you send us may be handled outside the EEA. TrekMail states that it relies on the Standard Contractual Clauses for those transfers. This concerns email only: your account, workspace and assessment data stay in the Frankfurt region.

We are moving these mailboxes to a provider that keeps email in the European Union. This section will change when that is done.

Account and workspace data, including assessment data we process for an organisation: while the workspace is active. After it closes, deleted within 90 days, or sooner if the organisation asks.

Reports and data exports you download: the generated files are deleted automatically after 30 days.

Application and security logs: 90 days.

Records of changes to our infrastructure: 12 months.

Database backups: kept for up to 35 days, then overwritten.

Correspondence: up to 12 months after the last exchange.

Business and tax records: contracts, invoices and related correspondence are kept for 7 years, as Dutch tax law requires. Legal basis: our legal obligation (Art. 6(1)(c) GDPR).

Website request logs: kept by Cloudflare only for the short period needed to operate and secure the site.

qognexus.com sets no cookies while you browse. When you sign in, the platform sets one strictly necessary cookie that keeps you signed in, and stores a few items in your browser, such as your selected workspace, your cart and a short record of recent actions used for troubleshooting. None of it is used for analytics or advertising, and none of it is sent to anyone else. Checkout opens on Stripe, where Stripe's own cookie policy applies.

We do not make automated decisions about you, and we do not profile individuals. Readiness scores are calculated automatically, but for programmes and groups, not about people.

Under the GDPR you can ask us to access, correct, delete or export your data, to restrict processing, or to object to it. Where we rely on consent, you can withdraw it at any time without affecting what happened before.

Write to privacy@qognexus.com and we will reply within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Data is encrypted in transit with HTTPS and at rest. Each organisation's data is kept separate, and access by our staff is limited to people who need it, protected by two-factor authentication and logged.

We will update this page when our processing changes and revise the date at the top. If we change how account or assessment data is used in a material way, we will tell workspace administrators directly.

Controller

Echelon Labs

Email

privacy@qognexus.com

Telephone

+31 85 060 5375

Post

Leeuwerickensanck 4, 6363 BK Wijnandsrade, Netherlands

Registrations

KVK 42145233 · VAT NL005532285B93