Data Processing
Where an organisation engages ResilienceBuilder®, we act as a data processor under its instructions for the Assessment data we handle on its behalf. Individual reports stay confidential to the individual; organisations receive only anonymised, aggregate group data. This page summarises how that works.
This page explains, in plain terms, how ResilienceBuilder® processes data in an organisational engagement. It sits alongside our Privacy Policy.
Roles
When an organisation runs the ResilienceBuilder® Assessment across its people, that organisation is the data controller and Steve Howe Consulting Ltd (Company No. 11027854), operating as ResilienceBuilder®, acts as a data processor, handling the data on the organisation’s documented instructions.
The individual / organisation split
- Individuals own their personal report. It is confidential to them.
- Organisations receive aggregate, anonymised dashboards at team and company level — never an identifiable individual’s responses or report.
This separation is a deliberate design choice. It protects psychological safety and keeps the underlying data honest.
Safeguards
- Processing is carried out under UK GDPR and the Data Protection Act 2018.
- Steve Howe Consulting Ltd is a certified Cyber Essentials provider.
- Data is processed only for the agreed purposes, kept only as long as needed, and then deleted or anonymised.
- Any sub-processors we use are bound by equivalent obligations.