Last updated: 4 August 2026

1. Who we are

CaroKahn Ltd ("CaroKahn", "we", "us") is the organisation responsible for the processing of your personal data in connection with our online maturity assessments. We act as the data controller for this activity under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Registered office: CaroKahn Ltd, 86-90, Paul Street, London EC2A 4NE 

Company number: 15435407 

Email: assessments@carokahn.com

If you have any questions about this notice or how we handle your data, you can contact us using the details above.

2. What this notice covers

This notice explains how we collect and use your personal data when you complete one of our maturity assessments, including (but not limited to):

• Access Governance Maturity Assessment
• Data Protection & Security Maturity Assessment
• The Immune Maturity Index, delivered as an interactive instrument at apps.carokahn.com
• Any other CaroKahn assessment delivered via Microsoft Forms, an interactive instrument hosted by us, or a similar online tool.

Our general website privacy policy continues to apply to other interactions with us (for example when browsing our website or signing up to newsletters).

3. Interactive assessment instruments

Some of our assessments, including the Immune Maturity Index, are delivered as interactive instruments in your browser rather than as online forms. These work differently from our form-based assessments, and this section explains exactly what leaves your browser and when.

While you complete the assessment, your answers are held in your browser. Nothing you enter is transmitted to us as you work through the questions, and abandoning the assessment part-way sends us nothing at all.

When you reach your results, we record a single anonymous completion event. This contains a randomly generated session reference, the version of the instrument you completed, the date and time, and a campaign tag identifying the link you arrived through. It contains none of your answers, none of your scores, and no personal data. We use it to count how many people complete each assessment and which campaigns they arrived from.

If you choose to send your result and request a debrief, two things happen. First, a structured record of your assessment is transmitted to us: your thirty individual answers, your domain scores, your overall score, the instrument version, the campaign tag, and the same session reference. Second, your email application opens with your result summary addressed to us; your name, organisation and any other contact details reach us through that email, and only to the extent you choose to include them. The session reference in the email allows us to connect your message to your assessment record. What the share button sends is stated on the page before you press it.

The session reference is generated afresh for each sitting, is held only for the duration of that sitting, and is not stored on your device. We do not use cookies, tracking pixels, fingerprinting or any cross-session identifier in these instruments, and we do not retain your IP address with your assessment record.

Retention. Assessment records from interactive instruments, together with the associated scores, session reference, instrument version and campaign tag, are retained for twenty-four months from the date of completion, subject to annual review. These records do not contain your name, organisation or contact details. Anything you send us by email when requesting a debrief is retained in line with section 10.

Hosting. Interactive instruments and the records they generate are hosted and stored with Cloudflare, acting as our data processor. See sections 8 and 9.

4. What data we collect

Depending on the specific assessment and the questions you choose to answer, we may collect:

• Identity and contact details – name, job title, organisation name, business email address, business telephone number.
• Organisation information – sector, size, geographic footprint, technology landscape (for example ERP platforms, cloud providers).
• Assessment responses – your answers to maturity questions, free-text comments, ratings and self-assessments relating to access governance, data protection, security and related business processes.
• Assessment session data – for interactive instruments, the session reference, instrument version, completion date and time, and campaign tag described in section 3.
• Engagement data – whether and when you completed the assessment, follow-up interactions relating to your results (for example workshop notes or meeting outcomes).

We do not intentionally collect special category data (such as health, ethnicity or religious beliefs) or criminal offence data through these assessments, and we ask you not to include this information in free-text responses.

5. How we collect your data

We collect your data directly from you when you:

• complete one of our online maturity assessments, whether delivered as a form or as an interactive instrument hosted by us; or
• participate in a follow-up meeting, workshop or consultation where we discuss or refine your responses.

6. Why we use your data (purposes)

We use your personal data from maturity assessments to:

• Analyse and benchmark your organisation's current level of maturity in areas such as access governance, data protection and security.
• Generate and share tailored reports, insights and recommendations with you.
• Prepare for and deliver follow-up conversations, workshops or advisory services.
• Develop and improve our assessment tools, frameworks and consulting services (using aggregated and anonymised data wherever possible).
• Maintain appropriate records of our relationship with you and manage our business operations (for example pipeline management and internal reporting).

We will not sell your data to third parties or use it for unrelated purposes without informing you and, where required, obtaining your consent.

7. Our lawful bases for processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

• Legitimate interests (Article 6(1)(f)) – where you complete an assessment in a business / professional context, we process your data to provide you and your organisation with insights and recommendations, and to grow and manage our business. We balance these interests against your rights and expectations and only process data that is necessary and proportionate.
• Consent (Article 6(1)(a)) – where we explicitly ask for your consent, for example to send you ongoing marketing communications or to use a testimonial or case study that identifies you personally. You can withdraw this consent at any time – see section 12.

8. Who we share your data with

We may share your data with:

• Microsoft – as our cloud service provider for Microsoft Forms / Microsoft 365 (acting as our data processor).
• Cloudflare – as the hosting and storage provider for our interactive assessment instruments and the records they generate (acting as our data processor).
• Other carefully selected service providers who support our IT, analytics, customer relationship management or communication tools (for example secure email or CRM platforms), all under appropriate data processing agreements.
• Professional advisers (such as legal or accounting advisers) where necessary for our legitimate business interests and subject to confidentiality obligations.

We do not share your assessment responses with other clients without your explicit agreement. Where we use examples, case studies or aggregated statistics in marketing or thought leadership, we remove or anonymise identifiable details unless you have given us permission to do otherwise.

9. International transfers

Some of our service providers, including Microsoft and Cloudflare, may store or process your data outside the UK. Where this happens, we ensure that appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses approved by the UK Information Commissioner's Office ("ICO").

10. How long we keep your data

We retain your personal data from maturity assessments only for as long as necessary for the purposes described in this notice:

• Assessment records from interactive instruments are retained for twenty-four months from completion, as described in section 3.
• Assessment responses and related contact details from form-based assessments, and correspondence you send us when requesting a debrief, are typically retained for up to 7 years from the date of your last interaction with us, so that we can provide longitudinal insights, benchmarking over time and continuity in our advisory work.
• Where you become a client, we may retain relevant assessment data as part of your client file, in line with our client data retention schedule and legal obligations.
• If you withdraw consent for marketing, we will stop using your data for that purpose and retain limited information only to record your preference.

When data is no longer needed, we securely delete or anonymise it.

11. How we keep your data secure

We take appropriate technical and organisational measures to protect your personal data, including:

• limiting access to authorised CaroKahn personnel and trusted processors;
• using secure, access-controlled cloud platforms, including Microsoft 365 and Cloudflare, with strong authentication and logging;
• encrypting data in transit and at rest where appropriate;
• maintaining policies, controls and training relating to information security and data protection.

12. Your rights

You have a number of rights under UK data protection law in relation to your personal data:

• Right of access – to request a copy of the personal data we hold about you.
• Right to rectification – to ask us to correct inaccurate or incomplete data.
• Right to erasure – to ask us to delete your data in certain circumstances.
• Right to restriction – to ask us to limit the way we use your data.
• Right to object – to object to our processing where we rely on legitimate interests, including profiling; we will stop processing unless we have compelling legitimate grounds.
• Right to data portability – to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to ask us to transfer it to another controller where technically feasible.
• Right to withdraw consent – where we rely on consent (for example for marketing), you can withdraw it at any time by contacting us or using the unsubscribe options in our communications.

To exercise any of these rights, please contact us using the details in section 1. Please note that completion records from interactive instruments contain no information that identifies you; where you have requested a debrief, the session reference in your email allows us to locate the associated assessment record if you wish to exercise your rights over it.

13. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: https://ico.org.ukTelephone: 0303 123 1113

14. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our assessments, services, technology or legal obligations. We will indicate the date of the latest update at the top of the notice and, where appropriate, notify you of significant changes.