This notice explains what personal data LUNARRÁ collects, why we hold it, who we share it with, how long we keep it and what you can ask us to do about it. It covers this website, the Performance Architecture Assessment™, and everyone who contacts us or works with us.
Section 01Who we are
LUNARRÁ is the trading name of LUNARRÁ Group Ltd, a company registered in England and Wales, company number 16881159, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
We are the data controller for the personal data described in this notice. That means we decide what is collected and why, and we are accountable for it.
When your employer commissions an assessment
Two different things are happening, and the difference is the reason you can answer honestly.
Your organisation decides to run the assessment and gives us the list of people to invite. For that list, your organisation is the controller and we act on its instructions.
For your answers, and for everything we build from them, we are the controller. We set the questions, the scoring and the thresholds, and we decide what the report is able to say. Your organisation cannot instruct us to hand over your individual answers, because they are not its data to demand. There is no instruction it could give us that would work.
We are independent controllers rather than joint controllers. Each of us answers for our own part.
We are registered with the Information Commissioner's Office under registration number ZC216954.
For anything to do with your data, write to info@lunarra.co.uk. Data protection is the personal responsibility of the director, Ramón Wright. There is no separate Data Protection Officer, because we are not required to appoint one.
Section 02What we collect, and why
If you complete the assessment
The Performance Architecture Assessment™ is the main way we collect personal data. When you complete it we record:
- Your work email address, and your name where you were sent a personal invitation link or where your name can be read from your email address.
- Your organisation's name and email domain.
- Your business unit or department, your primary country, and whether your responsibilities reach beyond it.
- Your answers to the assessment statements, the pressure factors you flag, and the scores calculated from them.
- Records of our commercial relationship with your organisation, including our own working notes and assessment of it. These are judgements about the business rather than about you, and they are never shown to you or to your employer.
We use this to build your Pressure Architecture Map™ and your organisation's Performance Architecture Report™, and to contact you about the results and about our work.
The assessment asks how well you recover, how sustainable your workload is, and where pressure sits. Those are questions about working conditions, not about your health. We do not ask for, and do not want, medical information.
But we recognise that answers about recovery and sustained pressure can say something personal about you. So we treat them as sensitive by choice: your individual answers are never shown to your employer. Everything your organisation sees is combined with other people's answers, and no view is released to an organisation until enough people at that level have responded for individuals not to be identifiable.
If you contact us or book a briefing
Your name, email address, organisation, and whatever you choose to tell us. If you book through our online scheduling page we also receive the time you chose and any notes you added.
If we meet online
We use an automated notetaker on some client and partner calls. It records, transcribes and summarises the meeting. We tell you before it starts, and we turn it off if you ask. Recordings of your meeting are not shared outside LUNARRÁ without your agreement.
If you work with us or for us
Staff, partners and contractors are covered by a separate staff privacy notice, issued directly. Suppliers and clients: we hold the contact and billing details needed to run the relationship.
What we do not do
- We do not sell personal data. Ever, to anyone.
- We do not run advertising or analytics tracking on this site.
- We do not make automated decisions that produce legal effects for you.
- We do not knowingly collect data from children through this website.
Section 03Our lawful basis
UK data protection law requires a lawful basis for every use of personal data. Ours are these.
| What we do | Our basis | Why it applies |
|---|---|---|
| Produce and send you your assessment result | Contract, or steps taken at your request | You asked us for the result. We cannot produce it without your answers. |
| Combine responses into an organisation's report | Legitimate interests | It is the service the organisation engaged us for, and individuals are protected by aggregation. |
| Follow up with you about your result and our work | Legitimate interests | You are a business contact who came to us. You can stop it with one reply. |
| Run the business: invoices, records, tax | Legal obligation | Company and tax law requires us to keep these. |
| Record meetings with a notetaker | Legitimate interests | Accurate notes serve the work. You may ask that recording is not used, and alternative note-taking arrangements will be considered. Refusal costs you nothing. |
Where we rely on legitimate interests we have weighed our interest against yours and concluded it does not override your rights. You can ask us for that assessment and we will send it to you.
Section 04Who else touches your data
We are a small firm and we use established suppliers to run the service. Each one acts on our instructions only. We do not give any of them permission to use your data for their own purposes.
| Supplier | What it does for us | What it sees |
|---|---|---|
| Netlify | Hosts the website | Technical request data |
| Supabase | Stores assessment responses | Everything in Section 02 |
| Web3Forms | Relays completion notices to our inbox | Your email, organisation and scores |
| EmailJS | Sends you the link to your own result | Your name, email and link |
| Namecheap Private Email | Our mailboxes | Anything you email us |
| Calendly | Briefing bookings | Your name, email, booking |
| Fathom | Meeting notes and transcripts | What is said in the meeting |
| Revolut Business | Invoicing and payments | Billing contact details |
| Google Fonts, jsDelivr | Serve fonts and code to your browser | Your IP address, as any web request requires |
| Clearbit | Fetches your organisation's logo for your report | Your organisation's website domain only, never your email |
We will also disclose data where the law requires it, and to our professional advisers where necessary.
Data outside the UK
Some of these suppliers are based outside the UK, principally in the United States. Where data is transferred, we rely on the safeguards approved under UK law, which is normally the International Data Transfer Addendum to the European Commission's standard contractual clauses. The specific safeguard for each supplier is recorded in our processor register. You can ask us which safeguard applies to a particular supplier.
Section 05How long we keep it
| Record | Kept for | Then |
|---|---|---|
| Assessment responses, where the organisation became a client | Duration of the engagement plus 6 years | Deleted |
| Assessment responses, where no engagement followed | 24 months from completion | Deleted, or reduced to anonymous statistics |
| Enquiries and briefing bookings that went nowhere | 12 months | Deleted |
| Meeting recordings and transcripts | 12 months | Deleted, notes retained |
| Invoices, contracts and financial records | 6 years after the end of the financial year | Deleted |
| Saved assessment progress in your own browser | 21 days | Expires automatically |
Anonymous statistics, meaning figures that can no longer be traced to a person or an organisation, may be kept indefinitely. Once data is genuinely anonymous it stops being personal data.
Section 06Cookies and browser storage
This site sets no advertising cookies, no analytics cookies and no third-party tracking cookies.
The assessment saves your progress in your browser's local storage so that closing the tab does not lose your work, and passes your result to the Pressure Architecture Map™ through session storage. Both are strictly necessary for the function you asked for, both stay on your device, and clearing your browser data removes them.
Fonts and code libraries are loaded from Google Fonts and jsDelivr. Those requests reveal your IP address to those providers, as every web request does.
Section 07Your rights
You have the right to:
- See what we hold about you, and get a copy of it.
- Correct it if it is wrong or incomplete.
- Have it deleted, where we have no overriding reason to keep it.
- Restrict what we do with it while a dispute about it is resolved.
- Object to processing based on legitimate interests, including any marketing. If you object to marketing we stop, without exception and without argument.
- Receive your data in a portable format, where we rely on consent or contract.
- Withdraw consent at any time, where consent is what we relied on.
Ask by emailing info@lunarra.co.uk. We answer within one month. We do not charge. We may ask you to confirm who you are first, so that we do not hand your data to somebody else.
Section 08Keeping it safe
- Access to assessment data is limited to the people who need it to do the work.
- Our database is configured so that the public website can write a response but cannot read anybody else's back out.
- Reports are released to an organisation only in aggregate, and only once enough people have responded for individuals not to be identifiable.
- Accounts are protected with strong, unique passwords and two-factor authentication where the supplier offers it.
- If a breach happens and it is likely to be a risk to you, we report it to the ICO within 72 hours and tell you directly where the risk is high.
Section 09Complaints
If you are unhappy with how we have handled your data, tell us first. We would rather fix it than have it escalate, and we will take it seriously.
You also have the right to complain to the Information Commissioner's Office, the UK regulator, at any time. Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint.
Section 10Changes
If we change this notice we update the version and date at the top of the page. If a change materially affects how we use data you have already given us, we tell the people affected directly rather than expecting them to notice.