Privacy Policy

1. Who we are

CAIA Limited ("CAIA", "we", "us", "our") is a psychology-led leadership consultancy registered in England and Wales, company number 11618191. Registered office: 26–28 Great Portland Street, London W1W 8QT. We are the controller of the personal information described here. "You" means anyone whose personal information we handle as described in this policy. Contact: lara@caiaconsulting.com.

Our website and services are not intended for anyone under 18, and we do not knowingly collect information about children.

2. What we collect

• When you contact us, book a call or request materials: your name, email address, phone number (if provided), organisation, role and what you tell us in your message.
• When you or your organisation become a client: the information needed to set up and deliver the engagement, including business contact details and correspondence.
• When you take a leadership assessment or complete COA: your responses to psychometric questionnaires, interview notes, and the reports produced from them (see section 3).
• When you give 360 feedback about a colleague: your name, contact details and the feedback you provide.
• When you buy COA on this website: your name, email address, the transaction record, your confirmation that you requested immediate access, and your marketing choice. If you buy COA for someone else, we also collect their name and email address. Payment is processed by Stripe; we do not receive or store your card details.
• When you complete COA that someone else bought for you: your responses, your report, and your acknowledgement that the purchaser will receive your report.
• When you use this website: technical and usage information collected by our analytics provider, described in sections 6 and 7.

3. Leadership assessments and psychometrics

Where an organisation commissions an assessment, coaching engagement or other leadership service relating to you, we may receive basic information about you from that organisation, such as your name, role and business contact details, and the purpose of the work.

During an assessment we collect information directly from you through psychometric questionnaires, interviews and other assessment methods. This may include information about your career history, leadership experience, values, motivations, strengths and development areas.

Sometimes you may choose to tell us about your health or other sensitive matters during an interview or coaching session. We only record this where it is relevant to the work and with your explicit consent, and we do not include it in reports shared with a commissioning organisation unless you have agreed.

Where an assessment includes 360-degree feedback, we collect feedback about you from colleagues nominated by you or the commissioning organisation, along with those colleagues' names and contact details. We report 360 feedback in aggregated form so that individual raters cannot be identified, except where raters have been told in advance that their comments will be attributed.

We combine this information to produce an individual assessment or development report. Before you take part we tell you what the assessment involves, how your information will be used and who will receive the findings. Our assessments are professional development tools. They are not medical or clinical diagnoses, and they are not designed to be the sole basis for any decision about you.

4. Where information comes from

Most of the information we hold comes directly from you. In commissioned assessments, some comes from the organisation that engaged us, as described in section 3. Where an assessment includes 360 feedback, some comes from colleagues who give feedback about you. Where someone buys COA for you, we receive your name and email address from them. We do not buy personal data and we do not collect information about you from social media or other public sources for assessment purposes.

5. How and why we use it

We use personal information to:

• respond to enquiries and provide requested materials, relying on our legitimate interest in responding to people who contact us;
• deliver assessments, coaching and consulting, including 360 feedback, and prepare the outputs of that work, relying on performance of a contract with you or, where an organisation has engaged us, on our and that organisation's legitimate interest in delivering the engagement properly;
• process COA purchases and provide your report, relying on performance of a contract or, where someone else bought COA for you, on our legitimate interest in delivering the assessment they purchased;
• send marketing and follow-up communications, relying on your consent or, for existing business contacts, our legitimate interest in keeping in touch (see section 9);
• use assessment data in anonymised or pseudonymised form for research, validation and benchmarking (see section 8), relying on our legitimate interest in maintaining reliable, well-validated assessments and contributing to leadership research. You can object to this use (see section 14);
• operate, secure and improve our website and services, relying on our legitimate interest in running an effective and secure business;
• meet legal, accounting and regulatory obligations, relying on legal obligation.

Where we handle sensitive information about your health, we rely on your explicit consent, as described in section 3.

Where we rely on legitimate interests, we have considered the effect on you and do not use your information in ways you would not reasonably expect.

6. Who we share it with

We do not sell personal information.

Commissioning organisations. Assessment reports and findings are shared only with the organisation that commissioned the work, in the form and to the people agreed with you at the outset. We do not share your identifiable assessment information with any other client.

Individual purchasers. Where someone else purchases COA for you, such as an employer, investor or co-founder, your report is sent to both you and them. We tell you this clearly before you start the assessment.

Assessment platform providers who host or score psychometric questionnaires we use. Some of these providers act as controllers in their own right and have their own privacy notices.

Associates and consultants who deliver work on our behalf and are bound by confidentiality and data protection obligations.

Service providers who process information on our instructions: Lovable and Supabase, which host our website and COA assessment app; Anthropic, whose AI tool Claude we use to help draft reports; Google Workspace, for email, documents and file storage; Google Analytics, for website usage; Calendly, for booking calls; Stripe, for payments; and our email delivery provider. Each is bound by contract to protect your information.

Professional advisers, such as lawyers, accountants and insurers, where needed.

A buyer or successor, if CAIA's business is sold or restructured.

Legal requirements. We may disclose information where the law requires it.

7. Cookies and analytics

We use cookies and similar technologies to run this website and to understand how it is used. Essential cookies are needed for the site to work. Non-essential analytics cookies, including Google Analytics, are set only if you consent, and you can change or withdraw your choice at any time through Cookie settings in the footer. Google Analytics collects information about how visitors use the site, such as pages viewed and approximate location; it does not tell us who you are.

8. Research and anonymised benchmarking

We use assessment data to check that our tools work, to build the comparison groups a psychometric assessment needs, and to publish research on leadership. For this we use anonymised data, from which you cannot reasonably be identified, or pseudonymised data, where identifying details are separated from responses and kept securely. Pseudonymised data is still personal information and is protected as such. Published research and benchmarks contain only aggregated results in which no individual is identifiable. You can object to the use of your pseudonymised data for research (see section 14).

9. Marketing

We send occasional emails about our work, research, events and resources to people who have asked for them or who are existing business contacts. If you buy COA on this website, we only send you marketing emails if you tick the box to opt in at checkout. We confirm your sign-up by sending you an email with a confirmation link (double opt-in); you will only receive marketing emails after you confirm. Every email includes an unsubscribe link, and you can also opt out by emailing lara@caiaconsulting.com. Opting out does not affect any engagement or purchase.

10. Automated processing and AI tools

COA generates your individual report automatically from your responses. CAIA does not make decisions about individuals based solely on automated processing that would have legal or similarly significant effects on them. Where an assessment informs a recruitment, investment, development or other decision, that decision is made by people.

We use AI tools, including Claude by Anthropic, to help our consultants draft assessment reports. A CAIA consultant reviews and finalises every AI-assisted report before it is shared, and AI tools are not used to make decisions about you.

11. International transfers

CAIA is based in the United Kingdom. Our website and COA assessment app are hosted by Lovable and Supabase in [SUPABASE REGION]. Some of our service providers, including Anthropic, Google, Stripe and Calendly, may process personal information in the United States.

Transfers to the European Economic Area are covered by UK adequacy regulations. Where information is transferred to the United States or another country without UK adequacy, we rely on recognised safeguards: the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework. You can contact us for more information about the safeguards we use.

12. How long we keep it

• Assessment records and reports from commissioned engagements: up to 5 years after the engagement ends, unless the client agreement, the law or a specific need requires otherwise.
• COA reports and responses purchased through this website: 3 years after completion.
• Interview notes: 6 months after the final report is issued.
• Enquiries and prospective client information that does not lead to an engagement: 2 years.
• Purchase, invoicing and accounting records: up to 6 years, where needed for tax, accounting or legal purposes.
• Pseudonymised research datasets: reviewed at least every 3 years, then fully anonymised or deleted once they are no longer needed to validate our assessments.

Fully anonymised, aggregated data, from which no individual can be identified, is not personal information and may be kept.

When information is no longer needed we delete it securely.

13. How we protect your information

We protect personal information with appropriate technical and organisational measures, including access controls, encryption and limiting access to assessment reports to the people who need it.

14. Your rights

You can ask us to give you access to your information, correct it, delete it, restrict how we use it, or provide it to you in a portable format. Where we rely on consent, you can withdraw it at any time.

You have the right to object. You can object at any time to our use of your information for marketing, and to any use based on our legitimate interests. If you object to marketing we will stop. If you object to other legitimate-interest processing we will stop unless we can show a compelling reason to continue.

To exercise any right, email lara@caiaconsulting.com. We will respond within one month. For complex requests we may extend this by up to two further months, and we will tell you if we do. There is usually no charge. We may need to verify your identity, or ask you to clarify your request, before acting on it.

Complaints

If you have a concern or complaint about how we handle your information, please contact us first at lara@caiaconsulting.com. We will acknowledge your complaint within 30 days, investigate it and respond without undue delay, and let you know the outcome.

You can also complain to the UK Information Commissioner's Office at ico.org.uk or, if you are in the EU, to your local supervisory authority.

15. Contact and changes

Questions about this policy: lara@caiaconsulting.com. We will post any changes on this page with a new date at the top. If we make significant changes, we will let clients and customers know directly.