ThinkerBox Privacy Notice

Who I am

ThinkerBox is the trading name of Iddo Diamant, a sole trader established in Ireland at The Tara Building, 11-15 Tara Street, Dublin 2, D02 RY83, Ireland.

I am the data controller for everything described here. I can be reached at iddodiamant@gmail.com.

I am not required to appoint a Data Protection Officer and have not appointed one, so privacy questions come to me directly.

What this notice covers

thinkerbox.ie, including the contact form, the Calendly booking link, and the AI and tech readiness check at /readiness/sport, /readiness/education, and /readiness/nonprofit.

It does not cover data I process on behalf of a client during an evaluation engagement. In that work the client is the controller and their own notice applies, governed by the contract between us.

What I collect, and why

When you send me a message. Your name, email address, and whatever you write. I use it to answer you and to take any steps you are asking for before we might work together. Legal basis: taking steps at your request prior to a contract, and my legitimate interest in responding to enquiries about my business.

When you book a call. Your name, email address, and the time you choose, handled by Calendly. Same basis.

When you take the readiness check. Your answers to the screener, the organisational items, the individual items, the attitude items, and the open question, plus how long you took and the two internal response-quality results. Then your email address, which you give at the end so I can send you your result. Legal basis: performing the service you asked for. Separately, I use the answers to check and improve the instrument itself, on the basis of my legitimate interest in making it accurate, which I have balanced against your interests by not using your identity for it.

Giving your email is voluntary and there is no obligation of any kind to give it. If you would rather not, you can stop at that point and nothing you have answered is used. The only consequence is that you do not receive your result.

When you visit the site. Aggregate page and traffic figures derived from server logs. Legal basis: my legitimate interest in knowing which pages are read.

Business records. Where we do business, I keep invoices and related records because Irish tax law requires it.

I do not collect special category data, and the check does not ask for any. Please do not put personal details about other people, or anything confidential to your organisation, into the open question.

The readiness check, in more detail

The check produces an instant summary automatically, with no person involved at the moment it is generated. It names where your organisation sits, where you sit, the fit between the two, one strength and one gap, and a line of published evidence. It contains no score, no percentage and no ranking against anyone else.

Part of producing that summary uses a large language model through a commercial API. What is sent to it is the set of scored answers alone. Your email address, your name and any organisation name are removed first, and the open question is never sent at all, because it is the one field whose contents I cannot control. The provider is contractually barred from using that content to train its models.

The full written report works the same way and is never sent automatically. It only exists if you ask for it. I read your response, the draft is produced through the same API on the same basis, I check and edit it myself, and I send it to you. Every response that comes in is read by me, whether or not a report is requested.

This is automated processing, and part of it evaluates your own stated competency. It produces no legal effect and nothing similarly significant: the result is information for you, it decides nothing about you, and nobody else is given it. You can ask me to review any result by hand, or to explain how it was reached, by emailing iddodiamant@gmail.com.

Your response is yours. I do not disclose an individual's answers or result to their employer, their colleagues, or anyone else, whoever asks and for whatever reason.

Once your result has been sent, your email address is separated from your answers and held against a reference number instead. If you want your report later, quote that number. Your answers no longer sit alongside anything that identifies you.

Your email address is used to send you your result and, if you ask for it, your report. It is not added to a mailing list, and I will not send you marketing on the back of it.

Cookies

This site sets no cookies and stores nothing on your device. Site statistics come from Netlify's server-side web analytics, which uses no cookies and no tracking script, and which I see only in aggregate. There is no consent banner because there is nothing to consent to.

Who else handles your data

Netlify, which hosts the site and receives contact form and readiness check submissions. Acts under a data processing agreement.

Calendly, if you book a call. Acts under a data processing agreement.

Anthropic, which processes the stripped answers described above through the Claude API. Acts under a data processing agreement.

Google, which carries my email. My mailbox is a standard Google account and is not covered by a data processing agreement, so I keep what passes through it to a minimum: readiness answers are held by Netlify, not in email, and are separated from your identity once your result is sent.

Nobody else receives your data, and I do not sell it, share it for advertising, or pass it to any other organisation.

Where your data goes

Netlify, Calendly, Anthropic and Google are established in the United States. Those transfers are covered by the EU-US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission's standard contractual clauses.

If you are in Israel, note that the European Commission recognises Israel as providing an adequate level of protection, so data moving between Ireland and Israel needs no additional safeguard.

How long I keep it

Readiness check answers: 24 months from your response, or until the instrument has been validated, whichever comes first. After that they are anonymised so they can no longer be linked to you. Anonymised data may be kept indefinitely.

The email address attached to a readiness response: separated from the answers once your result is sent, and deleted at 24 months at the latest.

Messages you send me: 24 months, unless we are working together, in which case they are kept for the life of the engagement.

Calendly bookings: for as long as the booking record is held in that account.

Business and tax records: six years, as Irish tax law requires.

Anonymised findings

I may publish patterns drawn from readiness check responses, for example how often a particular fit shows up across everyone who has taken it. Anything published is aggregate, and no figure is published for any group of fewer than ten responses. I do not quote what anyone wrote in the open question, and I do not name or describe an organisation in a way that would identify it.

Your rights

You can ask me for a copy of your data, to correct it, to erase it, to restrict what I do with it, or to receive it in a portable form. You can object to processing I carry out on the basis of legitimate interest. If you object to your response being used to check and improve the instrument, it comes out of that set and stays out. Where I rely on your consent you can withdraw it at any time, which does not affect anything done before you withdrew it.

Email iddodiamant@gmail.com and I will respond within one month.

If you are unhappy with how I have handled your data, you can complain to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, dataprotection.ie. You can also complain to the supervisory authority in the country where you live or work.

If you are in Israel

Israeli law applies to this site as well as Irish and EU law, and the following is your notice under section 11 of the Privacy Protection Law.

You are under no legal obligation to give me any of this data. You give it because you want to send a message, book a call, or receive your readiness result. If you choose not to, nothing happens: you simply do not receive the thing you asked for, and there is no other consequence.

The controller is Iddo Diamant, trading as ThinkerBox, at the address above. The purposes are the ones set out in this notice and no others. The data is handled by the providers named above, each of which is there because the site needs hosting, scheduling, email or automated drafting to work at all.

You have the right to inspect the data I hold about you and to ask for it to be corrected or deleted. Email iddodiamant@gmail.com. You can also complain to the Israeli Privacy Protection Authority.

Children

This site and the readiness check are meant for people working in an organisation, and are not directed at anyone under 18. If you believe someone under 18 has given me data through this site, email me and I will delete it.

Changes

If this notice changes I will update the date at the top. Substantive changes to how the readiness check works will be described here before they take effect.