Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how GrundMind collects, uses, stores, shares, and protects personal data in connection with:

• our websites, including grundmind.com and grundmind.com;
• contact forms and consultation requests;
• newsletters and marketing communications;
• AI adoption assessments and surveys;
• diagnostic and pilot programmes;
• workshops, interviews, and advisory services;
• reports, dashboards, and progress reviews;
• client administration, billing, and support;
• events, webinars, and other professional activities.

This Privacy Policy applies to website visitors, prospective clients, clients, survey participants, client employees, contractors, partners, suppliers, and other people who interact with GrundMind.

2. Who is responsible for your personal data?

The data controller is:

GrundMind, a brand of Grund Institute
Registered address: Avenue de la Moesette, 1110 Morges, Switzerland
Email: info@grundmind.com
Website: grundmind.com

In this Privacy Policy, “GrundMind”, “we”, “us”, and “our” refer to this entity.

For some corporate assessments and advisory engagements, the client organisation may determine why employee or participant data is processed. In those cases, the client may act as the data controller and GrundMind may act as a data processor on its behalf. The relevant client agreement or participant privacy notice will explain the applicable roles.

3. Applicable data-protection law

GrundMind is established in Switzerland and is subject to the Swiss Federal Act on Data Protection where applicable. The European Union General Data Protection Regulation may also apply to particular processing activities depending on the people, organisations, services, and locations involved.

The Swiss FADP protects natural persons whose personal data is processed and imposes duties on private controllers and processors. The GDPR may apply, for example, where services are offered to individuals in the European Economic Area or their behaviour is monitored there.

4. What personal data do we collect?

The personal data we collect depends on how you interact with us.

4.1 Contact and professional information

We may collect:

• first and last name;
• business email address;
• telephone number;
• job title;
• employer or organisation;
• department, team, or business unit;
• professional role and responsibilities;
• country and preferred language;
• correspondence and meeting details.

4.2 Website and technical information

When you use our website, we or our service providers may collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• language settings;
• pages visited;
• date and time of access;
• referring website;
• approximate location derived from IP address;
• cookie and similar technology identifiers;
• interaction and performance data;
• security logs.

4.3 Assessment and survey information

When you participate in a GrundMind assessment, we may collect:

• survey responses;
• ratings and written comments;
• perceptions of AI tools and initiatives;
• views on workflows, business value, trust, governance, skills, roles, and support;
• department, role category, seniority, location, or team;
• assessment completion status;
• timestamps and technical metadata;
• optional demographic or professional information expressly requested in the survey.

We aim to collect only information needed to understand organisational AI adoption. Participants should not submit medical information, political views, religious beliefs, trade-union membership, information about sex life or sexual orientation, disciplinary records, or other highly sensitive information unless GrundMind and the relevant client have expressly agreed that such information is necessary and appropriate safeguards are in place.

4.4 Client engagement information

During pilots, diagnostics, workshops, and advisory engagements, we may collect:

• project goals and priorities;
• organisational structures;
• AI initiatives and use cases;
• workflow descriptions;
• governance policies;
• adoption metrics;
• milestone and implementation information;
• meeting notes and action items;
• feedback from leaders and employees;
• business performance indicators;
• estimated or measured return on investment;
• documents supplied by the client.

4.5 Contractual and billing information

We may collect:

• company billing details;
• postal address;
• contract information;
• purchase order details;
• invoice records;
• payment status;
• tax and VAT information;
• bank transaction references.

We do not normally collect or store full payment-card details directly. Payments may be handled by an external payment provider.

4.6 Marketing and event information

We may collect:

• newsletter subscriptions;
• communication preferences;
• event registrations;
• webinar attendance;
• downloaded resources;
• responses to campaigns;
• professional interests;
• records of consent or objections.

4.7 Information from third parties

We may receive personal data from:

• your employer or client organisation;
• colleagues or project sponsors;
• professional networking platforms;
• event partners;
• public company websites;
• business directories;
• analytics and marketing providers;
• referral partners;
• other service providers.

Where personal data is obtained indirectly, we will provide appropriate information where required by law.

5. Why do we process personal data?

We may process personal data for the following purposes.

5.1 Providing our services

We process data to:

• administer surveys and assessments;
• analyse organisational AI adoption;
• calculate scores and diagnostic outputs;
• identify conditions that may be limiting AI value, workflow effectiveness, trust, governance, or capability;
• prepare reports, interpretations, and recommended action priorities;
• conduct interviews and workshops;
• provide advisory and implementation support;
• track milestones and progress;
• assess adoption and business impact;
• administer reporting and client support.

5.2 Managing client relationships

We process data to:

• respond to enquiries;
• arrange introductory calls;
• prepare proposals;
• manage contracts and projects;
• communicate with client contacts;
• schedule meetings;
• maintain project records;
• manage billing and payments;
• provide support.

5.3 Improving GrundMind

We may process data to:

• improve questionnaires and scoring;
• validate and refine our methodology;
• test new features;
• improve reports and recommendations;
• understand service performance;
• develop aggregated benchmarks;
• conduct internal research;
• maintain quality and consistency.

Where possible, we use aggregated or anonymised data for these purposes.

5.4 Website operation and security

We process technical data to:

• operate and maintain our websites;
• remember user preferences;
• diagnose technical problems;
• prevent fraud and misuse;
• secure accounts and systems;
• analyse website performance;
• understand how visitors use our website.

5.5 Marketing and business development

Where permitted, we process data to:

• send relevant updates, articles, invitations, and offers;
• follow up after enquiries or events;
• understand professional interests;
• measure campaign effectiveness;
• maintain business relationships.

You can unsubscribe from marketing emails at any time.

5.6 Legal and compliance purposes

We may process personal data to:

• comply with legal and regulatory obligations;
• maintain accounting and tax records;
• establish, exercise, or defend legal claims;
• respond to lawful authority requests;
• investigate suspected misuse;
• enforce contracts and policies;
• manage data-protection requests and incidents.

6. Legal bases under the GDPR

Where the GDPR applies, our legal bases may include:

• performance of a contract, where processing is necessary to provide requested services;
• legitimate interests, such as operating our business, improving services, ensuring security, and communicating with professional contacts;
• consent, where required for specific cookies, newsletters, recordings, or optional processing;
• legal obligations, such as accounting, tax, and compliance requirements;
• establishment, exercise, or defence of legal claims;
• another lawful basis permitted by applicable law.

Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests override them.

In an employment context, the appropriate lawful basis must be assessed for the specific deployment. GrundMind does not assume that employee consent is automatically an appropriate legal basis merely because a participant is asked to acknowledge or accept a survey notice.

You may withdraw consent at any time, although withdrawal does not affect processing carried out before the withdrawal.

7. Organisational surveys and employee participation

When a client invites employees or other participants to complete a GrundMind assessment, the purpose, expected use of the results, and applicable privacy information should be communicated clearly.

• GrundMind aims to minimise the collection of identifiable information;
• standard Team and Corporate Results are designed to present aggregated organisational findings;
• small-group reporting may be suppressed or withheld where the applicable reporting threshold is not met;
• manager and employee evidence are kept as separate evidence sources rather than averaged together;
• raw participant answers and free-text evidence are restricted to authorised access;
• named individual Fit scores, named Cognitive Archetypes, raw answers, and employee ranking are not part of standard manager reporting;
• where a restricted Manager Support view identifies a person, it is limited to operational support needs and recommended support actions and should be shared only with people who require that information to provide the support;
• GrundMind is intended for AI adoption support, workflow improvement, enablement, governance, and development, not for hiring, promotion, compensation, disciplinary action, termination, employee ranking, performance evaluation, or automated allocation of work.

Client organisations remain responsible for determining the lawful basis, internal approvals, employee-representative consultation, notices, and other obligations that apply to their particular deployment.

8. Automated analysis and profiling

GrundMind uses predefined scoring rules, evidence thresholds, and reporting logic to calculate assessment results. Missing evidence is not treated as a negative score, and results may be withheld where evidence requirements are not met.

Automated processing may be used to:

• calculate assessment scores and evidence status;
• group and aggregate responses;
• identify patterns across dimensions and subdimensions;
• produce diagnostic signals about possible barriers to AI value;
• support benchmarking and longitudinal comparison where appropriate.

GrundMind is intended for organisational AI adoption, workflow improvement, enablement, governance, capability development and developmental support. It is not designed or permitted for individual employment decision-making. GrundMind outputs must not be used to make, recommend, rank, score or materially influence decisions concerning an individual’s recruitment or hiring, promotion, compensation, performance evaluation, disciplinary action, termination, selection for redundancy or headcount reduction, or allocation of work, tasks, shifts or responsibilities.

GrundMind may identify organisational, workflow, capability or structural changes for consideration, but its outputs must not be used to determine which individuals should be selected for employment-related actions. All findings require human interpretation and may be used only within GrundMind’s stated organisational and developmental purposes.

9. Use of artificial intelligence tools

The GrundMind methodology is human-designed. Core scores and evidence states are determined by predefined rules rather than unrestricted AI interpretation.

The platform may use AI to assist with draft interpretation, summarisation, translation, or report preparation. AI-assisted narrative content must be reviewed and explicitly published by an authorised human before it becomes client-facing.

Client and participant data is not used to train public AI models. Where an external AI-enabled service is used, GrundMind applies data minimisation and other safeguards appropriate to the information involved.

10. Who do we share personal data with?

We may share personal data with the following categories of recipients where necessary:

• cloud-hosting providers;
• survey and form providers;
• data-analysis and reporting providers;
• email and communication services;
• customer relationship management providers;
• videoconferencing providers;
• project-management and collaboration tools;
• website hosting and analytics providers;
• payment and accounting providers;
• professional advisers;
• insurers;
• contractors and consultants supporting GrundMind;
• competent public authorities where legally required;
• a purchaser or successor in connection with a merger, acquisition, restructuring, or sale.

Service providers may process data only for agreed purposes and under appropriate contractual and security requirements.

Swiss guidance confirms that outsourcing data processing does not remove the controller's responsibility for lawful processing and appropriate safeguards.

11. Sharing data with the client organisation

The information provided to a client depends on the agreed reporting layer and purpose. Standard Team and Corporate Results are designed to be aggregated. Manager and employee perspectives remain separate where both are collected.

Client-facing reporting may include:

• aggregated dimension and subdimension results;
• team-level patterns where the reporting threshold is met;
• aggregated Cognitive Archetype distributions;
• Manager–Team Alignment findings;
• evidence-coverage information;
• diagnostic interpretations and recommended actions;
• progress measures where a follow-up assessment has been agreed.

Standard manager reporting does not provide named individual Fit scores, named Cognitive Archetypes, raw answers, free-text evidence, or employee rankings. A restricted Manager Support view may identify a person only where operationally necessary to provide support, and only the support need and recommended manager actions are shown.

The client remains responsible for how it uses the reports and recommendations it receives and must respect the agreed intended-use restrictions.

12. International data transfers

Some service providers may store or process data outside Switzerland or the European Economic Area.

Where personal data is transferred to a country recognised as providing adequate data protection, we may rely on that adequacy decision.

Where adequate protection is not recognised, we may use safeguards such as:

• recognised standard contractual clauses;
• contractual protections adapted for Swiss law;
• transfer impact assessments;
• supplementary technical and organisational measures;
• another lawful transfer mechanism.

Swiss law generally permits transfers abroad where the recipient country provides adequate protection or where appropriate safeguards or another legal exception applies. The FDPIC recognises adapted EU Standard Contractual Clauses as one possible safeguard for certain transfers.

You may contact us for more information about the safeguards used for relevant transfers.

13. Data retention

GrundMind retains personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable contractual, legal, accounting, security, dispute-management, or audit requirements.

Retention periods differ by data category and engagement. In particular:

• accounting, invoice, and contractual records are retained for the periods required by applicable Swiss law;
• contact and prospective-client information is retained only while there is a legitimate business or legal reason to keep it;
• assessment responses, result snapshots, reports, and related provenance are retained according to the applicable client agreement, assessment purpose, and legal requirements;
• archiving may preserve historical evidence and audit records while removing them from normal operational views;
• personal data is deleted, anonymised, or otherwise restricted when it is no longer required for the applicable purpose;
• anonymised statistical information may be retained where it no longer identifies an individual.

Client-specific retention or deletion requirements may be documented in the relevant agreement or data-processing documentation.

14. Data security

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure;
• destruction.

Measures may include:

• access controls;
• role-based permissions;
• encryption in transit and, where appropriate, at rest;
• multifactor authentication;
• secure cloud infrastructure;
• backup and recovery procedures;
• logging and monitoring;
• contractual confidentiality obligations;
• supplier due diligence;
• staff awareness and training;
• data minimisation;
• pseudonymisation and aggregation.

No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security.

Swiss data-protection rules require controllers to implement suitable technical and organisational safeguards and apply data protection by design and by default.

15. Data breaches

If a personal-data breach occurs, we will assess its nature, scope, potential consequences, and required response.

Where required by law, we will notify the competent authority and affected individuals.

Under the Swiss FADP, the FDPIC must be notified as soon as possible where a breach is likely to result in a high risk to the personality or fundamental rights of affected individuals.

16. Cookies and similar technologies

Our website may use cookies, local storage, pixels, scripts, and similar technologies.

These may include:

Essential technologies

Required for:

• website operation;
• security;
• session management;
• form submission;
• accessibility;
• user preferences.

Analytics technologies

Used to understand:

• website traffic;
• page performance;
• visitor interactions;
• navigation patterns;
• technical errors.

Marketing technologies

Used, where enabled, to:

• measure campaigns;
• understand conversions;
• personalise communications;
• support advertising.

Where required, non-essential cookies will be activated only after consent.

Where a cookie-consent control is presented, you can use it to manage optional technologies. You can also manage cookies through your browser settings. Disabling some technologies may affect website functionality.

The FDPIC has published guidance specifically addressing cookies and similar tracking technologies, including transparency and data-protection requirements.

A separate Cookie Notice may provide details of the individual technologies used.

17. Marketing communications

We may send business-related marketing communications where:

• you have requested them;
• you have consented;
• there is an existing professional relationship;
• another applicable legal basis permits the communication.

You can unsubscribe at any time using the link in the message or by contacting us.

We may retain a minimal suppression record to ensure we respect your opt-out request.

18. Third-party links and websites

Our website may link to third-party websites or services.

GrundMind is not responsible for the privacy practices, security, accuracy, or content of external websites. You should review their privacy notices before providing personal information.

19. Children

GrundMind's services are designed for organisations and working professionals.

They are not directed at children, and we do not knowingly collect personal data from children through our website.

Where an organisation wishes to include participants under the age required for valid consent, this must be expressly agreed in advance and supported by appropriate legal safeguards.

20. Your rights

Depending on applicable law, you may have rights to:

• request confirmation of whether we process your personal data;
• access your personal data;
• request correction of inaccurate data;
• request deletion of data;
• request restriction of processing;
• object to certain processing;
• withdraw consent;
• request data portability where applicable;
• obtain information about international transfers;
• object to direct marketing;
• request review of certain automated decisions;
• lodge a complaint with a supervisory authority.

Under Article 25 of the Swiss FADP, an individual may request information about whether personal data concerning them is being processed and receive information including the purposes, categories of data, recipients, and applicable retention period.

Some rights are subject to conditions and exceptions. For example, we may need to retain information for legal obligations, contractual claims, security, or overriding interests.

21. How to exercise your rights

To submit a privacy request, contact:

Email: info@grundmind.com
Postal address: Avenue de la Moesette, 1110 Morges, Switzerland

Please describe your request clearly.

We may ask for information needed to verify your identity and protect your data from unauthorised disclosure.

Where GrundMind acts only as a processor for a client organisation, we may direct your request to that organisation or assist it in responding.

We will respond within the period required by applicable law.

22. Complaints

You may contact us first so that we can try to resolve your concern.

You may also contact the Swiss Federal Data Protection and Information Commissioner:

Federal Data Protection and Information Commissioner, Switzerland

Where the GDPR applies, you may also lodge a complaint with the competent supervisory authority in the country where you live, work, or believe an infringement occurred.

The FDPIC is Switzerland's independent federal data-protection supervisory authority.

23. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our services;
• new technologies;
• changes in data use;
• changes to providers;
• legal or regulatory developments.

The revised version will be published with an updated date.

Where changes materially affect active participants or clients, we may provide additional notice.

24. Contact us

For questions about this Privacy Policy or our processing of personal data, contact:

GrundMind
Avenue de la Moesette
1110 Morges
Switzerland

Email: info@grundmind.com
Website: grundmind.com