Privacy notice

Who is responsible

Eldwin is a market-testing service for wellness and preventive health startups. Until the company is registered, the data controller is Olivier Paquier Lorenzi, acting as a natural person, reachable at olivier@eldwin-uk.com. A postal address is available on request at that address and will be published here at registration.

A company named Eldwin is being incorporated. Once it exists it will replace Olivier Paquier Lorenzi as data controller, and its registered name, number and address will be published on this page and in the legal notice.

The risk check runs in your browser

The six-question expansion risk check is plain JavaScript running on your own device. Your answers, the risk level it computes and the country you type are held in the page only. Nothing leaves your browser unless you submit the email form, and if you close the page they are gone.

What is collected when you submit the form

If you enter your email address and submit the form, the following is sent and stored:

• your email address;
• your six answers and the risk level computed from them;
• the country or countries you typed, if any;
• the goal you selected and the test format you selected, if any;
• the language version of the page you were on, and the date and time of submission.

Plus a hidden anti-spam field, normally empty, and a constant recording that the submission came from this website. Nothing else: no name, no company, and no identifier beyond that list. Your IP address is not recorded in our own records; our host, Netlify, keeps technical access logs on its side, under its own retention periods.

Why, and on what legal basis

The email address is used to send you your own results and the one-page test plan, which is what you asked for by submitting the form. The legal basis is the performance of steps taken at your request (Article 6(1)(b) GDPR). Giving your email is entirely optional: the risk check works without it, and the test plan template is freely available on this site without leaving anything.

The answers are used to make a first conversation about your market useful rather than generic. Where we reply to a business enquiry you have made, we rely on legitimate interest (Article 6(1)(f) GDPR).

We sell this data to nobody and pass it to no third party for their own purposes. The only intermediaries are the processors listed below. It is not used for advertising or profiling, and no automated decision producing legal effects is made about you.

Who processes it

Submissions are received by a Google Apps Script web app and stored in a Google Sheet inside Eldwin's Google Workspace; the results email and the internal notification are sent through Gmail. Google is therefore the only processor. Transfers to the United States rest on Google's standard contractual clauses and on its certification under the EU–US Data Privacy Framework; a copy of the clauses can be requested at the address above.

Booking a call opens a Google Calendar appointment page. What you enter there is handled under Google's terms, not ours.

How long it is kept

Until you ask us to delete it, and in any case no longer than 24 months after our last contact. Ask at olivier@eldwin-uk.com and we will confirm the deletion.

No cookies, no analytics, no trackers

This site sets no cookies. It loads no analytics, no advertising and no third-party scripts: all of its code and its single font file are served from this domain. It writes nothing to your browser's storage. There is no consent banner because there is nothing to consent to.

Your rights

You can ask for access to the data we hold about you, for it to be corrected or erased, for processing to be restricted, for it to be sent to you in a portable format, and you can object to processing. Write to olivier@eldwin-uk.com; you will get an answer within one month, extended by up to two further months if the request is complex, in which case we will tell you. You also have the right to complain to a data protection authority: the one where you live, where you work, or where you believe the breach took place.

If you take part in a market test

This notice covers visitors to the website. No market test has been run yet. Before the first one, every tester will receive a separate information notice and will give explicit, specific consent for that test.

Eldwin commits, for every test: to pseudonymise usage data from the first day; to give the client the panel's make-up (age ranges, cities, habits) and never the identity of any tester; to carry out a data protection impact assessment before any test involving health-related usage data; to sign a processing agreement with the client; and to delete individual data at the end of the test. These commitments are written into the one-page test plan signed before a test starts.

Changes

If this notice changes, the date at the top of the page changes with it. Material changes affecting people whose data we hold will be sent to them by email.