Privacy policy
Last updated: 22 October 2026
This policy explains what personal information Digital Maturity collects when you use digitalmaturity.org, what we do with it, who else handles it, how long we keep it and what your rights are.
Who we are
Digital Maturity is run jointly by two companies:
- Contentious Ltd, 81 Rivington Street, London EC2A 3AY, United Kingdom, which built the site and runs it day to day;
- Digital Leadership Ltd, which owns the assessment and looks after clients.
The two companies are joint controllers of your personal information, which means they decide together how and why it’s used. They’ve agreed that Contentious Ltd answers questions about your information and handles requests to use your rights, and that each company keeps the information it can see secure and uses it only as this policy describes. You can still use your rights with either company.
For any question about your information, or to use any of your rights, email hello@digitalmaturity.org.
What we collect
When you sign up
- Your first and last name, your email address and the name of your organisation.
- Whether you agreed to the terms and whether you asked for the newsletter.
- For a team or organisation account, the people you invite (their email addresses) and who has joined.
When you pay
Payment happens on Stripe’s own pages, not ours. Stripe collects your card details, billing address and, if you give one, your tax ID. We never see or store your card details. From Stripe we keep only what we need to run your subscription: Stripe’s reference numbers for you and your subscription, your plan, the amount, the currency, its status and the date you’re paid up to.
When you take the assessment
- Your answers to the 17 questions, and the scores worked out from them.
- The organisation name you enter, your organisation’s ID (if you belong to one), your country, your county or region, and your job function.
- The date you took it, the type of browser you used and the page you came from. We don’t store your IP address with your assessment.
We link each assessment to your account so that you can see your own results.
When you use the site
- Sign-in. We email you single-use sign-in links. Each one lasts 15 minutes and is stored only in a scrambled (hashed) form. If you set a password, WordPress stores it hashed too.
- Security. To stop abuse, we briefly count sign-in and sign-up attempts per IP address and per email address, in scrambled form, for up to an hour. Failed logins to the admin area are recorded.
- Server logs. Our host keeps standard web server logs (IP address, the page requested, browser type, date and time) for security and troubleshooting.
- Analytics. We use Umami, which counts page views without cookies and without storing your IP address. It records the page, the referring site, your browser, operating system, device type and country. None of this identifies you.
What we use it for, and why we’re allowed to
| What we do | Lawful basis |
|---|---|
| Create and run your account, sign you in and send the emails the service needs (sign-in links, invitations, confirmations) | Contract: it’s how we provide the service you signed up for |
| Show you your results, and show your organisation’s averages to its members | Contract |
| Take payments and keep billing and tax records | Contract, and legal obligation (tax law requires us to keep records) |
| Include your scores, without your name, in the averages and benchmarks other users see | Legitimate interests: comparison with others is the point of the assessment, and other users never see your name |
| Keep the site secure and working, and understand which pages are used | Legitimate interests |
| Send you the newsletter | Consent: you ticked the box. You can unsubscribe from any newsletter email |
We don’t sell your information, use it for advertising, or make automated decisions about you.
Who can see your information
Within your organisation
- Your organisation’s admin sees your name and email address in the members list, and can remove you.
- Members see the admin’s name.
- Your organisation’s admin can download your organisation’s assessment results if the organisation has a paid plan. The download has the date, country, job function and the level for each competency for every assessment, but no names or email addresses.
- In a small organisation, someone might still be able to tell whose row is whose from the date, country and job function.
Other users never see your name. They see averages and benchmarks. An organisation’s average, or the average for a job function within it, may be based on very few assessments, so in a small organisation people may be able to work out each other’s answers. Your organisation’s admin can choose not to show averages based on fewer than 3 assessments.
The people who run Digital Maturity at Contentious Ltd and Digital Leadership Ltd can see accounts, organisations, billing status and assessment results in the site’s admin area.
Service providers handle information for us under contracts that require them to protect it and use it only on our instructions:
| Provider | What for | Where |
|---|---|---|
| WP Engine (with Cloudflare) | Hosting the site and its database; security and bot protection | UK (London) data centre; Cloudflare’s global network |
| Stripe | Payments, invoices, tax, and the billing page where you manage your subscription | UK, EU and US |
| Postmark (ActiveCampaign) | Sending the site’s emails | US |
| MailerLite | The newsletter, if you signed up for it | EU |
| Umami, on a server run by PikaPods | Cookieless page statistics | Germany |
Stripe is also a controller in its own right for some payment information, such as fraud checks. Its privacy policy covers that.
We’ll share information if the law requires it, for example with HMRC.
International transfers
Some of these providers are based in the United States or may reach data from there. When personal information leaves the UK, the transfer is covered by UK adequacy regulations (for the EU, and for US companies certified under the UK Extension to the EU–US Data Privacy Framework) or by the ICO’s International Data Transfer Agreement or Addendum.
How long we keep it
We keep personal information only as long as we need it for the reasons above. Once a year we review accounts, organisations, sign-ups and invitations that are no longer active, and delete those we don’t need.
| Information | How long |
|---|---|
| Your account and organisation details | While your account is in use, and until our yearly review once it isn’t |
| Sign-ups that never complete payment, and invitations nobody accepts | Until our next yearly review |
| Your assessments | While your account exists. If you ask us to delete your account, we delete your assessments too, or remove your name and the link to you so the anonymous scores can stay in the averages and benchmarks |
| Billing records | At least 6 years, as tax law requires |
| Sign-in links | Until used, or 15 minutes |
| Server logs and security records | A few weeks at most, depending on the host |
| Newsletter subscription | Until you unsubscribe |
| Email delivery records at Postmark | 45 days |
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the information we hold about you;
- correct anything that’s wrong;
- delete your information;
- restrict how we use it, or object to how we use it on the basis of legitimate interests;
- give you your information in a format you can take elsewhere.
You can also withdraw consent to the newsletter at any time.
To use any of these, email hello@digitalmaturity.org. We’ll reply within a month. You can change your name and email address yourself on the Account page.
If you’re unhappy with how we’ve handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Cookies
We use only the cookies the site needs to work, and no advertising or tracking cookies. The cookie policy lists them.
Children
Digital Maturity is for adults at work. Nobody under 18 should use it.
Changes to this policy
When something changes, we’ll update this page and the date at the top. If a change affects how we use information you’ve already given us, we’ll email you first.