The short version
- You can take any benchmark without telling us who you are. Anonymous answers are stored without a name, email or IP address.
- If you add your details, it is because you ticked a box asking for the report, for contact, or both. Each box is separate and unticked to start with.
- We only pass your details to a technology supplier after you confirm that named company in writing.
- Research is published and shared only as anonymised, aggregated findings, never for a group smaller than 10.
- You can stop all contact or ask us to delete your data at any time, using one short form.
Who we are
Asand is a trading name of ORRJO Limited, a company registered in England and Wales (company number 13925853), registered office 86-90 Paul Street, London EC2A 4NE. ORRJO Limited is the controller of the personal data described here, which means it decides how and why that data is used and is responsible for protecting it.
Questions about this notice or your data: hello@asand.io.
What we collect
When you take a benchmark
Your answers to the questions (for example your role, the size of your organisation and where you are in a buying decision), the time you started and finished, and a short campaign label if you arrived through an invitation link. We do not ask for free-text answers, and we do not store your name, email or IP address with your answers.
If you choose to add your details
Your name and work email. If you also ask the research team to contact you, your company, job title and, if you choose to give them, your phone number and LinkedIn profile. We also record exactly what you agreed to, the wording you saw, when you agreed, and the IP address and browser details at that moment, so we can prove your choice later.
If we invited you to take part
Your name, work email, job title and organisation, which we obtain from business data providers and from public sources such as company websites. We record where each contact came from and will tell you on request. If you don’t take part, we delete these details within six months of the invitation. If you opt out, we keep only your email address on our do-not-contact list.
If you talk to the research team
Notes of your conversations, what you’re looking for, and any introduction you confirm, including the supplier, the details shared and when you confirmed.
When you use the site
Anonymous page counts through a cookieless analytics service, and standard server logs kept by our hosting provider for security. See cookies and analytics.
We do not collect special category data (such as health, religion or political views) and the site is not intended for anyone under 18.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Run the benchmark and show your result | Legitimate interests: providing the service you asked for. |
| Combine answers into anonymised research, which we publish and share with organisations that commission it | Legitimate interests: producing research about how organisations buy technology. Answers are anonymised before analysis and only ever shared in aggregate. |
| Invite business contacts by email to take part in a benchmark | Legitimate interests: researching how organisations buy technology. Invitations go to work addresses, say who we are and include a one-click opt-out. We only send them where the law allows business contact without prior consent. |
| Email you the published report | Legitimate interests: doing what you asked when you ticked the report box. This is the report only, not marketing. |
| Contact you by email, phone or LinkedIn about your results and suppliers that may fit | Consent, given by ticking the contact box. You can withdraw at any time. |
| Introduce you to a named technology supplier | Consent, given separately for each supplier on a confirmation page. |
| Keep records of consent, introductions and opt-outs | Legal obligation and legitimate interests: showing we have acted lawfully, and making sure we never contact someone who has asked us not to. |
| Keep the site secure and prevent misuse | Legitimate interests: protecting the site and the people who use it. |
The exact wording of the two optional boxes is:
- Send me the report. “Email me the published benchmark report when it is ready. (This is the report only, not marketing.)”
- Talk to the research team. “Yes, Asand's research team can contact me by email, phone or LinkedIn about my results and technology suppliers that may fit what I need. The team works for ORRJO Limited, which runs Asand. I can withdraw at any time.”
Your result is calculated automatically from your answers using our published rubric. It is for your information only and doesn’t lead to any decision with legal or similarly significant effects on you.
Who we share it with
- Technology suppliers you confirm by name. Only the details listed on the confirmation page, only after you click confirm, and only for that supplier. Once shared, the supplier is responsible for your details under its own privacy notice, and is bound by an agreement with us to use them only to arrange and follow up the meeting you asked for.
- Organisations that commission research or sponsor a benchmark. Anonymised, aggregated findings only. Never your details or your individual answers.
- Service providers who process data for us, under contracts that require them to protect it and use it only on our instructions: Vercel (website hosting and cookieless analytics), Supabase (our database, hosted in London), Google Workspace (email and calendar), our email sending platform for invitations, the business data providers we use to find work contact details, and the telephony and CRM tools our research team uses.
- LinkedIn, if you asked us to contact you there. LinkedIn handles messages under its own privacy policy.
- Professional advisers, regulators or law enforcement, where the law requires it.
We never sell personal data, and we never pass it to unnamed “partners”.
International transfers
Our database is in the UK. Some of our service providers are based in, or support their services from, the United States and other countries. Where personal data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.
How long we keep it
| Data | How long |
|---|---|
| Anonymous benchmark answers | Up to five years for research, then only aggregated findings remain. |
| Details of people we invited who didn’t take part | Six months from the invitation, then deleted. |
| Details given only to receive the report | Until the report is sent, plus three months, then deleted. |
| Details given with consent to contact | Two years from your last contact with us, or until you withdraw, whichever is sooner. |
| Records of consent and confirmed introductions | Six years after our last contact, so we can show we acted lawfully. |
| Opt-out list | For as long as needed to honour your request. It holds only your email and the date. |
When your details are deleted, any answers they were linked to stay only in anonymised form.
Your rights
You have the right to:
- withdraw consent at any time, without affecting anything done before;
- object to direct marketing at any time, which we will always honour;
- object to processing based on legitimate interests;
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- receive data you gave us with consent in a portable format.
Use the preferences page or email hello@asand.io. We respond within one month. Stopping contact takes effect straight away and never needs proof of identity. For copies or deletion we may ask you to confirm your identity first.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first at hello@asand.io. We will acknowledge your complaint within 30 days and keep you updated until it is resolved. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Security
Data is encrypted in transit and at rest. Our database is locked so that only our own server code can read or write to it. Access inside ORRJO is limited to the people who need it, and we will report any breach to the Information Commissioner’s Office within 72 hours where the law requires.
Changes to this notice
If we change this notice we will update the date at the top. If a change affects something you agreed to, we will ask again rather than assume.