ImpactAS+™ Privacy Notice
Effective: 15 July 2026 Version: 1.0 Controller: RESILIGENT Limited Data protection contact: privacy@resiligent.com
This notice tells you what personal data we collect about you when you use the ImpactAS+™ platform (including LINC™, Cohort Hub, CulturePulse™, group coaching, and the leadership assessments), why we collect it, how long we keep it, who processes it on our behalf, and what rights you have. It is written to satisfy the Nigeria Data Protection Act 2023 (NDPA) as our primary regulatory regime, and the UK GDPR for our users in the United Kingdom. Where the two frameworks differ we apply the stricter standard.
If anything in this notice is unclear, please write to privacy@resiligent.com and we will respond within 14 days.
1. Who we are
RESILIGENT Limited ("we", "us", "RESILIGENT") is the data controller for personal data you provide to the ImpactAS+™ platform. Our registered office is in Lagos, Nigeria. Where you use ImpactAS+™ through an organisation that pays for your access (your employer or a programme sponsor), that organisation is a joint controller for the purposes of the coaching programme they have commissioned; a separate Data Processing Agreement between RESILIGENT and that organisation governs their part of the relationship.
2. What personal data we collect
2.1 Data you give us directly
- Account identity — name, email, professional role, password (stored as a bcrypt hash, never in plain text).
- Leadership assessments — your answers to DISC, LCP, JobFit, CulturePulse™ PGI and related instruments, and the reports derived from them.
- LINC™ session content — the free-text situations you type into LINC when you Prepare, Navigate or Debrief a leadership moment.
- Cohort Hub posts — anything you write in a cohort feed, discussion prompt or spotlight.
- Group coaching recordings — audio and video of coaching sessions you attend, where you have consented to be recorded.
- Coach notes — where you are a coach, notes you write about a coachee you are working with.
- Consent choices — the timestamp and version of every consent you have granted or withdrawn on the platform.
2.2 Data we derive from your use of the platform
- Leadership Memory™ — syntheses LINC composes across your sessions, only if you have granted memory consent (v4).
- Leadership Timeline™ — a chronological view of your own journey, derived from your consented session history.
- Relationship Intelligence™ — inferences about people you have referenced in your sessions, held only in your own memory.
- Decision Patterns — tentative observations LINC forms about how you tend to decide, only after 15+ decision-bearing sessions across at least 90 days, and only if you have granted the Section 7 consent.
- Organisational themes — anonymised, k-anonymous (minimum 5 leaders) aggregates of themes from consented LINC use, fed to CulturePulse™ for your organisation.
- Usage metering — the number of composed LINC turns you use each month, so we can honour the allowance model.
2.3 Data we collect automatically
- Technical logs — IP address, browser, device, time of access, error traces. Held for security and audit for up to 24 months.
- Strictly-necessary cookies — session cookies used to keep you signed in. We do not use non-necessary analytics or advertising cookies. We do not sell any personal data.
3. Why we process your data (lawful basis)
Under NDPA S.25 and UK GDPR Art 6, we rely on:
| Purpose | NDPA lawful basis | UK GDPR lawful basis |
|---|---|---|
| Providing the ImpactAS+™ platform to you (account, assessments, coaching, LINC composition, Cohort Hub) | Performance of contract (S.25(1)(b)) | Art 6(1)(b) contract |
| Longer-arc LINC features (Memory, Timeline, People, Decision Patterns) | Explicit consent (S.25(1)(a)) — granted separately per feature | Art 6(1)(a) consent + Art 9(2)(a) for any profile inference |
| Aggregated organisational themes (CulturePulse Org Loop) | Explicit consent per leader (S.25(1)(a)) plus k-anonymity | Art 6(1)(a) consent |
| Security, fraud prevention, and audit | Legitimate interest (S.25(1)(f)) | Art 6(1)(f) legitimate interest |
| Compliance with legal obligations | Legal obligation (S.25(1)(c)) | Art 6(1)(c) legal obligation |
We do not use your data for advertising, third-party marketing, or to train foundation models outside the platform.
4. Automated processing and AI-generated content
ImpactAS+™ uses AI-assisted composition to produce LINC counsel, Decision Patterns observations, and cohort programme drafts. Two things you should know:
- No LINC output constitutes a decision that has a legal or similarly significant effect on you. LINC is designed as observation, phrased tentatively, always presented with evidence, and always subject to your acceptance or dismissal. You are the decision-maker.
- You may object to any automated observation by withdrawing the
underlying consent (memory, org-loop, or decision-patterns) at any
time, from within the
/lincsurface. Withdrawal purges the derived surfaces immediately.
5. Who we share your data with (recipients and processors)
We share personal data only with the following categories of recipient, each under a written data processing or joint controller agreement:
- Your paying organisation where applicable (coaching sponsor). Scope is limited to what the sponsorship contract permits and what you have granted through the coaching-layer share controls.
- Your assigned coach where you are on a coaching programme, and only for content you have explicitly shared with them (Block 5 coaching layer).
- Infrastructure processors — MongoDB Atlas (database), SendGrid (transactional email), and OpenAI / Anthropic / Google (LLM providers via the Emergent Integrations layer). None of these processors are permitted to use your data for their own purposes.
- Advisors — legal, accounting and audit firms, under confidentiality.
- Public authorities where we are legally required to disclose, such as under a court order or a lawful NDPC or ICO request.
We do not sell personal data. We do not share personal data with advertisers.
6. Cross-border data transfer
Where your data is stored. The primary ImpactAS+™ database is hosted by MongoDB Atlas in the United States. Transactional email is sent via SendGrid (United States). LLM composition passes through providers in the United States and the European Union depending on the model. This means personal data of Nigerian, UK and other subjects may be transferred outside your country of residence.
Basis for transfer.
- For UK and EU subjects: we rely on the UK International Data Transfer Agreement (IDTA) with MongoDB Atlas and on the EU Standard Contractual Clauses (2021/914) with our LLM providers, each supplemented by technical safeguards (encryption in transit and at rest, access controls, audit logging).
- For Nigerian subjects: we rely on NDPA S.41(1)(b) — adequate contractual safeguards with each recipient (equivalent to SCCs), documented and available for inspection by the NDPC on request. Where a specific transfer requires it, we rely on S.41(1)(a) explicit consent of the data subject; you can decline the transfer by choosing not to use the affected feature.
We keep signed transfer agreements with each processor on file and review them annually. If you would like a copy of the transfer basis that applies to your data, write to privacy@resiligent.com.
7. How long we keep your data (retention)
We keep personal data only for as long as we need it. Concretely:
| Data | Retention | What happens then |
|---|---|---|
| Account identity | While your account is active + 6 months after closure | Hard-deleted from the primary store; backups purged within a further 30 days |
| Leadership assessments (raw + reports) | 7 years from completion, unless you request earlier deletion | Hard-deleted; aggregate/anonymised statistics may be retained |
| LINC sessions and derived memory | While your consent is active; on withdrawal, soft-deleted immediately and hard-deleted 30 days later | Hard-deleted; k-anonymous org-loop themes remain in the tenant aggregate but your individual contribution is removed |
| Cohort Hub posts | While the cohort is active + 12 months, unless you delete earlier | Hard-deleted after retention window |
| Group coaching recordings | 90 days from the session, unless coach and coachee agree in writing to extend | Hard-deleted after retention window |
| Coach notes | While the coaching relationship is active + 24 months | Hard-deleted after retention window |
| Technical logs (IP, device, error traces) | 24 months | Hard-deleted rolling |
| Consent audit trail | 7 years (regulatory requirement) | Retained as-is |
"Deletion means gone" — when you ask us to delete your data (a right-to-erasure request under NDPA S.34 and UK GDPR Art 17), the record is soft-deleted from the app immediately, then hard-purged from the primary store 30 days later. After that 30-day window your erasure cannot be reversed, even by us. Backups may hold a copy for a further period; those roll off on their own retention schedule.
Separately, we sometimes deactivate an account for operational reasons — long dormancy, an admin cleanup, a suspected spam signup, or an admin error. Operationally deactivated accounts are soft-deleted for 180 days so that if you return, or if the deactivation was a mistake, we can restore you cleanly. After 180 days the account and its data are hard-purged. You can request an immediate right-to-erasure upgrade of any operationally deactivated account by writing to privacy@resiligent.com; that switches the clock to the 30-day compliance path and is non-reversible.
The two-lane model is intentional: the compliance promise beats operational convenience every time. When a data subject asks to be forgotten, we do not keep a "just in case" backdoor.
8. Your rights
Under both NDPA (S.34–S.40) and UK GDPR (Arts 15–22) you have the right to:
- Access the personal data we hold about you.
- Correct any personal data that is wrong or out of date.
- Erase your personal data ("right to be forgotten").
- Restrict how we process your personal data in specific circumstances.
- Portability — receive a machine-readable copy of what you have given us.
- Object to processing based on legitimate interests, and to any profiling that produces observations (Decision Patterns).
- Withdraw consent at any time for any feature that relies on consent, without affecting your access to the base platform.
- Complain to a supervisory authority — in Nigeria the Nigeria Data Protection Commission (NDPC), in the UK the Information Commissioner's Office (ICO).
How to exercise these rights. Write to privacy@resiligent.com with the right you are exercising and, where relevant, the specific data or session you are asking about. We respond within 14 days for Nigerian subjects (NDPA S.36) and within one month for UK subjects (UK GDPR Art 12(3)). If we cannot verify your identity we will ask you to log in and confirm from your account.
Within the platform, you can already:
- Withdraw any LINC consent from
/linc. - Delete any individual session from
/linc/timeline. - Wipe your Decision Patterns from the Decision Patterns panel.
- Close your account by writing to privacy@resiligent.com.
9. Security
We use industry-standard technical and organisational measures, including encryption in transit (TLS 1.2+) and at rest, hashed passwords (bcrypt with per-user salt), role-based access control, audit logging of every administrative action, and least-privilege production access. Full detail is in our internal Information Security Policy, available to enterprise clients under NDA.
10. Breach notification
If a personal data breach affects you, we will notify the NDPC (for Nigerian subjects) and the ICO (for UK subjects) within 72 hours of becoming aware, in line with NDPA S.40 and UK GDPR Art 33. If the breach is likely to result in a high risk to you personally, we will notify you directly and without undue delay.
11. Children
ImpactAS+™ is a professional platform. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from a person under 18, we will delete it immediately.
12. Changes to this notice
We may update this notice from time to time. Every change is versioned and dated at the top of this page, and material changes are notified to you inside the app before you next use an affected feature. Your continued use of the platform after a material change constitutes acknowledgement of the updated notice; changes to lawful basis or new processing that requires consent will always be re-consented, not assumed.
13. Contact
- Privacy contact / Data Protection Lead: privacy@resiligent.com
- Registered office: RESILIGENT Limited, Lagos, Nigeria
- Nigeria supervisory authority: Nigeria Data Protection Commission (NDPC) — https://ndpc.gov.ng
- UK supervisory authority: Information Commissioner's Office (ICO) — https://ico.org.uk
This notice is written in plain English and mirrors the specific consent architecture inside ImpactAS+™. If you would like a Nigerian Pidgin or a French translation for a colleague, please write to privacy@resiligent.com.
