Privacy Notice

Workshop Commitment Tracker is an invite-only platform used for client workshops and post-workshop follow-up. It is not a public sign-up service.

It covers invited users such as participants, managers, facilitators, administrators and other authorised users of a client workspace.

The organisation that invited you into the workshop is normally the controller of workshop data. It decides why the workshop runs, who participates and how outputs are used.

Smart Minds Ltd. normally acts as processor for the WCT platform and processes workshop data to provide secure access, workflow delivery, reminder emails, support, auditability and compliance assistance.

Smart Minds Ltd. may act as an independent controller for limited platform operations such as account administration, support handling, security logs and legal or business records.

Depending on your role, WCT may process identity and business contact details, workspace membership, workshop assignment, role data, commitments, check-ins, support requests, shared wins, Team Wall items, final reflections, notification data, communication delivery records and audit logs.

The platform is designed for development follow-up. The MVP does not use scores, rankings, peer evaluation or AI interpretation.

Data is normally supplied by the client organisation, an authorised administrator or a facilitator. Additional operational data is created when users sign in, accept invitations, add commitments, complete check-ins, share optional content or view reports.

Workshop data is processed only to run the WCT workflow: secure workspace access, workshop setup, participant and manager assignment, commitment capture, check-in collection, reminder delivery, progress reporting, Team Wall visibility, final reflections, support, auditability and compliance assistance.

Smart Minds does not use WCT workshop data for independent marketing, behavioural advertising or unrelated commercial profiling.

The controller is responsible for defining and documenting the lawful basis for each workshop or programme. Smart Minds acts on the controller's documented instructions and service agreement when acting as processor.

For workplace-development workshops, the controller may typically rely on legitimate interests or another controller-selected lawful basis under the organisation's internal policy and applicable law.

Participants see their own commitments, check-ins, support requests, and final reflections. They choose what to share where the workshop settings allow participant choice.

Managers see visible commitments, named check-in completion status, shared wins, aggregated support themes, aggregated progress signals and aggregated final summaries. Managers do not see private answers.

Facilitators see workshop setup, named completion, dashboard summaries, individual support requests, notes to facilitator, and final responses where the workshop configuration and participant choice allow it. Participant private reflection remains participant-only.

Team-level progress insights are shown from submitted check-ins, while private and unshared content remains protected by the role and sharing rules.

Workshop data is shared only with authorised users in the relevant workspace and with service providers needed to run the platform.

The current processor chain includes Supabase for managed backend data services including database and authentication, Vercel for web hosting and server-side execution, and Brevo for transactional email delivery.

The detailed subprocessor record is maintained by Smart Minds as part of its processor documentation and may be provided through controller-facing contractual materials or supporting compliance records.

Where a service provider processes data outside the EEA, appropriate contractual safeguards such as Standard Contractual Clauses or equivalent mechanisms should be used where required. The relevant arrangement depends on the active vendor agreement and deployment setup.

Workshop records should be kept only as long as necessary for the workshop purpose, contractual obligations and applicable legal requirements.

Different record types may have different retention periods because they support different purposes, for example workflow delivery, follow-up reporting, reminder history, support, security and auditability.

Removal of workspace access or an account-deletion request does not automatically require immediate erasure of all workshop records. Relevant records may need to be retained for programme integrity, contractual obligations, auditability or applicable law until the approved retention period expires.

Depending on applicable law, you may have rights of access, rectification, erasure, restriction, portability and objection, as well as the right to complain to a competent supervisory authority.

Because workshop data is normally controlled by the client organisation, rights requests should usually be directed to that organisation first. Smart Minds may assist the organisation operationally as processor.

WCT uses HTTPS/TLS, Supabase Auth, role-based access checks, row-level security, workspace scoping, controlled server-side privileged access, essential secure-session cookies, notification controls, and audit logs.

Access is limited according to workspace role and workshop function, and key operational actions are traceable through system records used for security, auditability and compliance support.

These measures reduce risk and support accountability, but no digital system should be described as absolutely risk-free.

WCT is not designed to make solely automated decisions that produce legal effects or similarly significant effects on individuals. It supports workflow, reporting and development activity decided and interpreted by authorised human users.

For platform support, contact platforms@smart-minds.space. For workshop privacy questions, contact the organisation that invited you to the workshop.

If you are in Bulgaria or the Bulgarian authority is otherwise relevant to your case, you may contact the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, https://www.cpdp.bg/.