This notice explains what information RethinkSM Ltd collects when you use rethinksm.com, including our free ITSM assessments, and what we do with it. We have tried to keep it short and plain.
Last updated: 25 October 2026
In short
- You can use our assessments without creating an account or giving us your name or email address.
- Your results are shown on screen straight away. If you download a PDF, it is created in your own browser and is not sent to us.
- We don’t use advertising or analytics cookies, and we don’t sell your information.
- If you contact us, we use what you send us to reply to you.
Who we are
RethinkSM Ltd is the controller of the personal information described in this notice. We are a private limited company registered in England and Wales.
- Company number: 17462882
- Registered office: 66 Paul Street, London, EC2A 4NA
- Contact: contact@rethinksm.com
We are a small company and have not appointed a data protection officer. Please send any privacy question or request to the email address above.
What we collect and why
| What you do | What we collect | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Visit our website | Your IP address, the date and time, the page you asked for, the referring page, and your browser and device type. This is recorded automatically in our web server’s access logs. | To deliver the website, keep it secure and fix problems | Legitimate interests: running a secure, working website | About one to two months, after which the logs are deleted automatically |
| Complete an assessment or use the savings calculator | The answers you choose (or the numbers you enter in the calculator), the results we calculate, the assessment version and the date. There are no free-text boxes, and we don’t ask for your name, email address or employer. | To calculate and show your results, let you return to them, and improve our assessments using overall statistics | Legitimate interests: providing the assessments you ask for and improving them | 24 months, then deleted |
| Arrive at an assessment from another site or a campaign | The page you completed the assessment on, the domain of the website that referred you (not the full address), and any campaign tags in the link (source, medium and campaign) | To understand which pages and campaigns people find useful | Legitimate interests: understanding how our website is found and used | Kept with the assessment result (24 months) |
| Submit an assessment | A security code made from your IP address using a secret key and a one-way process. We do not store your IP address itself with your results. | To stop automated abuse, limit repeated submissions and spot duplicates | Legitimate interests: protecting the website and the quality of our data | Removed from your result after 30 days. Short-term rate-limiting records are deleted within two days. |
| Get your results | A private results link. We store only a scrambled (hashed) version of it, so we cannot recreate your link. | To let you return to your results | Legitimate interests: providing the service you asked for | The link works for 90 days |
| Contact us by email, phone or WhatsApp | Your name and contact details, your organisation and job title if you give them, and what you tell us | To reply to your enquiry and, if you ask, discuss how we might work together | Legitimate interests: responding to business enquiries. If you ask about our services, we may also rely on taking steps at your request before entering into a contract. | 12 months after our last contact, unless we go on to work together, in which case we will tell you how we handle your information |
About your results link. Anyone who has your results link can see those results. Please share it only with people you want to see them. Your results do not contain your name or contact details.
About the PDF. The PDF of your results is created on your own device by your browser. It is not sent to or stored by us.
About automated scoring. Your scores are calculated automatically from your answers. They are self-assessment guidance only and are not used to make any decision about you.
Cookies
Our assessments do not use cookies or any other browser storage. We do not use advertising or analytics cookies. If you are one of our staff and log in to manage the website, WordPress sets the essential cookies needed to keep you signed in.
Fonts
Our website uses the Inter typeface from Google Fonts. To display it, your browser requests the font files from Google’s servers. Google receives your IP address and browser details when it does this. Google’s handling of this information is described in Google’s privacy policy.
Who we share your information with
We do not sell your information or share it for others’ marketing. We use these service providers, who handle information for us under contract:
| Provider | What they do for us |
|---|---|
| GoDaddy | Hosts our website, database and server logs |
| Microsoft | Provides our email (Microsoft 365) |
| Supplies the fonts used on our website (see Fonts above) |
If you message us on WhatsApp, your messages pass through WhatsApp, which is part of Meta. WhatsApp handles them under its own terms and privacy policy.
We may also share information if the law requires it, or with professional advisers such as accountants or lawyers where needed.
International transfers
Our website and assessment data are hosted by GoDaddy in a data centre in the European Economic Area. Some of our providers, including Google, Microsoft and Meta, may process information in the United States or other countries. Where information leaves the UK, we rely on UK adequacy regulations (including the UK–US data bridge for certified companies) or on the data transfer agreements approved for use under UK law.
How we protect your information
- The whole website is served over an encrypted (HTTPS) connection.
- Assessment answers are scored on our server, and the browser receives only the questions.
- Results links and security codes are stored only in scrambled (hashed) form.
- Access to the website’s administration area is limited to authorised staff.
- Information is deleted automatically when its retention period ends.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal information;
- ask us to correct information that is wrong;
- ask us to delete your information;
- ask us to restrict how we use it;
- object to how we use it, including where we rely on legitimate interests; and
- ask for your information in a portable format, where this applies.
To make a request, email contact@rethinksm.com. There is usually no charge, and we will reply within one month.
Because we do not ask for your name when you complete an assessment, we may not be able to find your results unless you send us your results link. If you’d like your assessment results deleted, please include the link in your request.
Complaints
If you are unhappy with how we have handled your information, please contact us first at contact@rethinksm.com. We will acknowledge your complaint within 30 days and keep you updated until it is resolved.
You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Children
Our website and assessments are designed for businesses and IT professionals. They are not aimed at children.
Changes to this notice
We will update this notice if the way we use information changes. The date at the top shows when it was last updated.