Substance / Data access
Visibility, not possession.
Many companies cannot hand over business-critical data. That is not the exception, it is the rule, and it is no reason to do without sound decisions. We work in four clearly separated levels of access.
45 minutes · no obligation · no data release
Our stance
Getting started needs no access. The work needs visibility.
We could promise to get by entirely without your data. That would be convenient and dishonest: evaluation on outcome metrics alone is a crutch, and whoever promises it has to walk it back during the project.
So we say both. Intro call, Readiness Check and the first prioritization run without any access at all. For the actual work we need visibility into your numbers, not possession of them. The data stays where it is. We make it better there and draw the decision from it.
The level model
Four levels. You decide which one applies.
No access
Intro call, Readiness Check and first prioritization. We only see the metrics you name. You review how we work before you release anything.
Aggregated
Extracts at segment level, no individual cases, no personal data. Carries significance calculation, segment analysis and contribution margin logic.
Visibility, not possession
Our recommended setup. We work with your accounts, in your systems, under your logging. Read-only, named individuals, time-limited. No export, no copies, no storage on our side.
Processing on your behalf
Full access on a contractual basis under Article 28 GDPR, with named individuals, documented deletion periods and technical measures. Required as soon as we do not just support systems but operate them.
Plain words
Where the data sits does not decide the contract.
A point that many providers present as friendlier than it is.
Whether a data processing agreement is required does not depend on where the data sits, but on whether personal data is visible. Read-only access to someone else's system already counts as processing in legal terms.
We clarify that up front instead of asserting it. For purely pseudonymous evaluations one is usually not required, with visible personal data always, even if nothing reaches our side.
What that means in practice
Five rules that apply at every level.
| Named individuals | Accounts are issued to names, not to a shared account. You know at all times who can see. |
| Time-limited | Accounts end with the project, not with someone remembering it. We ask for them to be switched off ourselves. |
| Your logging | What we do is in your logs. We work in a way you can retrace. |
| No secondary use | Your data goes into no benchmark, no model training and no publication. |
| No competitor in parallel | We do not work for direct competitors in the same test field at the same time. On request we put that in writing. |
We sign a confidentiality agreement before the first substantive meeting if you want that. Just say so in the intro call.