Privacy

1. Controller

Stiven Janaqi
Rruga Egnatia, Pallati Kantierit, Lagjja Nr. 3
2001 Durrës, Albania
Email: contact@stivencatalyst.com

2. Hosting

This website is served through GitHub Pages (GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you open its pages, GitHub processes technically necessary data, in particular the IP address, the date and time of access and details of the browser and operating system, in order to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and stable provision of the website. Transfers to the USA rest on the EU-US Data Privacy Framework, of which GitHub is a member. More information: GitHub privacy statement.

3. No cookies, only a script for anonymous visit counts

This website sets no cookies and, apart from the script for anonymous visit counts described below, uses no analytics or tracking services. Fonts are loaded from this site itself, without Google Fonts or any other external font service. The other external services, and when they are used, are described below. Only when you subscribe to the newsletter is your email address sent to the newsletter service (section 5).

Visit counts: the pages of this site, except the tools and the role pages, load a small script of Cloudflare Web Analytics by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Its purpose is to count how many people read the texts and where they come from. It sets no cookies, stores nothing in your browser and builds no profiles; it is built to send only details of the page view, such as the page opened, the referring page, browser, device type and loading time, from which Cloudflare is to form aggregate figures (for example views per page and country). Your IP address is transmitted technically but, according to Cloudflare, not used to recognise individual visitors. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is a simple measurement of readership without following people. Transfers to the USA rest on the EU-US Data Privacy Framework, of which Cloudflare is a member. More information: Cloudflare Web Analytics, Cloudflare privacy policy.

Some features keep what you type only in your own browser (local storage), so that it is still there after the page is reloaded, among them: the choice between the light and the dark theme, whether you paused the motion and whether floor mode is on, the 5 Whys worksheet, the logs in Damage Control, Incomplete Control and Delay Analyzer, the shift handover with its history, the days of the control chart, the answers, checklists and project charter in the course “Six Sigma in the Warehouse”, the data in the Pareto tool (80/20), the tables, targets and actions in the Last-Mile CX Control Tower, the CV in the CV Builder including the photos and logos you upload there, the ATS CV, and the cover letter including photo and signature. Photos you add as evidence (in the 5S Audit, the Safety Cross, Room Inspection, the Maintenance Planner and the Spaghetti Diagram, or with “Add photo” in other tools) are made smaller on your device and kept in your browser's IndexedDB. Some tools let you note other people's data: guest names in Lost & Found and Guest Complaints, employee names in the Skills Matrix and Shift Capacity. They stay in your browser like the rest of your work, and Lost & Found and Guest Complaints ask you to remove them once the case is closed. On your first visit the site also notes in your browser, for each section of the menu, a short code for its current content, so that it can later mark what is new there; nothing is sent for this. When you read the essays and reflections, the site remembers in your browser which ones you have read to the end and how far you got in each, so that the lists can mark what you have read and offer to continue. If you have an essay read aloud, your browser also keeps the reading speed you chose. The reading itself is done by a voice of your browser or operating system; this site records and sends nothing for it, but where a browser has no voice of its own on the device it may use an online voice of its maker (for example Google or Microsoft): it then sends the text to that maker to be spoken, under that maker's privacy policy. The note under the player says which kind of voice reads, and a voice on the device is used first. The bookmark on an essay or a tool keeps it on “My shelf” in your browser, and a checklist you tick off or fill in keeps its state, so you can come back to it. The coaching workspace, too, keeps the chosen work context, projects, exercises, reflections, actions and evidence only in your browser. You export coaching backups yourself; there is no automatic account synchronisation, and coaching is never part of team sync. With “Save all my work” you save the data of every tool yourself as a file on your device; when you open such a file, it is read only in your browser and not uploaded. So that nothing is lost, the site also keeps restore points of your work in your browser's IndexedDB (at most one a day; while you work, at most one every quarter of an hour if the work has changed; one before such a file is opened, one before a restore point is brought back, one before team sync writes the team's work, one when the tools are unlocked with the PIN and something was written while they were locked (below), and one whenever you ask; only the most recent of each kind are kept and older ones are deleted automatically) and asks the browser not to clear this data when space runs low; these, too, stay on your device. So that the tools also work without a connection, a tool page installs this site's service worker, which keeps copies of this site's own pages and files in your browser's cache, and none of your work. None of this data is sent to me or to third parties, and it leaves your device only when you export, copy or print it yourself, or share it, encrypted, with your team through team sync (below). For the storage you start yourself (what you type or save in a tool, a bookmark, a checklist, a lock with the PIN and the restore points of that work) I rely on Section 25(2) no. 2 TDDDG, the German data protection act for digital services: storage strictly necessary for a feature you expressly asked for. Without any action of yours, the site writes the marks of what is new in the menu and how far you have read the essays and reflections, and on a tool page the service worker keeps copies of this site's pages. This data, too, stays on your device and is not sent; you can delete it in your browser's settings. What you type in the KPI Diagnostic is not stored. You can remove stored data at any time with the delete button in the tool concerned or in your browser's settings.

Reminders in the Action Tracker: when you switch on “Remind me of due actions on this device” there, your browser asks once whether this site may show notifications – only after that click, never by itself. After that the browser keeps in its IndexedDB that reminders are on, the day of the last reminder, their wording and a short summary of the open actions (how many are due on which day and the titles of the three due soonest). From it your device shows at most one notification a day or, where notifications are blocked, a note at the top of the page; in an installed app the site's service worker can do so without a page open. Nothing is sent or fetched for the reminders: they are made entirely on your device, and the notification is shown by your browser or operating system. The summary is not part of a saved file, a restore point or team sync; switching the reminders off deletes it.

A PIN for a shared computer: in the box “All your work in one file” you can lock the tools with a PIN. The work of every tool, the restore points and the photos are then encrypted on your device with a key made from the PIN (PBKDF2, AES-GCM) and kept as one record in your browser's IndexedDB; the plain copies are removed. The PIN itself is kept nowhere. After an unlock (or a lock with the PIN typed) the key stays in that tab's session storage, so the tab can lock again without the PIN; it is gone when the tab is closed. If something was written on a page without the lock while the tools were locked, it is kept as a restore point when you unlock. Nothing is sent for any of this. The lock protects against a colleague at the same desk, not against someone who can read the browser's storage while the tools are open.

CV import in the ATS CV: when you open a PDF or Word file there, it is read only in your browser and not uploaded. The reader needed for PDF files (pdf.js) is loaded from this server, not from third parties.

Pareto 80/20 and Last-Mile CX Control Tower: CSV and Excel files you open there are likewise read only in your browser and not uploaded. When you hand data from Damage Control, Incomplete Control, Delay Analyzer or the Control Tower to the Pareto tool, this happens through your browser's session storage, which is cleared when the tab is closed.

Company logos in the CV Builder: when you type a company's website there, your browser loads that company's logo through Google's icon service (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google receives the web address you typed and technically necessary data such as your IP address and browser details. Your name and the rest of your CV are not sent. The request happens only when you type a website yourself; without one, or with a logo you uploaded, no connection is made. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is providing the logo lookup you asked for. Transfers to the USA rest on the EU-US Data Privacy Framework, of which Google is a member. More information: Google privacy policy.

Team sync: under every tool and on the Tools page, in the box “All your work in one file”, you can start a team or join one. Until you do, team sync is off and nothing is sent. After that your browser sends only the work of the tools you tick there (such as the Action Tracker, the workplace profile and the logs; never the career tools, your shelf, your reading or coaching), with a random device id and the device name you may give. This data is first encrypted on your device (AES-GCM) with a key made from the team code; the code itself never leaves your device. The encrypted copy is kept by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) in Cloudflare Workers and Durable Objects, in data centres in the EU or, as Cloudflare chooses, in other regions. The server sees only encrypted data, a version number and the IP address of the request, which is sent for technical reasons; it cannot read the work, and there is no tracking. The copy stays until someone of the team deletes it in the same box (“Delete the team's copy”), or is deleted by itself 180 days after the last sync. The legal basis is Art. 6(1)(b) GDPR (the feature you asked for); a transfer to the USA takes place under the EU-US Data Privacy Framework, which Cloudflare has joined. More: Cloudflare's privacy policy.

Read-only codes and a new team code: a device of a team can make a read-only code. It holds the address of the team's copy and the key to read it, but not the permission to write; the six words of the team code are not in it. A device that joins with a read-only code only downloads the encrypted copy and sends nothing, not even a device id; as with every request, the server sees its IP address. When someone of the team changes the team code, that device uploads the team's work, encrypted with the key of the new code, as a new copy and then deletes the old copy on the server; the old code and the old read-only codes then no longer work.

4. Contact by email

When you write me an email, I process your details (name, email address, message) only to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted as soon as it is no longer needed for that purpose and no statutory retention duties apply.

5. Newsletter

When you subscribe to the newsletter, I process your email address to send you new posts. Subscription uses double opt-in: you first receive an email in which you confirm the subscription. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in every email.

Stored are your email address, the language of the page you subscribed on, and the time and IP address of the subscription and of the confirmation, so that your consent can be shown. After you unsubscribe, your address is no longer written to.

For sending I use MailerLite (UAB „MailerLite“, Vilnius). A data processing agreement under Art. 28 GDPR is in place with the provider. The provider may record whether an email is opened and which links in it are clicked; this serves only to improve the newsletter and falls under the same consent.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw a consent you have given at any time with effect for the future. You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence or place of work (Art. 77 GDPR).