Terms & Conditions and Privacy Notice

1. Who we are & acceptance of these terms

The iTeam team diagnostic, the iTeam diagnostic quiz and the website at www.iteamformyteam.com (together, the "Service") are operated by Beyond The Gap Proprietary Limited, registration number 2017/261460/07, a company incorporated in the Republic of South Africa, with its registered address at 11 Tintagel Road, West Beach, Milnerton, Western Cape, 7441, South Africa ("BTG", "we", "us").

"Coaching Unity International" is a brand under which the Service is presented, and is not the contracting party. It is a trading style, not a registered entity. Your agreement for the Service is with BTG alone, and every reference in these terms to "we", "us" or "BTG" means Beyond The Gap Proprietary Limited.

By creating an account, starting a diagnostic quiz, joining an assessment session, ticking an acceptance checkbox, or otherwise using the Service, you agree to these Terms & Conditions and to the processing of personal information described in the Privacy Notice contained in sections 7–11. If you do not agree, do not use the Service.

If you are accepting on behalf of a company, team or other organisation, you warrant that you have authority to bind that organisation, and "you" includes that organisation.

2. Definitions

• Coach — a person with an account who creates and manages assessment sessions (including "superusers", administrators, leaders and co-leaders acting in a session-owner capacity).
• Participant — a person who responds to an assessment session, typically via a personal invitation link, without an account.
• Session — a single iTeam assessment run for a team or group.
• Responses — the marker positions and free-text comments submitted in a Session.
• Quiz — the public diagnostic quiz that recommends continuums based on symptoms you select.
• Client Organisation — the company or team on whose behalf a Coach runs Sessions.
• Reports — the on-screen, PDF and PPTX outputs generated from Responses or Quiz answers.

3. The Service

iTeam is a team-diagnostic instrument. It captures where team members believe their team currently stands, and where it needs to stand, on a set of tensions ("continuums"), and produces aggregate Reports designed for facilitated debriefs. The diagnostic Quiz maps observed symptoms to recommended continuums. The Service includes optional AI-assisted content generation (section 13) and optional paid quiz reports and subscriptions (section 6).

The Service provides decision-support information for team development. It is not a psychometric test, a medical or psychological assessment, an employee-evaluation instrument, or a substitute for professional advice. Reports reflect the subjective perceptions of the people who responded, and must not be used as the sole basis for employment decisions about any individual.

4. Accounts & eligibility

• You must provide accurate account information and keep credentials, access codes and invitation links confidential. Anyone using your access code or session links is presumed to act with your authority.
• You must be at least 18 years old to create a Coach account, and at least 16 to participate in a Session or Quiz (see section 11).
• You are responsible for what you invite Participants to do: Coaches must have a lawful basis to invite their team members and must not pressure any person to self-identify within anonymous Responses.
• We may suspend accounts that compromise the security, integrity or lawful operation of the Service (section 16).

5. Acceptable use

You must not:

• attempt to re-identify anonymised Respondents, including by cross-referencing completion data, writing style or timing;
• probe, scan, overload or test the vulnerability of the Service, circumvent rate limits, tokens or entitlement checks, or access data belonging to another account;
• submit content that is unlawful, defamatory, harassing or that infringes any third party's rights, or upload malicious code;
• use the Service to send unsolicited communications, or trigger invitation/reminder emails to people who have not agreed to take part;
• scrape, resell, sublicense or white-label the Service or its content without our written agreement;
• use Reports to take adverse action against an individual on the basis of a presumed identity behind an anonymous Response.

6. Fees & purchases

• The Service is currently in advanced testing. Access is provided at no charge for the duration of that testing, and no payment is taken from you: paid quiz reports and subscriptions are not yet available for purchase, and we do not currently engage a payment provider or receive card details of any kind.
• When paid plans are introduced, prices will be shown at the point of purchase, each price will state whether it is inclusive or exclusive of VAT and similar taxes, and this section and the provider list in 7.4 will be updated to name the payment provider before any charge is possible. We will not store full card details.
• Subscriptions will grant access for the stated period and end on expiry or cancellation; purchased reports remain accessible under your entitlement. Prices may change prospectively.
• Except where required by law (including statutory cooling-off rights that apply in your country), fees are non-refundable once the purchased report or access has been delivered.

7. Data protection & privacy

This section, together with sections 8–11, is our Privacy Notice. It applies to Coaches, Participants, Quiz users and website visitors.

7.1 What we collect and why

7.2 Anonymity by design

Session Responses are engineered to be anonymous at the data layer: your email tracks whether you completed, never what you answered. Responses are keyed to a session token that is not linked to your identity in Reports. Two honest caveats:

• If you write something in a free-text comment that identifies you, readers of the Report may recognise you. Anonymity of comments is yours to keep or give away.
• Leaders, co-leaders and coaches may hold named roles in a Session; their positions can be displayed as named markers only through explicit reveal controls designed for that purpose.
• In very small teams, aggregate data can be easier to attribute. Because anonymity here is a property of the data layer and not a defence against inference, a Report drawn from very few Responses can allow a reader to work out who said what. To limit that, written comments are withheld entirely until at least three people have responded — scores and averages are still shown, the wording is not, and this applies to everyone who opens the Report, including the Coach who owns it. Above that threshold, Coaches should still consider team size when interpreting Reports, and section 5 prohibits attempts at re-identification.

7.3 Use of data to improve our models

Specifically, we may use:

• Response distributions and scores (marker positions, gaps, splits) in aggregated or de-identified form, to calibrate scoring thresholds, split-detection rules and report interpretations;
• Quiz selections and outcomes (which symptoms co-occur, which recommendations follow) to improve the symptom taxonomy and recommendation logic;
• Free-text comments, in de-identified form, to improve question wording, placeholder guidance and — where AI-assisted features are used — the quality of generated content.

Where this processing relies on your consent (for example, under the GDPR where consent is the appropriate basis), we ask for it at the point you first use the Service — such as the acceptance checkbox when you start a Quiz — and you may withdraw it at any time by contacting privacy@iteamformyteam.com. Withdrawal stops future use of your identifiable data for model improvement; it does not un-train improvements already derived from data that was de-identified or aggregated before withdrawal, and it does not affect processing needed to deliver the Service itself.

We do not use Participant emails or names to improve models, and we do not permit third parties to train their own models on your identifiable data.

What we actually do today. The rights above are reserved, not exercised. We do not currently operate any automated process that extracts Response values or free-text comments across Sessions for these purposes, and the scoring thresholds and split-detection rules in the Service are fixed values set by us — they are not fitted to customer data. If that changes, this notice will be updated first, and the controls in the paragraph below will apply.

Client Organisations under a written agreement. Where a Client Organisation engages us under a signed agreement, that agreement prevails over this section. Such Sessions are treated as service delivery only by default: their Response statistics and their free-text comments are used solely to deliver that Client Organisation's own Reports, and for no other purpose. Secondary use of either applies only where it is expressly agreed in writing, and the two may be agreed independently of each other. Where an agreement requires us to destroy a Client Organisation's information on termination, we will do so and certify it in writing on request.

7.4 Service providers (sub-processors)

Your Session and Quiz records — every response, comment and account — are stored and processed inside the European Union, on the database and application hosts named above. One narrow exception leaves it, and it is in the table: where a Coach initiates AI content generation, that request goes to a provider in the United States using the Coach's own key, carrying no Participant responses, comments or contact details. Two further cases are named for completeness, although neither moves those records outside the European Union. Email we send you — an invitation, a reminder, an account message — is delivered by a provider whose sending infrastructure and message records are in the European Union (Ireland), so the recipient's name, email address and the link itself pass through it there; that provider is a United States company, and its personnel may access data in the course of providing the service, which is a form of access rather than a transfer of storage. And the app's own files — its scripts, styles and images — are delivered over a content-delivery network with locations worldwide, so the request for them may be handled outside the EU and your IP address seen there. No Session, Quiz or account data travels that path; everything that carries such data goes to our API in Frankfurt. Nothing else is transferred, and transfers are covered by the safeguards in 8.3 and 9. The providers above are the complete list; we engage no payment processor, and no advertising, analytics or tracking provider of any kind. The usage analytics described in 7.1 and 7.8 are entirely first-party: they are recorded by our own API and stored in our own database, and no third party receives them. Each provider processes personal information under contractual terms consistent with this notice, and we will update this list before any new provider begins processing.

7.5 Retention & deletion

• Session data is retained while the owning Coach account remains active, so historic Reports keep working. Sessions marked ephemeral are deleted on reset. Coaches may delete sessions at any time; deletion removes the session's Responses. Where a written agreement with a Client Organisation requires its information to be destroyed — for example on termination — that requirement prevails over this retention period, and any of its Reports that depend on the destroyed data will stop working.
• Administrative removal. Separately from the deletion a Coach performs, we operate an internal facility that first marks an account, Session, team or quiz record for removal and clears it permanently in a second, deliberate step. A record in that state is not visible in the Service but is recoverable by us until it is cleared, and there is no automatic schedule that clears it. Where we have undertaken to destroy information by a given date, we clear it rather than leave it marked, and can certify that in writing on request.
• Quiz results are retained while your quiz identity or linked account remains active, so purchased reports remain accessible.
• Account data is deleted or de-identified within 90 days of a verified account-deletion request, except records we must keep for legal, accounting or dispute purposes.
• Technical logs are retained for 12 months for security purposes.
• De-identified and aggregated data (7.3) may be retained indefinitely; it no longer identifies you.

7.6 Security

We apply proportionate technical and organisational measures, including: encrypted transport (HTTPS); hashing of passwords; encryption of stored API keys; signed, session-scoped role tokens; per-identity access scoping on every read and write; rate limiting and abuse caps on public endpoints; audit logging of sensitive actions; and anonymity-by-design separation of completion tracking from Response content. No system is perfectly secure; if we become aware of a breach affecting your personal information we will notify you and the relevant authorities as required by law (GDPR arts. 33–34; POPIA s22).

7.7 Our role: controller / responsible party — or processor / operator

• For Coach accounts, the Quiz, purchases and the website, BTG determines the purposes of processing and acts as the controller (GDPR) / responsible party (POPIA).
• For Sessions run by a Client Organisation, the Client Organisation typically determines why its team is assessed and is the controller/responsible party for Participant contact data and Responses; BTG acts as its processor/operator, processing only to provide the Service and as described in this notice (including 7.3). Coaches warrant that they have the authority and lawful basis to submit Participant data.

7.8 Cookies, browser storage and analytics

We set no cookies. The Service and this website do not use cookies for advertising, tracking or measurement, and we do not operate a third-party analytics or advertising tag of any kind. There is therefore no advertising or tracking consent to give or withdraw.

We do use your browser's own storage for the Service to function:

• Session storage (cleared when you close the tab) holds your sign-in token for code-based access, your anonymous Participant token, and any draft answers you have not yet submitted — so a refresh or a locked phone does not lose your work.
• Local storage holds the sign-in session created by our authentication provider (Supabase, 7.4), so you are not asked to sign in on every visit.

Neither is used to build a profile of you or to follow you across other websites, and neither leaves your browser except to authenticate you to us.

First-party usage analytics. We record page views on our public website and within the Service, as described in 7.1. This happens on our own servers from the ordinary request — there is no tracking script, no analytics SDK, and no identifier stored on your device for it. Visitors are counted using a pseudonym derived from your IP address and browser with a secret that changes every day, so the same person cannot be recognised from one day to the next, and your raw IP address is not stored against these records. Your browser's user-agent is reduced to coarse categories — device type, browser family and operating system — and is not stored in full. Approximate country comes from a two-letter code our hosting provider attaches at the network edge; we do not run any IP-geolocation lookup. Query strings are removed before storage, because access links carry tokens in them, and identifiers inside a web address are replaced before it is stored. These records are deleted after twelve months (7.5).

Two analytics events are not anonymous. When a Coach signs in, and when an activation email is re-sent, we record that event against your account, not anonymously: the record carries your internal account reference so that sign-in activity can be attributed to the right account. It never carries your email address. Everything else described above is pseudonymous. Our lawful basis for all of it is legitimate interests (8.1); you may object at privacy@iteamformyteam.com.

None of this is shared with, or sent to, any analytics or advertising company. The only third parties involved are the hosting and database providers already listed in 7.4, which process these records because they run our servers.

8. European Economic Area & United Kingdom — GDPR

If you are in the EEA or the UK, the EU General Data Protection Regulation or UK GDPR applies. This section supplements section 7.

8.1 Lawful bases

8.2 Your rights

You may request: access to your personal data; rectification; erasure; restriction of processing; portability; and you may object to processing based on legitimate interests, withdraw consent at any time (without affecting prior processing), and lodge a complaint with your supervisory authority (in the UK, the ICO). Where BTG is processor, we will refer your request to the Client Organisation as controller and assist it in responding. Contact: privacy@iteamformyteam.com. We respond within one month, extendable as the GDPR allows.

8.3 International transfers

Where personal data is transferred outside the EEA/UK (see 7.4), we rely on adequacy decisions where available and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA), with supplementary measures where appropriate. A copy of the relevant safeguards is available on request.

8.4 Automated decision-making

The Service scores and aggregates responses and recommends continuums algorithmically, but it does not make decisions producing legal or similarly significant effects about you without human involvement. Reports are inputs to human-led conversations.

9. South Africa — POPIA

If you are in South Africa, the Protection of Personal Information Act 4 of 2013 (POPIA) applies. This section supplements section 7.

• Responsible party: Beyond The Gap Proprietary Limited (see section 1). Where a Client Organisation runs a Session, it is the responsible party and BTG is its operator under s20–21, processing under this notice as the written contract contemplated by s21(1).
• Information Officer: Tim Goodenough, reachable at privacy@iteamformyteam.com or at the registered address in section 1. The Information Officer is designated under section 56 of POPIA and carries the duties in section 55, including dealing with requests made under this notice and under PAIA. Registration of the Information Officer with the Information Regulator is made through the Regulator's registration facility in accordance with its regulations. Your rights under POPIA, and your right to complain to the Regulator set out below, do not depend on that registration.
• Processing grounds (s11): we process personal information with your consent; because it is necessary to perform a contract with you; to comply with law; or in pursuit of our or your legitimate interests, as set out in section 7. Model-improvement processing of identifiable information (7.3) is conducted with consent, or on de-identified information which falls outside POPIA once it can no longer be linked to you.
• Your rights (s23–25, s5): to be notified of collection; to access and correct your personal information; to object to processing; to withdraw consent; and not to be subject to unlawful direct marketing (s69 — we send marketing only with consent or to existing customers with an opt-out).
• Cross-border transfers (s72): some providers in 7.4 are outside South Africa. We transfer only where the recipient is bound by contractual terms providing an adequate level of protection substantially similar to POPIA's conditions, or with your consent, or as otherwise permitted by s72.
• Complaints: you may complain to the Information Regulator (South Africa) — inforeg@justice.gov.za / www.inforegulator.org.za — though we would welcome the chance to resolve the matter first via privacy@iteamformyteam.com.
• PAIA: our access-to-information manual under the Promotion of Access to Information Act is available free of charge on request from the Information Officer at privacy@iteamformyteam.com.

10. Rest of the world

Wherever you are, we apply the standards in section 7 as our baseline. In addition:

• United States: we do not "sell" or "share" personal information as defined by the California Consumer Privacy Act (CCPA/CPRA). California residents may exercise access, deletion and correction rights via privacy@iteamformyteam.com; we do not discriminate for exercising them.
• Other jurisdictions (including, for example, Australia's Privacy Act, Canada's PIPEDA, Brazil's LGPD): we honour access, correction and deletion requests, and rely on consent or contractual necessity consistent with local law. If local law grants you stronger rights than this notice, those rights prevail.

11. Children

The Service is a workplace and sports-team instrument. It is not directed at children. Coach accounts require you to be 18+. Participants and Quiz users must be 16+ (or the higher age your local law sets for consenting to data processing); where a Session involves a sports squad including minors, the Client Organisation is responsible for obtaining the consent of a competent person (POPIA s34–35; GDPR art. 8) before inviting them.

12. Intellectual property & report confidentiality

• The Service — including the continuum frameworks, question sets, taxonomy, software, designs and generated Report formats — is owned by BTG or its licensors. We grant you a limited, non-exclusive, non-transferable licence to use it for your internal team-development purposes.
• You retain ownership of the content you submit (comments, custom continuums, team data). You grant us the licence needed to operate the Service and the rights described in 7.3.
• Reports contain candid, anonymous input from real people. You agree to treat Reports as confidential within the Client Organisation and to share them only with people who need them for the debrief purpose.
• Feedback you send us about the Service may be used without restriction or compensation.

13. AI-assisted features

• What these features generate. Chiefly, simulated Participant responses: so that a Coach can preview the format and style of a Report before running a live Session, the Service can generate a set of fictional respondents for a continuum. The marker positions themselves are produced locally by the Service without any AI involvement; a third-party AI model is used to write the accompanying commentary in a plausible voice. Simulated responses are synthetic. They are not derived from, and do not contain, any real Participant's data. A Coach may also ask a model to classify existing continuum content.
• Whose key, and what leaves the Service. These features run only when a Coach initiates them, and only using an API key that Coach supplies; the key is stored encrypted and used solely for that Coach's own requests. The Service does not send Participant Responses, free-text comments or contact details to an AI provider.
• AI-generated content can be inaccurate or inappropriate. Coaches must review generated content before using it in a live Session.
• Coaches must not paste Participant information into a prompt. Anything a Coach submits to an AI feature is processed by the model provider under its terms. The Service cannot inspect what a Coach types, so this is an obligation on the Coach, not a control we can enforce: do not include Participant personal information, Responses or comments in AI prompts.

14. Disclaimers & limitation of liability

The Service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all warranties, express or implied, including fitness for a particular purpose; we do not warrant that the Service will be uninterrupted, error-free or that Reports are suitable for any specific decision.

To the maximum extent permitted by law: (a) we are not liable for indirect, incidental, special or consequential loss, loss of profits, or loss of data; (b) our total aggregate liability arising out of the Service in any 12-month period is limited to the greater of the fees you paid us in that period and ZAR 25,000. Nothing in these terms limits liability that cannot lawfully be limited (including under the South African Consumer Protection Act where it applies, or liability for fraud).

15. Indemnity

You indemnify us against claims arising from: your breach of these terms; Participant data you submit without a lawful basis; your misuse of Reports (including attempted re-identification or adverse action against individuals); and content you submit that infringes another's rights — except to the extent a claim results from our own breach of these terms or of applicable data-protection law.

16. Suspension & termination

• You may stop using the Service at any time and may request account deletion (see 7.5).
• We may suspend or terminate access immediately for material breach (especially of sections 5 and 7), for security reasons, or where required by law; where practicable we will give notice and an opportunity to export your Reports.
• Sections that by nature survive termination (7–11, 12, 14, 15, 18) survive.

17. Changes to these terms

We may update these terms and this Privacy Notice. Material changes will be notified — by email to account holders, or by prominent notice in the Service — at least 14 days before they take effect, and the version and effective date above will change. Continued use after the effective date is acceptance. If a change requires fresh consent under applicable law (for example, a new use of identifiable data), we will ask for it rather than assume it.

18. Governing law & disputes

These terms are governed by the laws of the Republic of South Africa, and the Western Cape Division of the High Court of South Africa, Cape Town has non-exclusive jurisdiction, without depriving consumers of mandatory protections or forum rights granted by the law of their country of residence. Nothing in this section limits your right to complain to a data-protection authority (sections 8.2 and 9).

19. Contact

Privacy requests and questions: privacy@iteamformyteam.com
General support: support@iteamformyteam.com
Postal: Beyond The Gap Proprietary Limited, 11 Tintagel Road, West Beach, Milnerton, Western Cape, 7441, South Africa (for the attention of the Information Officer)

When you contact us about a privacy right, we may need to verify your identity before acting; for Session Responses, remember that we deliberately cannot link anonymous Responses back to you (7.2) — which also means we cannot retrieve or delete "your" individual Response from within a team's anonymous data set.