Board evaluation privacy statement

Who holds your information

The Board Evaluation Platform (the Platform) is operated by Agends Advisory Pty Ltd ABN 43 688 073 127 (Agends Advisory, we, us). We hold the information collected through the Platform on behalf of the organisation that has engaged us, named in your invitation (the Organisation), which has engaged us to run this evaluation of its board. Questions about this statement go to info@agends.com.au.

The Organisation has its own obligations to you as a director, and this statement does not describe them.

What we collect

We collect your name, email address, role on the board, appointment date and expected retirement or rotation date. The Organisation's company secretary or coordinator enters these when you are added to the evaluation.

We collect your answers to the questions in each part of the evaluation you complete, including free-text comments. For the skills part we also collect the background you choose to give about your qualifications, professional memberships, governance education and other board and advisory roles.

If you are the company secretary, we collect the factual return you complete about the board: meetings held, timing of papers, attendance by director and the standing of governance documents. Attendance figures are recorded against each director by name.

We keep technical records of when your invitation link was issued and first opened, and when each part was saved and submitted.

We do not collect demographic information of any kind. We do not ask your age, gender, cultural background or any other characteristic, and there is no field in which to record one.

You are not obliged to answer any question. Most scored questions in the confidential part carry the option "I have no basis to judge this", the remainder offer "I am not aware of one" as an answer on the scale, and free-text questions may be left blank. If you choose not to take part, tell the company secretary. Nothing is recorded against you and the board's results are reported without you.

Why we collect it

We collect your information to run the evaluation the Organisation has commissioned: to put the questions to the right people, to hold your answers until the part is submitted, to compile the results into a report for the Organisation, and to keep a record of what was asked and answered so that a later evaluation can be compared with this one.

We also use it to prepare the report with the assistance of a language model. The section on artificial intelligence below describes exactly what the model receives.

Once your answers have been de-identified as described below, the Organisation has consented to their inclusion in an aggregate of results from all organisations that use the Platform, from which the Organisation's name has also been removed. The aggregate is used to show boards how their results compare with others. No figure is reported from a group of fewer than ten organisations, and no free-text comment, individual director assessment or skills background enters the aggregate.

Who sees what

The evaluation has up to three parts, and they are treated differently. The invitation and the Platform tell you which part you are in before you answer anything.

Board and director performance

This part is confidential. Your individual answers are not disclosed to the board, to the chair or to the Organisation. Results are reported for the board as a whole. We do not report a figure, average or range for a group of respondents so small that an individual answer could be read from it, and no result is broken down by role, tenure or any other characteristic. Your free-text comments may be quoted in the report, but only after we have removed anything that would identify you. A comment that could not be quoted without identifying you is described in general terms instead. Your raw answers are seen only by the people at Agends Advisory who prepare the report.

On a small board, or where few directors respond, a reader who knows the board may still be able to infer who said what from the pattern of answers. We cannot remove that risk entirely and we do not promise to.

Board skills self-assessment

This part is attributed. Your name appears against your answers in the board skills matrix, because the purpose of the matrix is to show who holds which capability. Your background answers are attributed in the same way. The confidentiality that applies to the performance part does not apply here.

Individual director assessment

Where this part is used, the chair completes it about each other director, and every other director completes it about the chair. Answers about you go to you and to the chair. They are not reported to the board and do not appear in the board report. Answers about the chair go to the chair and to the deputy chair.

The company secretary's return

The figures in the company secretary's return, including your attendance, are the Organisation's own records. They are reported beside what directors said about the same matters.

How we use artificial intelligence

We use a language model supplied by Anthropic PBC to help us select questions, to map earlier evaluations onto the current questions, and to help draft the interpretation and report.

Before anything is sent to the model, every name and email address the Platform holds is removed and replaced with a placeholder such as "the chair" or "Director A". The model never receives your name, your email address or the name of any other participant. It receives de-identified answers and the Organisation's name. The Organisation's name is retained because the model needs to know which organisation it is reasoning about. If you are the sole holder of an office at a named organisation, the placeholder for that office is not anonymous to a reader who knows the organisation, and we treat model outputs about office holders on that footing.

The model's supplier processes the information it receives in the United States. We use the service under Anthropic's Commercial Terms of Service, under which the supplier does not use what we send to train its models and retains it for no longer than thirty days, for the purpose of detecting misuse, before deleting it.

The model proposes and a person decides. No result, finding or recommendation reaches a report without a person at Agends Advisory reviewing it against the underlying answers. The model makes no decision that affects you.

Free-text comments are the one place where de-identification cannot be complete. If you name a third party in a comment, or describe an event in a way that identifies you, the model may receive that text. Write comments as you would want them read.

Where your information is held

The Platform and its database run on a server in Sydney, Australia, operated for us by DigitalOcean LLC. Apart from the model supplier described above, we do not disclose your information overseas.

How long we keep it

We keep your answers in identifiable form until the Organisation asks us to delete them, so that the Organisation's next evaluation can be compared with this one and so that we can answer a later question about how a result was reached. The Organisation may ask for deletion at any time, and it follows within thirty days. The Organisation may instead choose automatic deletion a set number of years after an evaluation closes. Deletion removes your name, email address, written comments and skills background and keeps only de-identified results.

Your invitation link is a secret. Once you have first opened it we store only a one-way hash of it, so that no one at Agends Advisory can retrieve or use your link after that point.

Security

Access to the Platform's administration is limited to Agends Advisory staff who work on the evaluation, through a password-protected administrator account. Each organisation's information is held behind an organisation scope in the database, and no query, report or model call crosses from one organisation to another. Nightly backups are encrypted, kept on the same server for thirty days and then deleted.

Access and correction

You may ask to see the information we hold about you and to have it corrected. For the confidential part, we will give you your own answers and nothing about any other person. Once a part has been submitted it is locked. A correction after submission is made by recording the change beside the original rather than by altering it, so that the report can state what was answered and when.

Requests go to info@agends.com.au. We respond within thirty days.

Complaints

If you think we have handled your information in a way that does not meet this statement or the Australian Privacy Principles, write to info@agends.com.au. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner.

Changes

We may revise this statement between evaluations. The version that applies to an evaluation is the one given to you with the invitation, and a change is never applied to information already collected without telling you.