Leadership Mosaic 360 — Privacy Notice

Leadership Mosaic 360 — Privacy Notice

Version 2.0 · Effective Date: July 1, 2026

This Privacy Notice describes how gothamCulture LLC handles personal data in connection with the Leadership Mosaic 360 (the “Mosaic”). It supplements — and should be read together with — the main gothamCulture Privacy Policy at https://gothamculture.com/privacy-policy/.

1. Who we are

gothamCulture LLC (“gothamCulture,” “we,” or “us”), located at 115 Broadway, 5th Floor, New York, NY 10006, is the data controller for personal data processed in connection with the Leadership Mosaic 360. Contact: privacy@gothamculture.com.

2. What we collect

• Your name and email address (to deliver your survey link and report).
• Your raters’ names and email addresses (same purpose — you provide these when you invite raters).
• Your survey rating responses.
• Your raters’ rating responses and any open-text comments they provide.
• Technical and consent-log data: IP address, browser language, user agent, jurisdiction (inferred from IP), and the timestamp/version of each consent decision.

We do not collect demographic information through the Mosaic — no industry, role level, organization, country, function, tenure, age, or gender. We deliberately exclude these fields from the survey instrument.

3. How we use it

• Your name and email — to deliver your survey link, send invitations to your raters, and deliver your final PDF report. Used during Phase 1 only (the 60-day identifiable processing window).
• Rater names and emails — same purpose; used during Phase 1 only.
• Ratings — used to generate your individualized report during Phase 1. After Phase 1 transformation, ratings may be retained in de-identified form in our research database for research and instrument improvement.
• Open-text rater comments — surfaced in your report only. Never included in the research database.
• Technical / consent-log data — used to demonstrate compliance with applicable law (GDPR, CCPA, etc.) and to enforce sanctions / geographic restrictions.

4. Legal basis (GDPR users)

• Primary processing of your data to deliver the Mosaic — contract performance (Article 6(1)(b)).
• De-identified research database — legitimate interests in scientific research and product improvement (Article 6(1)(f)), with the safeguards of Articles 17(3)(d) and 89 (research-purposes exception).
• Inclusion in the database in EEA/UK/Switzerland/Quebec — your opt-in consent (Article 6(1)(a)).
• Inclusion in the database outside EEA/UK/Switzerland/Quebec — legitimate interests with a right to object (no opt-in required, but you can opt out at any time during Phase 1).
• Marketing communications — your separate, opt-in consent (Article 6(1)(a)). Required globally, regardless of region.

5. Retention

• Your name and email — destroyed 60 days after your survey submission. (Retained slightly longer for raters where required to allow delivery of your final report.)
• Ratings in identifiable form — kept during the 60-day Phase 1 window only.
• Ratings in the de-identified research database — kept for 5 years from the date of Phase 2 transformation, with annual review of continued research need.
• Open-text rater comments — kept only during your Phase 1 window; excluded from the research database; deleted at Phase 2 transformation.
• Consent-log records — kept for the longer of 5 years or the applicable statute of limitations.

6. Your rights

You have the right to: access your personal data; rectify inaccuracies; erase data (subject to research-purposes limits under Article 17(3)(d) where they apply); restrict processing; object to processing based on legitimate interests; and receive your data in a portable format. California residents have parallel rights under the CCPA/CPRA, including the right to know, the right to delete, the right to correct, and the right to limit use of sensitive personal information. We do not sell personal information.

Against the de-identified research database: access and rectification rights apply without limitation. Erasure requests are assessed individually under Article 17(3)(d) — most are honored; the exception is where erasure would seriously impair the research purposes. Our mechanism for locating your record is pattern-matching against your own copy of the Mosaic report you received.

To exercise any right: email privacy@gothamculture.com. We respond within 30 days under GDPR, 45 days for California requests (extendable once with notice).

7. Raters

If you are receiving this notice as an invited rater (someone asked you to provide feedback about them):

• Your name and email are used to send you the survey link and confirm completion. You do not receive a copy of the report.
• Your ratings are used to generate the subject leader’s aggregated report. Individual rater identities are NEVER disclosed to the subject. Categories of fewer than 3 raters are merged with others rather than broken out separately.
• Your open-text comments appear in the subject’s report (with your name removed) but are NOT added to the research database.
• After Phase 1 transformation, your name and email are deleted along with the subject’s. Your anonymized ratings may be retained in the de-identified research database for 5 years on the same legal basis.
• You have the same data rights as the subject (access, rectification, erasure with research-purpose limits, restriction, objection). Contact privacy@gothamculture.com.
• The consent decisions you make here cover core feedback (legitimate interests with operational conditions), research database inclusion (opt-in or opt-out per your region), and marketing (opt-in only, globally). These three are independent — you can accept any combination.

8. International transfers

Where data flows internationally, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We have completed a Transfer Impact Assessment per our outside-counsel framework (May 2026).

9. Geographic restrictions

The Mosaic is not currently available to users located in Cuba, Iran, North Korea, mainland China, or the Russian-occupied regions of Ukraine (Crimea, Donetsk, Luhansk, Zaporizhzhia, and Kherson). Access from these jurisdictions is blocked. This is a business decision driven by the compliance burden being infeasible for a free promotional offering.

10. Cookies and technical data

Our use of cookies and similar technologies on the gothamculture.com site, including the Mosaic 360 landing pages, is described in our main Privacy Policy at https://gothamculture.com/privacy-policy/. SurveyCraft uses session cookies necessary to operate the survey flow; these are not used for advertising.

11. Changes to this notice

Material changes will be communicated to active users with at least 30 days’ notice. The currently effective version is always shown at checkout and at this page.

12. Contact and supervisory authority

For privacy questions or to exercise rights: privacy@gothamculture.com.

gothamCulture LLC, 115 Broadway, 5th Floor, New York, NY 10006.

EU/UK representative under Article 27 (and FADP Article 14): DataRep (Data Protection Representative Limited, trading as DataRep). Data subjects may exercise rights via email at datarequest@datarep.com (subject line: gothamCulture LLC), via webform at https://www.datarep.com/data-request, or by post to DataRep at any of its 31 EU/EEA/UK/Swiss contact locations (primary EU office: 77 Camden Street Lower, Dublin, D02 XE80, Ireland; UK: 107-111 Fleet Street, London, EC4A 2AB, United Kingdom; Switzerland: Leutschenbachstrasse 95, 8050 Zurich, Switzerland). Postal correspondence MUST be addressed to “DataRep” — not gothamCulture LLC — to reach the representative.

You may also lodge a complaint with your local supervisory authority (e.g., CNIL in France, the ICO in the UK, the EDPB members elsewhere in the EEA, or your state attorney general in the US).