The data we do not have.

The public training, practice rounds and certificate on PHSHX run entirely in your browser. Your answers, scores and progress are stored on your own device and are never sent to us.

We receive personal data in two cases: when you type it into a form (an enquiry, a newsletter signup), and when your employer orders a team session and you take part in it. The team-session case has its own section below.

We do not sell data, we do not run advertising trackers, and we do not build profiles of visitors.

PHSHX is an independent business operated from Sweden and is the data controller (personuppgiftsansvarig) for the processing described here. Full registration details are published here as soon as the Swedish company registration completes, and the registered name and organisation number are given on request before then.

For any question about your data, or to exercise any of the rights below, write to info@phshx.com. We answer within 30 days.

Training progress, practice scores, rank, your chosen theme and the name you put on a certificate are stored in your browser's local storage. They are not transmitted to PHSHX and we cannot read them.

Clearing your browser data for this site deletes all of it permanently. There is no copy on our side to delete.

Enterprise enquiry form. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries (GDPR Art. 6(1)(b) and 6(1)(f)).

• Work email address
• Company name and, for an exposure check, the domain to check
• Company size and sector, if you fill them in
• Anything you write in the message field

Waitlist signup. Legal basis: your consent (GDPR Art. 6(1)(a)), which you may withdraw at any time by writing to us.

• Email address
• Team size, if you fill it in

Certificate verification. When a code is checked, the code is sent to our server, validated, and discarded. It is not stored and not logged with any identifier.

When a company orders a team session, the company is the data controller and PHSHX processes the data on its behalf under a data processing agreement accepted at the time of ordering (GDPR Art. 28). The purpose is the company's training record and nothing else.

From the person who orders: name, work email, company name and domain. The results page and every report go to that email only.

From each employee who takes a seat, entered by the employee themselves:

• Name, or an employee identifier chosen by the employer instead of a name
• Department, if the employee fills it in
• Which tasks were answered and whether each answer was right, the score, the pass or fail result, and the times of starting and finishing
• A short resume code, and a cookie that ties the seat to the browser it was started in

The employer sees completion, scores and results by topic. Employees see their own result. Nobody sees a ranking, and results are not used to discipline anyone; the agreement with the employer says so.

Team-session data is kept for 24 months after the session closes so the employer can show a continuous record, and is then pseudonymised. The employer can ask for a seat to be removed at any time, and an employee can ask their employer to do so.

Team-session data is stored with the hosting and database providers listed under "Who else can see it", on servers in the EU.

Enquiries: up to 24 months from the last contact, so we can follow up on a conversation you started. Removed earlier on request.

Waitlist: until the product launches or you ask to be removed, whichever comes first.

Server logs kept by our hosting provider: a short technical retention period set by that provider, used only to keep the service running and secure.

We keep the list of processors deliberately short. Each one only receives what it needs to do its job:

• Vercel Inc. - hosting and delivery of the website, standard technical logs, and cookieless traffic statistics
• Resend (or the equivalent email provider configured at the time) - delivery of form submissions to our inbox and of order and report emails to the person who ordered
• Upstash (or the equivalent database provider configured at the time) - storage of team-session orders, seats and results

Where a provider processes data outside the EU/EEA, the transfer relies on the European Commission's Standard Contractual Clauses.

We never sell, rent or trade personal data, and we do not share it for advertising.

PHSHX sets no advertising cookies and uses no cross-site trackers.

Local storage is used for the things described above (your progress and preferences). It is technically necessary for the training to work and stays on your device.

Traffic statistics come from Vercel Web Analytics. It counts page views and the country and device type they came from, sets no cookies, stores no IP address, and cannot identify a visitor or follow them to another site. We use it to see which pages are read, and for nothing else.

For business customers we run agreed, unannounced awareness tests. These only ever run under a signed authorisation from the customer, within a scope the customer defines, and under a data processing agreement (personuppgiftsbiträdesavtal) in which the customer is the controller.

Results are reported to the customer to improve training. They are not used to discipline individuals, and any finding about a named person is only produced where that person has opted in.

Under the GDPR you may ask us to: confirm what we hold about you and give you a copy; correct anything wrong; delete it; restrict or object to how we use it; and receive it in a portable format. Where processing rests on consent, you can withdraw that consent at any time.

Write to info@phshx.com and we will act on it without charge.

If you believe we have handled your data badly, you can complain to the Swedish authority, Integritetsskyddsmyndigheten (IMY), imy.se.

The site is served over HTTPS with a strict content security policy and hardened response headers. Form endpoints are rate limited and reject oversized input.

Nothing is perfectly secure, so we keep the amount of data we hold as small as we can. The strongest protection is the data we never collect.

If this policy changes in a way that affects you, the date below changes with it, and material changes will be noted on this page.