Phase Won privacy and cookie policy

1. "Personal data" explained

As used in this policy, "personal data" means any information relating to an identified or identifiable natural person. This policy applies to information I collect where I control the purposes and means of processing: phasewon.net, wonder.phasewon.net, the emails and text messages I send, and the records I keep about classes, coaching engagements, and inquiries.

It does not apply to the practices of third parties I don't control, or to information that has been anonymized or, to the extent permitted by law, de-identified. I may share your name, email address, and course completion status with a third party based on the type of class you're taking. Scrum Alliance, Inc. issues certifications and administers its own exams for the classes it licenses; nothing you do inside the Wonder portal is sent to them. I work with education centers, which register students for public classes offered through them. And I may share your information with your employer if you're taking a class through them. Once your record sits with any of these third parties their policy governs it.

Additional disclosures for residents of Colorado, Delaware, Maryland, Minnesota, New Jersey, and Oregon are in section 10. Notices for residents outside the United States are in section 11.

2. Security

I maintain reasonable security measures intended to help protect information about you from loss, theft, misuse, alteration, destruction, and unauthorized access or release.

If you have a Wonder portal account, keep your login details to yourself and use a password you don't reuse elsewhere. Tell me right away if you think someone else has used your account.

No security system is impenetrable, though, and the confidentiality of anything transmitted to or from me over the internet or by email cannot be guaranteed. I am not responsible for the security of information transmitted over the internet. If you'd rather not send something to me electronically, call me instead and we'll find another way. If you believe an account, device, or message of yours has been compromised in a way that touches your work with me, please tell me right away.

3. Types of personal data I collect

What I hold depends on how you choose to deal with me. Almost all of it comes directly from you, through the contact form, by email or phone, or during registration for a class.

• Contact details. Your name, email address, phone number, and the company or organization you work for.
• Registration details. The course you're enrolled in, the dates you attended, your role, and anything you tell me about what you're hoping to get out of the class.
• What you write to me. The messages you send through the contact form or by email, including whatever context you share about your team.
• Call bookings. If you book a call on phasewon.net, I receive your name, email address, company, the time you picked, and your answers to the booking questions. The booking becomes an event on my Microsoft 365 calendar with you as an invited guest, a Zoom meeting is created for the call, and your answers come to me by email rather than appearing in the invitation. The link in your invitation lets you reschedule or cancel.
• Manager Approval Kit requests. If you ask for a Manager Approval Kit on phasewon.net, I receive your first name, work email, the class you picked, and any ad click identifiers and campaign tags in the link you arrived from. The request is stored in the Wonder portal, and the kit is emailed to you through Microsoft 365.
• Payment records. If you register for a class online, payment is taken by Stripe on Stripe's own checkout page. Stripe collects your card details there under its privacy policy; I never see or store them. What I keep is an order record: which session you bought, the amount, when it was paid, whether it was refunded, and Stripe's reference numbers for the payment. The receipt comes to you from Stripe. For classes paid by an education center or your employer, I keep the invoice.
• Credential records. Which credential you earned and when, so I can confirm it years later if you ask.
• Wonder portal account. If you use the Wonder student portal at wonder.phasewon.net, the account holds your email address, the display name you choose, an avatar image if you add one, and a protected form of your password that I can't read. Every portal signup is a student account.
• Wonder portal coursework. The portal records the sessions you're enrolled in, your answers to quizzes and exercises, and your progress and scores. This is your workspace: I look at it to teach the class and to see where people are getting stuck, not to score you against your colleagues.
• Live quizzes without an account. Anyone can join a live quiz from a room link by typing a name. If you do, I keep the name you typed and your answers for that session, and your browser holds a small identifier so a refresh doesn't lose your place. No email is collected that way.
• Usage data. Date and time of your visit, pages visited, referring site, browser, operating system, device type, and IP address, collected using cookies. It is reported to me in aggregate and is not linked to your registration record.
• Advertising data. When you arrive from an ad or browse this site, advertising tags from Google and LinkedIn may record the ad you clicked, the pages you viewed, and whether you went on to contact me or register. It is identified by cookie and device identifiers rather than your name. See the cookie policy.

I may also receive personal data from third parties: rosters from education centers for public classes they register, and attendee lists from the person who books a private cohort for their team.

I do not ask for and do not want sensitive personal data: no government identification numbers, no health information, no financial account details, no demographic categories. If you send something like that unprompted, I'll delete it.

4. How I collect and use personal data

The purpose is running the class and staying in touch about your training.

• Confirming your registration and sending logistics: dates, times, the meeting link, prework, and materials
• Reaching you if a class time changes or something goes wrong on the day
• Giving you access to course materials in the Wonder portal, keeping track of what you've completed, and holding your quiz and exercise answers so you can see your own progress
• Reviewing exercise and quiz answers to give you feedback and to improve how a course is taught
• Issuing your credential, certificate, or badge after the course
• Following up on a course you attended, and letting you know about upcoming classes you might be interested in
• Answering the question you asked, and preparing a quote or proposal if you asked for one
• Keeping the invoices and business records I'm required to keep
• Understanding which pages of this site people find useful
• Measuring whether my ads lead to inquiries and registrations, and showing my ads to people who have visited this site or already know my work

You can tell me to stop sending course announcements at any time, and I'll still send the operational messages for a class you're actually registered for.

5. Phase Won messaging privacy policy

Phase Won LLC (doing business as Phase Won) ("we," "us," "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how Phase Won collects and uses information about you when you opt-in to receive SMS messages from us.

Data We Collect

When you opt-in to receive SMS messages, we collect:

• Your name
• Your phone number
• Consent to send SMS messages

How We Use Your Data

We use your information to:

• Operate our business
• Send you the SMS messages you've opted in to receive

Data Sharing

• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
• Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned elsewhere in this policy excludes mobile opt-in data.

Messaging Program Terms and Conditions

1. The messaging program may consist of general customer care messaging to answer questions and provide support to customers, and/or marketing messaging that include discount codes, special deals or texts promoting our products/services, depending on which programs(s) you opt in to. We will only send content you have explicitly signed up to receive via our opt-in process. Messages will be sent from (833) 742-7311.
2. You can cancel the SMS service at any time. Just text 'STOP' to the phone number from which you received messages. After you send the SMS message 'STOP' to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.
3. If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at cbowman@phasewon.net.
4. Carriers are not liable for delayed or undelivered messages.
5. As always, message and data rates may apply for any messages sent to you from us and to us from you. Message frequency will vary based on communication needs. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.
6. If you have any questions regarding privacy, please read our privacy policy details contained in the rest of this page or contact us at cbowman@phasewon.net

In practice, most of what I send is confirmations and reminders: your registration is in, the class starts tomorrow, here's the link. Occasionally a message about an upcoming course you might be interested in based on what you've already taken. Agreeing to texts is never a condition of registering for a class or buying anything, and opting out doesn't cancel your registration; I'll switch to email for anything you need to know.

6. Retention of personal data

Information I obtain about you is retained for as long as it is reasonably necessary for a business purpose, including validating a credential you earned, because people ask me years later to confirm they took a class. Invoices and business records are kept as long as tax and record-keeping rules require. If you've only ever sent an inquiry that didn't turn into work, I clear it out once the conversation has clearly ended. A Wonder portal account stays open as long as you want it, so your materials and record stay available to you. Ask me and I'll close it and delete your profile, enrollments, and quiz answers. Records of payments you made stay in my business records for as long as tax rules require, but they are no longer connected to a portal account. You can ask me to delete anything I'm not required to keep.

7. Sharing of personal data

I do not sell your personal data for money. Mobile opt-in and consent data, and your phone number, are excluded from all sharing described in this section. Information leaves my hands in the following situations. Most exist because they are the only way to deliver what you signed up for; the advertising platforms are the exception, and you can opt out of them.

1. Scrum Alliance. Phase Won is a Scrum Alliance Licensed Training Partner. To issue a certification or micro-credential I submit your name and email address to Scrum Alliance so they can create your account, award the credential, and set up the two-year membership that comes with it. From then on their privacy policy governs that record, and your membership communications come from them rather than from me.
2. Education centers. For public classes offered through an education center, registration is theirs. They hold your enrollment record and share with me the roster I need to teach the class and issue credentials.
3. Your employer, when your employer is the customer. If your company arranged and paid for a private cohort, the person who booked it can expect a completion report from me: who attended and whether they finished. Employers have no access to the Wonder portal and cannot see your activity in it. I do not pass along what you said during the class, your quiz answers, your notes, or anything else you wrote in the portal, and I do not report on individual participation beyond attendance and completion.
4. Service providers. Ordinary business tools that process data on my behalf: Microsoft 365 for email and calendar; Supabase, which stores the portal's database and handles sign-in; Netlify, which hosts phasewon.net and the portal; Zoom for video calls, including calls booked on phasewon.net; the messaging provider that sends the texts; Stripe for online payments; and Google Analytics on phasewon.net only. They are not permitted to use your information for their own marketing. Stripe is the one you interact with directly, on its checkout page, and its own privacy policy applies there.
5. Advertising platforms. I advertise on Google Ads and LinkedIn, and may add other platforms that make sense for reaching product and agile professionals. Their tags on phasewon.net receive cookie and device identifiers, the pages you visit, and conversion events such as sending the contact form or registering for a class. I may also give a platform a hashed (scrambled) copy of an email address, either when you complete a conversion or as part of a list of past students and contacts, so it can measure results, show my ads to people who already know my work, or exclude them from ads they don't need. Phone numbers are never included. The platforms use this data under their own privacy policies (Google, LinkedIn), and some state laws treat it as a "sale," "sharing," or targeted advertising. You can opt out at any time; see your ad choices. Nothing from inside the Wonder portal is given to an advertising platform.
6. Legal requests and rights. I will disclose personal data where necessary to respond to legal requests, enforce my agreements, exercise or defend legal rights, or protect the rights, property, or personal safety of any person, and where any other disclosure is required by law.
7. A change in the business. I may share information in connection with, or during negotiations of, a proposed or actual merger, acquisition, or sale of all or part of the business. I would tell you before your information moved to someone else's control.

8. Social plugins and other websites

This site does not embed social media widgets, share buttons, or social plugins. It does carry LinkedIn's advertising tag (the Insight Tag) for measuring and targeting LinkedIn ads, which is covered in the cookie policy and can be switched off under your ad choices.

The Wonder portal at wonder.phasewon.net is mine, and this policy covers it. Beyond phasewon.net and the portal, this policy does not apply. The site links to other websites, including Scrum Alliance and LinkedIn. I am not responsible for the privacy practices of those sites. When you visit them, read their privacy policies.

9. Children under the age of 13

Phase Won's training is for working professionals. This site is not directed toward children under 13, and I do not knowingly collect personal data from them. If you are under 13, do not use this site or provide any information on it. If I learn that I have collected personal data from a child under 13, I will delete it. If you believe I might have information from or about a child under 13, email me at cbowman@phasewon.net.

10. Colorado, Delaware, Maryland, Minnesota, New Jersey, and Oregon

For residents of these states, my practices regarding the collection, use, disclosure, and retention of your personal data are set out in this policy and the cookie policy below.

I process personal data for targeted advertising: advertising tags from Google and LinkedIn on phasewon.net, and hashed email lists I may give those platforms, as described in section 7 and the cookie policy. Some of these laws may also treat that as a "sale" of personal data even though no money changes hands for it. You can opt out of both. I do not process personal data for profiling in furtherance of decisions that produce legal or similarly significant effects. I do not knowingly collect sensitive personal data; if I ever needed to, I would ask for your consent first.

Opting out of targeted advertising and sale

There are two ways to opt out, and either one is enough:

• In your browser. Use the control under your ad choices, or turn on a Global Privacy Control signal in your browser or a browser extension. Either one stops the advertising tags from loading on phasewon.net in that browser.
• By email. Email cbowman@phasewon.net and ask me to opt you out. I will remove your email address from any list I give an advertising platform and leave it off future lists. An email opt-out does not require the identity verification described below.

Requests

You have the right to:

• Confirm whether or not I am processing your personal data, and in some regions confirm the categories of personal data processed
• Access your personal data
• Correct inaccuracies in your personal data
• Delete your personal data
• Obtain a copy of the personal data you previously provided to me, in a portable and readily usable format
• Revoke consent you previously gave, including consent to receive text messages
• Opt out of the processing of your personal data for targeted advertising, and of any sale of personal data

If you are a Minnesota or Oregon resident, you also have the right to obtain a list of the specific third parties to which I have disclosed personal data. If you are a Delaware or Maryland resident, you also have the right to obtain a list of the categories of third parties to which I have disclosed your personal data.

These are verifiable rights, which means I need to establish who you are before acting on them. To exercise any of them, email cbowman@phasewon.net and say which right you want to exercise. To verify your identity I may ask you to confirm receipt of an email sent to an address that matches my records, or to provide details about your history with me. If I cannot verify your identity, I may deny the request as applicable law allows. I will confirm receipt of and respond to your request consistent with applicable law. Your rights are subject to legal exceptions and to my retention obligations, and I will not discriminate against you for exercising any of them.

You may use an authorized agent to make a request. I will require written and signed proof of the agent's permission, and I may verify your identity directly with you.

Appeals

You have the right to appeal a decision I make about your request. To appeal, email me and say what you wish to appeal. I will review and respond in accordance with applicable law. If I deny your appeal, you may submit a complaint to your Attorney General:

• Colorado: coag.gov/file-complaint
• Delaware: attorneygeneral.delaware.gov
• Maryland: marylandattorneygeneral.gov
• Minnesota: ag.state.mn.us
• New Jersey: njconsumeraffairs.gov
• Oregon: justice.oregon.gov

11. Important notices to residents outside the United States

This section applies to people in the European Economic Area and the United Kingdom. Phase Won is based in the United States. Personal data may be accessed by me or transferred to me in the United States, which means your information may be transferred to, processed, maintained, and used on systems located outside your state, province, or country, where privacy laws may not be as protective as those where you live. If you are located outside the United States and choose to work with me, you do so on that basis, and you consent to the application of United States federal and Colorado state law in matters concerning this policy.

In some cases personal data of EEA or UK residents reaches me through another data controller, such as an education center or your employer. Where that happens, that organization's agreement with you governs the transfer.

11.1 Data controller

Phase Won LLC is the data controller for the personal data you provide to me. There is no separate data protection officer; the contact is me.

Corissa Bowman, Phase Won LLC
cbowman@phasewon.net
(833) 742-7311
Golden, Colorado, United States
A postal address for written requests is available on request.

11.2 Purposes and legal bases for processing

If you reside in the United Kingdom or the European Union, you're entitled to know the legal bases I rely on. They depend on the context and the data at issue: (1) with your consent, such as for text messages and course announcements; (2) as necessary to perform a contract when you register for a class or engage me for coaching; (3) as necessary for my legitimate interests in delivering and improving training, running the site, and understanding how it's used; and (4) to comply with a legal obligation, including tax and record-keeping requirements and responding to legal process. It may also be necessary to process personal data to establish, exercise, or defend against claims and other potential liabilities.

Advertising relies on consent only. The advertising tags are set up not to load for visitors whose browser places them in Europe, and Google's tags default to no advertising cookies for visitors in the EEA, the United Kingdom, and Switzerland. I will not give an advertising platform the email address of anyone in the EEA or the United Kingdom unless that person has agreed to it.

11.3 Your rights regarding personal data

• Access and confirmation. You may ask whether I process personal data about you and, in some circumstances, obtain a copy of it.
• Deletion and blocking. In certain circumstances you may have your personal data deleted or blocked without undue delay. If it's deleted, I may no longer be able to confirm a credential you earned.
• Direct marketing. You may object to my processing of your personal data in specific circumstances, including for course announcements.
• Consent. Where I process personal data on the basis of consent, you may withdraw it at any time.
• Data portability. Where processing is based on consent or on performing a contract with you, and is carried out by automated means, you may receive the data in a structured, commonly used, machine-readable format.

To exercise any of these, email cbowman@phasewon.net. You also have the right to lodge a complaint with your local supervisory authority.

12. Contact me

If you have questions or suggestions about how your personal data is handled, or trouble accessing this policy, email cbowman@phasewon.net or call (833) 742-7311. There is no form and no ticket queue. It's me reading the email.

Records already submitted to Scrum Alliance or held by an education center have to be handled by them, and I'll point you to the right place.

13. Changes to this policy

I may make changes to this policy. Changes are published on this page and the date at the top is updated. If I make material changes to how I treat personal data I already hold, I'll notify the people affected by email rather than relying on you to notice.

Cookie policy

This cookie policy explains how I use information collected from your browser or device for analytics and advertising purposes.

1. Cookies

A cookie is a small text file stored on a computer, tablet, phone, or any other device used to browse the internet, capable of storing navigation information for statistical or functional purposes. Cookies can be used to recognize a returning visitor, make navigation easier, and remember preferences such as language or time zone. Session cookies expire when you close your browser; persistent cookies last until a set expiration date or until you delete them.

The Wonder portal uses one functional cookie to keep you signed in. If you join a live quiz without an account, your browser also keeps a small identifier in local storage so a refresh doesn't lose your place. Neither is used for analytics or advertising. Google Analytics and the advertising tags run on phasewon.net only; there is no analytics or advertising tracking inside the portal.

Pixels, also called web beacons, are code embedded in a page, often used alongside cookies to collect information from your browser. This site uses advertising pixels from Google and LinkedIn, described below.

For general background on cookies, see allaboutcookies.org.

2. Analytics cookies

This site uses Google Analytics to understand how many people visit and which pages they read. Google Analytics may record your approximate geographical location, device, internet browser, operating system, and IP address. I am not provided with information that allows me to link an individual to an IP address. More information is in Google's privacy policy.

3. Advertising cookies

I advertise my classes and services on Google and LinkedIn, and I may add other advertising platforms. To do that, phasewon.net can carry these advertising tags:

• Google Ads. Records when you arrive from one of my Google ads and whether you then contact me or register, so I can see which ads work. It also lets me show ads on Google and its partner sites to people who have visited this site (remarketing). Google Ads may use the Google Analytics data on this site for the same purposes. See Google's advertising policy.
• LinkedIn Insight Tag. Records visits and conversions from LinkedIn ads and lets me show ads on LinkedIn to people who have visited this site. LinkedIn may connect this to your LinkedIn account if you have one; I only see aggregate reports, such as job titles and industries of visitors, never who you are. See LinkedIn's cookie policy.

If I add another platform, it will be listed here before its tag goes live. These tags do not load if you opt out, if your browser sends a Global Privacy Control signal, or if your browser places you in Europe.

4. Your cookie choices

• Browser settings. Every browser lets you accept or reject all or certain cookies, or ask to be notified when one is set. The instructions differ by browser. Blocking cookies may mean parts of this site stop working as expected, and the Wonder portal cannot keep you signed in without its session cookie.
• Per browser and device. Cookie settings apply only to the browser you set them in. If you use several browsers or devices, or clear your cookies, you'll need to set them again.
• Google Analytics opt-out. You can opt out of Google Analytics on any site with Google's browser add-on.
• Preference signals. I treat a Global Privacy Control signal as a request to opt out of targeted advertising and sale, and the advertising tags do not load for a browser that sends it. Do Not Track has no agreed standard, so I don't act on it; use the control below instead.
• Platform settings. You can also manage ad personalization in your Google account and your LinkedIn advertising settings. Those settings apply to every advertiser on the platform, not just to me.