1 Data Controller Information
AI Governica ("we", "our", "us", or "the Platform") operates as a specialized, independent exam preparation, scenario gap-analysis quiz engine, and standard assessment portal for AI risk management frameworks (including ISO/IEC 42001, ISO/IEC 23894, BSI, NIST, ENISA, and EU AI Act readiness).
For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and EU Regulation (EU) 2016/679, AI Governica acts as the Data Controller for individual user accounts and public visitor inquiries, and acts as a Data Processor when handling employee seat assessments under enterprise corporate agreements.
• Organization: AI Governica Compliance Systems
• Official Privacy Contact: [email protected]
• Jurisdiction: United Kingdom (England & Wales)
2 Information We Collect & Process
We collect and process personal information strictly necessary to deliver standard assessment question banks, track practitioner certification progress, and facilitate corporate team training:
- Account Credentials: Full name, corporate email address, encrypted password hash (Argon2 / BCrypt), and assigned workspace role (Admin, Team Manager, Learner).
- Assessment & Quiz Telemetry: Scenario responses, clause timestamps, time taken per question, question flag history, final scores, mistake logs, and generated certificates.
- Billing & Commercial Data: Purchased standard tier, seat quantity, order IDs, invoice identifiers, and payment tokens. Note: All credit card transactions are processed directly via Stripe; AI Governica never captures or stores raw payment card numbers.
- Technical & Attribution Data: IP address, device telemetry, browser type, referral UTM parameters, and affiliate partner cookies (if referred by an approved partner).
3 Lawful Bases for Processing (UK GDPR Article 6)
Under UK GDPR Article 6, we process personal data strictly where an established lawful ground applies:
| Processing Purpose | Data Categories | Lawful Basis (UK GDPR) |
|---|---|---|
| Delivering standard quiz sessions & accuracy metrics | Account details, quiz responses, exam scores | Contract Performance (delivering purchased assessment service) |
| Enterprise workspace management & team seat licensing | Corporate roster, team member email, seat keys | Contract Performance & Legitimate Interests |
| Payment processing & FPDF invoice generation | Order amount, billing email, Stripe session ID | Legal Obligation & Contract Performance |
| Platform diagnostics, CSRF defense & cheat prevention | IP address, session IDs, user agent | Legitimate Interests (protecting platform integrity) |
| Affiliate referral tracking & commission payouts | Affiliate code, visit ID, PayPal email, order amount | Contract Performance (Affiliate Agreement) |
4 Corporate Workspaces & Employer Visibility
When you access AI Governica using an employer-provided corporate seat key or within a dedicated Company Workspace, your designated Corporate Workspace Manager has visibility over:
- Your overall standard completion percentage and readiness score.
- Clause-by-clause breakdown to identify organizational training deficiencies.
- Your verified Certificate of Completion credential.
Corporate managers cannot access your personal billing history, passwords, or activities performed under your Personal Workspace.
5 Third-Party Sharing & Sub-Processors
We do not sell, rent, or trade personal data to third parties. We share data only with verified sub-processors necessary to run the infrastructure:
- Stripe Inc. – Secure PCI-DSS Level 1 payment gateway processing.
- Google Analytics 4 (GA4) – Aggregated, anonymized performance telemetry (governed by your Cookie Preferences).
- Enterprise Hosting Infrastructure – UK/EU-based secure cloud hosting with 256-bit encryption.
6 Security Controls & Data Retention
We employ enterprise-grade technical and organizational safeguards:
- All web traffic and exam communications are encrypted in transit via 256-bit TLS/HTTPS.
- User passwords are hashed using salted cryptographic algorithms (Argon2id/BCrypt) and are never retrievable in plaintext.
- Data is retained as long as your account remains active. If you request account closure or data erasure, all personal records and exam histories are permanently expunged within 30 days.
7 Your Statutory Rights (UK GDPR & CCPA)
Under UK and EU data protection laws, you retain the following statutory rights:
- Right to Access: Request a complete copy of all personal and exam data we hold about you.
- Right to Rectification: Request correction of inaccurate personal profile data.
- Right to Erasure ("Right to be Forgotten"): Request full deletion of your account and quiz data.
- Right to Data Portability: Request an export of your exam results and certificates in structured JSON format.
- Right to Withdraw Consent: Update your cookie and telemetry preferences at any time.
To exercise any of these rights, email our compliance team at [email protected]. We respond to all verified requests within 30 days free of charge.
9 Contact Information & Inquiries
For any inquiries regarding this Privacy Policy, please contact:
• Email: [email protected]
• Support Portal: https://aigovernica.com
• Supervisory Authority: Information Commissioner's Office (ICO), UK (ico.org.uk)