Legal
Privacy Policy
How AIPEX collects, uses, and protects your personal data.
1. Who we are
AIPEX is a trading name of Altus Digital Services Limited, a company registered in England and Wales under company number 10377986.
For the purposes of UK data protection law we are the data controller for the personal data described in this policy.
This policy covers aipexconsulting.co.uk. When we launch our assessment platform we will update this policy before it starts collecting anything, and we will say so on this page.
Contact for any data protection matter: scope@aipexconsulting.co.uk or 0333 305 0866.
We are registered with the Information Commissioner's Office under registration number ZB180396.
We have not appointed a Data Protection Officer. We are not required to do so, and responsibility for data protection sits with the business owner.
2. What we collect
This website does not ask you to create an account. We collect personal data in five ways.
- When you send an enquiry form. Our enquiry forms ask for your name, work email address and company, and optionally your role and a message. We also record which form and page you used and the date and time you sent it.
- When you request a download. Our downloads, such as the EU AI Act Board Checklist, are available in return for the same details. They are only available to company email addresses, so we check that your address is not from a free email provider and that its domain is set up to receive email. That check looks up the domain, not you, and nothing is sent to anyone else. Your download link is personal to you, and we record each time it is used.
- When you unlock our executive briefings. The summary of every briefing is open to all. To read the full briefing, you give your name, work email address, company and role. We run the same company email check as for downloads, then email you a link to confirm the address. When you open it, a cookie on your device unlocks all of our briefings for 12 months. We record which page you came from, when you confirmed, and whether you ticked the optional box asking for new briefings by email.
- When you email or call us. Some contact links on this site open your own email program. Nothing is sent to us until you press send, and what we then hold is the email you chose to write: your name, your email address, and anything else you included. If you call us, we may note your name, number and what you asked.
- Website server logs. Like any website, our host records technical information when a page is requested, including your IP address, the page requested, the time, and your browser type. This is generated automatically and is not linked to your identity by us.
We do not buy contact lists, we do not scrape data, and we do not run advertising. With your consent, we use Google Analytics to understand how visitors use this site, including which of our posts or campaigns brought them here. We do not collect special category data, and we ask that you do not include it in a form or an email to us.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to an enquiry form you send us, providing a download you request, and giving you access to the full briefings when you ask for it, including the confirmation email | Legitimate interests, and where relevant taking steps at your request prior to entering a contract |
| Recording which downloads and briefings you requested, and following up personally about them | Legitimate interests: understanding which organisations are interested in our services and responding to that interest. You can ask us not to follow up at any time. |
| Checking that a download or briefing request uses a company email address | Legitimate interests: making sure our downloads and briefings reach the businesses they are written for |
| Reading and replying to an email you send us | Legitimate interests, and where relevant taking steps at your request prior to entering a contract |
| Keeping a record of our correspondence with you | Legitimate interests: running the business and keeping an accurate account of what was agreed |
| Website analytics (Google Analytics), including which post or campaign brought you to the site | Consent, given through the cookie banner. You can withdraw it at any time using the "Cookie preferences" link |
| Server logs, used for security and to keep the site working | Legitimate interests: protecting the service against abuse and diagnosing faults |
We do not currently send marketing email. If we start, it will be on the basis of your consent, asked for separately, never bundled with anything else, and withdrawable at any time. We will update this policy before that happens. The briefing form has an optional, unticked box asking whether you would like new briefings by email. We record your answer and will not send you anything on the strength of it until this policy says how.
4. Who we share it with
We do not sell your data, and we do not pass it to third parties for their own marketing.
| Provider | What it does | Where |
|---|---|---|
| SiteGround | Website hosting, the database that stores form submissions and download records, our business email, and the server logs described above | UK and EU |
| Google Ireland Limited (Google Analytics) | Website visit statistics, only if you accept analytics cookies | EU, and the USA (see section 5) |
| Resend, Inc. | Sends the confirmation email when you ask to unlock our executive briefings | USA (see section 5) |
| Vimeo.com, Inc. | Hosts and plays the executive briefing videos. Your device connects to Vimeo when a briefing video loads | USA (see section 5) |
Forms and email you send us are received in our own business mailbox and website database, and are not shared onward.
We may also disclose personal data where we are required to do so by law.
5. International transfers
Our website hosting is within the United Kingdom and the European Economic Area, so using this site does not involve transferring your personal data outside the UK, except as follows.
If you accept analytics cookies, Google Analytics data may be processed by Google LLC in the USA. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which UK law recognises as providing adequate protection.
The confirmation email for our executive briefings is sent by Resend, Inc. in the USA. Resend is also certified under the UK Extension to the EU-US Data Privacy Framework.
Our briefing videos are played from Vimeo.com, Inc. in the USA, which receives your IP address and browser details when a video loads. Vimeo is also certified under the UK Extension to the EU-US Data Privacy Framework.
If we later add a provider based outside the UK, we will only do so under a transfer mechanism permitted by UK GDPR, and we will name that provider and the mechanism on this page before it goes into use.
6. How long we keep it
| Record | Retention |
|---|---|
| Form submissions, download records and email enquiries that do not become clients | 24 months from last contact |
| Correspondence with clients | For as long as you remain a client, and 24 months after the relationship ends |
| Website server logs | As retained by our host, typically no more than 12 months |
| Google Analytics data (only if you accepted analytics cookies) | 14 months in Google Analytics. The _ga cookies in your browser last up to 2 years unless you clear them or withdraw consent |
Where the law requires us to keep something for longer, for example financial records for tax purposes, we keep it for that period and no longer.
7. Your rights
Under UK GDPR you have the right to:
- be told how your data is used, which is what this policy is for;
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to processing carried out on the basis of legitimate interests;
- object to direct marketing at any time, with no reason needed;
- receive your data in a portable format;
- withdraw consent at any time, where we relied on consent.
To exercise any of these, email scope@aipexconsulting.co.uk. We will respond within one month. There is no charge.
Withdrawing consent does not affect anything we did lawfully before you withdrew it.
8. Complaints
If you are unhappy with how we have handled your data, please tell us first and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection: ico.org.uk/make-a-complaint, or 0303 123 1113.
9. Cookies and similar technologies
Some cookies are strictly necessary for this website to work. Strictly necessary cookies do not require your consent. One of them is aipex_briefings, set only after you confirm your email for the executive briefings. It holds a reference number and a security code, not your name or email, and it keeps the briefings unlocked on that device for 12 months.
With your consent, we also use Google Analytics to measure visits, including which of our posts or campaigns brought you here. It sets cookies named _ga and _ga_*. These never contain your name or contact details.
Our briefing videos are played by Vimeo in "do not track" mode, so the video player does not set cookies.
We do not use advertising cookies, and we do not track you across other websites.
When you first visit, the cookie banner asks for your choice. Analytics stays off unless you click "Accept", and "Reject" is just as easy. You can change your mind at any time using the "Cookie preferences" link at the bottom of every page.
10. Automated decision making
We do not carry out profiling on this website. The only automated step is the company email check on the download and briefing forms, which declines free email addresses such as Gmail. It has no legal or similarly significant effect on you, and if you would like a download or a briefing without a company address, email us and we will consider it personally.
11. Is providing your data required?
Providing your data is entirely voluntary. You can read every page of this site, and the summary of every briefing, without giving us anything. Our forms need your name, work email and company so that we can reply, and downloads and the full briefings also need a company email address. If you choose not to give them, we simply will not be able to reply to you, send the download or open the full briefing.
12. Changes to this policy
If we change this policy we will update the date at the top of the page. If the change is significant, and we hold your contact details, we will tell you directly.