Privacy Notice

1. Who we are

AITrustPass™ provides TrustPass™, a voluntary responsible-AI assessment and verifiable credential service.

For the purposes of UK data protection law, AITrustPass™ is responsible for the personal information described in this notice.

You can contact us about privacy or data protection at:

2. Information we collect

Depending on how you use TrustPass™, we may collect:

• Your full name.
• Your email address.
• Your responses to the TrustPass™ responsible-AI assessment.
• Your assessment score and Assessment Outcome.
• Credential and certificate information, including Certificate ID, verification information, TrustPass™ version, issue date and credential status.
• Information relating to payment and transaction status. Complete payment card details are handled by our payment provider and are not stored directly by AITrustPass™.
• Communications you send to us, including support, correction, cancellation, complaint or verification enquiries.
• Basic technical, device and security information generated when you use our website where this is provided by our website, hosting or infrastructure providers.

3. Why we use your information

We use personal information to:

• provide and administer the TrustPass™ assessment;
• calculate and provide your Assessment Outcome;
• process and confirm your TrustPass™ purchase;
• link your payment to the applicable assessment process;
• review and, where applicable, issue your TrustPass™ credential;
• create your personalised TrustPass™ certificate;
• maintain the AITrustPass™ Registry;
• allow TrustPass™ credentials to be independently verified;
• send certificate and service-related emails;
• respond to support, correction, cancellation and other enquiries;
• prevent misuse, fraud or unauthorised manipulation of assessments, payments, credentials or verification;
• maintain appropriate business, accounting and transaction records; and
• operate, secure and improve the AITrustPass™ website and service.

4. Our lawful bases

UK data protection law requires us to have a lawful basis for using personal information.

Where we rely on legitimate interests, those interests include operating a trustworthy credential service, protecting Registry integrity, preventing misuse and providing a reliable verification process.

5. Automated assessment scoring

TrustPass™ assessment responses are automatically scored using the assessment rules for the applicable TrustPass™ version. This generates an assessment score and applicable Assessment Outcome.

An Assessment Outcome is not itself an issued TrustPass™ credential and does not constitute legal, regulatory, employment, financial or other professional approval.

TrustPass™ credential issuance is subject to the applicable review and issuance process.

We do not use the TrustPass™ assessment to make a solely automated decision that produces legal effects concerning you or similarly significantly affects you.

6. TrustPass™ Registry and verification

Depending on the credential and its current status, the verification result may display:

• the credential holder's name;
• TrustPass™ outcome or tier;
• credential status;
• date issued, where applicable;
• TrustPass™ version; and
• Certificate ID.

The verification page is intended to allow a third party to check the current Registry status of a TrustPass™ presented to them, including where the relevant status is pending, issued or revoked.

Anyone who has access to a certificate's verification link or QR code may be able to view the associated verification information. You should therefore consider who you share your certificate, QR code or verification link with.

We do not display your email address or individual assessment answers on the public TrustPass™ verification page.

7. Organisations we use

We use third-party service providers to operate TrustPass™. These organisations may process personal information on our behalf, or as otherwise necessary to provide their services.

We may also disclose information where required by law, to establish or defend legal rights, or where reasonably necessary to prevent fraud, misuse or protect the security and integrity of TrustPass™.

8. International processing

Some of the technology providers used by AITrustPass™ operate internationally and may process information outside the United Kingdom.

Where personal information is transferred internationally, appropriate safeguards will be used where required by applicable UK data protection law.

9. How long we keep information

We only keep personal information for as long as reasonably necessary for the purposes described in this notice, including providing the TrustPass™ service, maintaining Registry integrity, resolving disputes and meeting accounting, tax or legal requirements.

Our current retention approach is:

• Pending or incomplete assessment records may be removed when they are no longer required to complete or administer the TrustPass™ process.
• Issued, suspended or revoked credential and Registry records may be retained while relevant and afterwards where necessary to maintain an accurate record of issuance, status, revocation, disputes or misuse.
• Transaction and accounting records may be retained for the period required for tax, accounting or legal purposes.
• Support and other communications are retained only for as long as reasonably necessary to deal with the enquiry and any related issues.

We periodically review the information we retain and delete or anonymise information when it is no longer required.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights including:

• the right to ask for a copy of personal information we hold about you;
• the right to ask us to correct inaccurate or incomplete personal information;
• the right to ask us to delete personal information in certain circumstances;
• the right to ask us to restrict how information is used in certain circumstances;
• the right to object to certain uses of your information;
• the right to data portability where applicable; and
• rights relating to certain automated decision-making where applicable.

These rights are not absolute. Whether a particular right applies depends on the circumstances and the lawful basis on which we use your information.

We will respond to valid data protection requests within the period required by applicable data protection law.

To exercise a privacy right, contact: contact@aitrustpass.com .

11. Keeping your information secure

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, loss or disclosure.

Access to administrative TrustPass™ functions is restricted. TrustPass™ verification uses credential-specific information, including a Certificate ID and verification key, to support the integrity of the verification process.

No internet-based system can be guaranteed to be completely secure, but we take reasonable measures designed to protect the information used to provide TrustPass™.

12. Cookies and website technologies

AITrustPass™ uses cookies and similar technologies where necessary to operate, secure and protect the website and TrustPass™ service.

Our website infrastructure may use strictly necessary security technologies, including technologies provided by Cloudflare, to protect the service, manage traffic and help prevent misuse.

We do not currently use cookies for advertising or behavioural tracking.

If we introduce analytics, advertising or other non-essential cookies or similar technologies in the future, we will update this notice and provide appropriate information and consent controls where required.

13. Complaints

If you have concerns about how we use your personal information, please contact us first at:

contact@aitrustpass.com

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Information Commissioner's Office

14. Changes to this notice

We may update this Privacy Notice when our services, technology, providers, data practices or legal obligations change.

The latest version will be published on this page with the updated date shown at the top.