Skip to content
SAAII The Security and AI Institute
PRIVACY POLICY

Privacy Policy

How SAAII collects, uses, and protects the personal data of learners, enquirers, and website visitors.

Last updated: [DATE]. Version 1.0. — DRAFT: this template needs review by SAAII\’s DPO or a data protection solicitor before publication.

1. Who we are

The Security and AI Institute (“SAAII”, “we”, “our”) is a [UK-registered private limited company / other legal form], company number [NUMBER], registered address [ADDRESS]. We are the data controller for the personal data described in this notice. Our Data Protection Officer can be reached at dpo@thesaaii.com.

2. What personal data we collect

We collect personal data in three contexts:

  • Website visitors. Anonymised technical data (IP address, browser type, pages visited) via server logs, retained for [30] days for security and diagnostic purposes.
  • Enquirers. Name, work email, organisation, role, and any information you volunteer in a contact or briefing form. Retained for [24] months from last contact.
  • Learners. The above, plus billing information (processed by Stripe/PayPal — we do not store card details), learning records (enrolment, progress, assessment results, credentials issued), and any content you submit as part of an assessment. Retained for the duration of your enrolment plus [7] years thereafter for credential-verification and audit purposes.

3. Legal bases for processing

  • Contract — to deliver programmes you have enrolled in.
  • Legitimate interests — to respond to enquiries, secure the website, and improve our services.
  • Legal obligation — to retain financial records under UK tax law.
  • Consent — for optional marketing communications only. You can withdraw consent at any time.

4. Who we share your data with

We share personal data only with the following categories of processor, each under a written data-processing agreement: our hosting provider (Hostinger); our self-hosted LMS on our infrastructure; our payment processors (Stripe, PayPal); our email delivery provider; our privacy-preserving analytics provider. We do not sell, rent, or trade personal data. We do not use third-party advertising cookies or trackers.

5. International transfers

Where a processor is outside the UK/EEA, transfers are made under the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

6. Your rights

You have the right to request a copy of the personal data we hold about you; correct inaccurate data; request deletion (subject to legitimate retention obligations); object to processing based on legitimate interests; withdraw consent for marketing at any time; and lodge a complaint with the UK Information Commissioner\’s Office (ico.org.uk) or your national data protection authority. To exercise any of these rights, contact dpo@thesaaii.com.

7. Cookies

See our separate Cookie Policy.

8. Changes to this policy

We will update this policy when our processing changes. Material changes will be notified to active learners by email.