01Who we are and how to contact us
ETHIQ AI Ltd is the controller of the personal information described in this notice. Company number: 17160020. Our privacy contact is Halima Jafari.
Email: admin@ethiqai.co.uk
Postal address: Box Makers Yard, 504 Rosewood, New Kingsley Road, Bristol, BS2 0GL.
This notice covers ethiqai.co.uk, learn.ethiqai.co.uk and ETHIQ AI services, including course enrolment, marketing, community administration, enquiries and our business apps where we determine why and how personal information is used. A particular app or service may give additional information at the point of collection. Where we handle a client’s personal information solely on their instructions, the client’s privacy notice and our processing agreement also apply.
Our services are designed for professionals and businesses, rather than being directed at children. If you believe a child has provided information that we should not hold, contact us.
02What we collect and where it comes from
- Contact and enquiry information: name, business or role, email, phone number and the information you send through forms, email, social media, calls or messages.
- Purchases and accounts: order details, billing information, payment status, account identifiers, login and support information. Payment providers process the payment credentials entered in their payment forms; we use transaction and payment-status information to administer your purchase.
- Learning and certification: course enrolment, progress, assessment submissions, feedback, marks, certification records and learner support correspondence. For a team purchase, the purchaser may provide the other learners’ names and contact details.
- Community and event information: membership status, profile information you choose to share, posts, messages and contributions. If a session is recorded, information about the recording and its intended use should be provided for that session.
- Marketing and app activity: sign-up source, offers or resources requested, preferences, consent and opt-out records, app submissions and relevant interaction history.
- Technical information: IP address, device/browser details, security logs, cookies and similar technologies. Tracking information depends on the service, settings and choices you make.
- AI interactions: where an AI feature is provided, the prompts, uploaded content, conversation and generated results needed to operate that feature. Do not submit another person’s personal or confidential information without appropriate authority.
We receive information directly from you, from someone arranging an authorised team purchase, and from the platforms used to provide our services. We may also use relevant publicly available professional or business information when responding to enquiries or developing business relationships; being publicly available does not remove data-protection or marketing requirements.
We do not ask you to submit health information or other special-category data through general marketing forms. If you choose to disclose sensitive information, for example to request an accessibility adjustment, we will assess what is necessary, explain its use where appropriate, and identify both a lawful basis and any additional condition required.
03Why we use information and our lawful bases
| Purpose | Lawful basis and explanation |
|---|---|
| Reply to enquiries, discuss a potential purchase and administer a contract | Contract or steps at your request before a contract where applicable. Otherwise, legitimate interests in responding and running our business. |
| Provide accounts, learning materials, assessment, certification and support | Contract for an individual purchaser. For employees or team learners who are not personally party to the purchase contract, legitimate interests in delivering the training arranged for them, where appropriate. |
| Maintain accounting and required business records | Legal obligation where required by tax or accounting law. |
| Protect systems, prevent misuse and manage disputes | Legitimate interests in security, administration and establishing or defending claims; legal obligation where applicable. |
| Send marketing and organise relevant follow-up | Consent where required by PECR or UK GDPR; otherwise legitimate interests where permitted, subject to your rights. See section 4. |
| Use advertising tracking or other optional tracking | Consent where required. A narrow statutory exception may apply to a particular technology only if all of its conditions are met. See section 5. |
| Publish identifiable testimonials or learner case studies | Your permission or consent for the agreed use. Participation is optional and does not determine your assessment outcome. |
Where we rely on legitimate interests, we consider the purpose, necessity and impact on your rights. You can ask for further information and object as explained below. If information is needed to provide a service or meet a legal requirement and you do not supply it, we may be unable to fulfil that part of your request; we will explain this.
04Marketing and your right to object
You can unsubscribe using the link in a marketing email or by contacting admin@ethiqai.co.uk. You have an absolute right to object to use of your personal information for direct marketing, including related profiling.
For unsolicited email or text marketing to individual subscribers, including sole traders and some partnerships, we rely on consent unless every requirement of the products-and-services soft opt-in is met: we obtained the contact details directly during a sale or negotiation, the marketing is for our own similar products or services, and we offered a simple opt-out both when collecting the details and in each message. Merely downloading a free resource or making a general enquiry does not automatically satisfy these conditions.
Different PECR rules apply to corporate subscribers, such as limited companies. Where we send relevant business marketing without consent, we still consider the lawful basis for personal information, identify ourselves and provide an opt-out. We do not treat every business email address as a corporate subscriber.
An unsubscribe does not prevent necessary non-marketing messages about an order, payment, account or course you have purchased. We keep a minimal suppression record where needed to respect your choice. We do not sell your personal information or give it to unrelated organisations for their own independent marketing.
05Cookies, tracking and embedded services
Our sites and apps may use technologies needed for login, security, checkout or to provide a feature you request. Optional analytics, advertising pixels, video embeds and similar tools may also process information. The technologies actually enabled must be described in the relevant cookie information and controls.
Advertising tracking and related profiling require consent for storage or access on your device. We do not treat a legitimate-interest statement in this notice as a substitute for that consent. Where a narrow exception is relied on for aggregate service-improvement statistics or appearance preferences, its conditions include clear information and a simple way to object. The exception does not cover advertising or tracking identifiable visitors across services.
Cookie consent controls are being implemented across the main website and the learning subdomain. Until installation and testing are complete, we do not claim that a consent banner is operating or that optional tracking is blocked. Browser settings can provide additional controls, but do not replace our consent obligations. Withdrawing optional tracking consent should not withdraw access to a purchased course, although blocking technologies essential for login or payment can affect those features. Third-party videos, fonts, payment services and community platforms may make network requests or collect information when loaded; a cookie choice alone does not describe every transfer of personal information.
06Service providers and sharing
We use external services to run the business. Information shared depends on the service you use and the task involved. Relevant platforms include:
| Service or category | Purpose |
|---|---|
| Systeme.io | Funnel pages, forms, marketing email and course/checkout functions as these are configured and brought into use. |
| Kajabi during the transition | Existing pages, purchases, learning materials and customer records while the existing service is in use. |
| Payment providers selected at checkout | Payment collection, transaction administration, fraud prevention and payment-plan or finance services. The available provider and its own terms are shown at checkout. |
| Skool and community communication services | Membership administration and community interaction where included or separately purchased. |
| Base44 and app infrastructure | ETHIQ AI apps, forms, workflows and customer relationship administration where applicable. |
| Email, document, video and meeting providers | Correspondence, file storage, teaching resources, embedded media and meetings; examples include Microsoft 365, Google Workspace/Drive and video-hosting services where used. |
| Google AI Study Buddy and Base44 AI services | Optional AI Study Buddy and Governance Pack Generator, where a user chooses to use them. Processing may also involve the AI providers configured for the Base44 app; this needs to be explained in the feature-specific information. |
| Authorised team members and advisers | Limited access needed to support services, administration, accounting, insurance or legal advice. |
A provider processing information on our behalf must be covered by an appropriate processing agreement and instructions. Some providers, including payment or finance providers, may act as separate controllers for their own purposes; their privacy notices explain those activities. Information you post in a community may be visible to other members according to that platform’s settings.
We may disclose information where required by law, to protect legal rights, or as part of a genuine business sale or restructuring with appropriate safeguards. We do not describe all recipients as processors acting only on our instructions.
07AI, automation and profiling
We use automation to organise work, route enquiries and administer services. This can include tags, segmentation or prioritisation based on the resources requested, information supplied or relevant engagement. Where it evaluates someone’s interests or behaviour, it may amount to profiling. Marketing choices and the right to object still apply.
We do not submit identifiable client or learner information to general-purpose AI tools as part of our ordinary internal drafting or research. The exceptions are optional AI services that a person chooses to use: our AI Study Buddy using Google AI Study Buddy, and the Base44 Governance Pack Generator. Those services process the information submitted to them to provide the requested output. Choosing an AI service does not authorise unrelated reuse of personal information or remove the need for an appropriate lawful basis, provider arrangements, security and any additional safeguards for sensitive data.
We do not use solely automated decisions with legal or similarly significant effects as part of the routine administration described here. Hali Jafari personally reviews and approves every practitioner certification result; AI does not make the final certification decision. If we introduce a materially different use, we will assess it and provide the required information and safeguards before it begins.
See our AI Use Policy for our working standards. Provider use of prompts or uploads, including model-improvement settings, depends on the particular product, plan and agreement; this notice does not promise that every external provider has identical settings.
08International transfers
Using cloud platforms or overseas support can involve personal information being stored outside the UK or made accessible to a separate organisation abroad. For a restricted transfer, the UK transfer rules require a valid mechanism: UK adequacy regulations, appropriate safeguards or a specific legal exception.
Depending on the destination and provider, safeguards can include the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses, together with the assessment and additional measures required for that transfer. The UK-US Data Bridge is relevant only to eligible recipients covered by the UK Extension, not simply any US business or any provider in the EU-US framework.
You can contact admin@ethiqai.co.uk for information about the destinations and safeguards relevant to your service and how to obtain a copy, with confidential details protected where appropriate. EU transfer rules may also apply to particular processing; a UK mechanism is not automatically a substitute for those rules. We do not use a general consent statement as a routine fallback for ongoing transfers.
09How long we keep information
We keep information for as long as it is necessary for its purpose and then delete or anonymise it, taking account of legal duties, the service supplied, claims and the sensitivity of the information. Different records have different retention needs; a 12-month course-access period does not mean every record is deleted after 12 months.
| Record | Retention period or criteria |
|---|---|
| Accounting and tax records | Generally six years from the end of the last company financial year they relate to, and longer where a legal requirement or an HMRC enquiry requires it. |
| Enquiries and customer relationship records | For the period needed to respond, manage the relationship and resolve relevant follow-up or disputes, with inactive records reviewed against that purpose. |
| Marketing records | While the relevant permission or other lawful basis remains applicable; minimal consent evidence and suppression records may be retained to demonstrate and honour choices. |
| Course submissions, feedback and certification | For delivery, marking, resubmissions, appeals and reasonable evidence of certification or claims. Certification verification may require retaining a minimal award record after course access expires. |
| Community content and AI interactions | According to the purpose, service settings and applicable provider retention arrangements. Avoid submitting unnecessary personal information; contact us about the records held for your service. |
| Security logs and backups | For the period needed for security, recovery and incident investigation. Deleted active records may remain in protected backups until they are overwritten under the relevant backup cycle. |
A legal hold or unresolved complaint can justify retaining relevant records longer. Ask us for the retention criteria applicable to a particular record.
10Security and sensitive information
We use proportionate technical and organisational measures, including access controls and limiting access to people who need it for their work. The precise controls depend on the system and the information involved. No online service can guarantee absolute security.
We assess suspected incidents and notify the regulator and affected individuals where legally required. Do not send passwords, full payment-card details, or unnecessary sensitive client information through general enquiry forms, community posts or AI prompts.
11Your information rights
Depending on the circumstances and the lawful basis, you may have rights to access, correct, erase or restrict use of your personal information, obtain certain information in a portable format, or object to processing. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. These rights are not all unconditional.
Direct marketing: you can object at any time, including to related profiling. We will stop that use of your personal information.
Contact admin@ethiqai.co.uk to exercise a right. A request does not have to use a particular form or legal phrase. We may make proportionate identity checks where needed. We normally respond to an access request without undue delay and within one month. A further two months may be available for complex or multiple requests, with an explanation within the applicable initial period. Reasonably required clarification can pause the access-request clock; asking a routine question does not automatically pause every type of rights request.
Requests are normally free. A fee or refusal is permitted only in the circumstances allowed by law, such as a manifestly unfounded or excessive request; we will explain the reason and complaint options. For more information, see the ICO’s guidance for the public.
12Complaints
If you are concerned about our handling of information, email admin@ethiqai.co.uk or write to the address in section 1. Tell us what happened, the service involved and how you would prefer us to respond. You do not have to use a particular form.
We will acknowledge a data-protection complaint within 30 days, investigate without undue delay and keep you informed of progress and the outcome. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to obtain our permission or exhaust our process first. Where another supervisory authority has jurisdiction, your applicable complaint rights are unaffected.
13Links and changes to this notice
Other sites and services have their own notices and settings. This notice describes ETHIQ AI’s activities; it does not replace the privacy information supplied by an independent provider.
We will update this notice when our activities or legal obligations change and give further notice where a change materially affects how we use your information.