How we handle your answers and documents.
The assessment asks about weaknesses in how your organisation uses AI. That is sensitive, so here is exactly what is kept, where, and for how long.
What we keep
- Your organisation's name and the answers about your organisation: size, sector, which rules apply, how AI is used.
- Every answer you give, your notes, and your answers to the foundation questions in your own words. Each change is kept with the time it was made, so there is a record of how an answer developed.
- The name and role on your invitation, and when your invitation link was last used.
- Documents you choose to attach, with the type, the date on the document, the file name and a fingerprint of the file. Attaching documents is optional.
- A record of each time an attached document is opened.
Why
To carry out the assessment your organisation asked for, to show you where you stand, and so that an assessor can confirm the position with you. We do not use your answers for anything else, and we do not sell or share them.
Where it is kept
With Cloudflare, which runs this service. Answers are stored in a database located in Western Europe. Documents are stored in object storage restricted to the European Union, encrypted at rest and filed under their fingerprint rather than their name. A document can only be opened through a link that is tied to your invitation and expires after five minutes.
How long
For the length of the engagement plus twelve months, after which the assessment and its documents are deleted. You can ask us to delete a document or the whole assessment sooner. When a document is deleted, the file is removed and only its fingerprint and the date remain in the record, so the history of the assessment stays intact.
What stays on your device
Your choice of light or dark mode, whether you chose the quick check or the full assessment, and a copy of unsaved answers are kept in your browser so you can pick up where you left off. The personal AI check at /individual/ keeps its answers in your browser only; nothing from it is sent to us. There are no advertising or tracking cookies.
Your rights
Under the GDPR you can ask for a copy of what we hold about you, ask us to correct or erase it, object to how it is used, or complain to the data protection authority.
The data controller is Cyber Benchmarker, Amsterdam, the Netherlands. To use any of these rights, or to ask what we hold, write to hi@cyberbenchmarker.com. The supervisory authority for the Netherlands is the Autoriteit Persoonsgegevens.