Privacy notice — AI Strategy Assessment

Last updated: 9 August 2026

This notice explains how your information is handled when you use the AI Strategy Assessment. It is written to meet UK GDPR transparency requirements. Please read it before submitting the assessment.

Who is responsible for your data

The data controller is TheITRevolution Ltd, trading as RichardHam.co.uk. ICO registration number: [ICO registration number — to be added]. For any privacy question or to exercise your rights, contact us via richardham.co.uk/contact.

What we collect

Your work email address (so we can send your report).
Your role and organisation size band.
Optionally, your company name and industry, if you provide them.
Your answers to the assessment questions, including any free-text you enter.
Whether you opted in to receive marketing updates.
Limited technical/usage events (e.g. that a step was completed) used to measure the assessment funnel. These do not record your answers.

Please do not enter confidential, personal or customer-identifiable information in free-text fields — they are for general business context only.

Why we use it, and our lawful basis

To produce and deliver your report — this is the service you requested (UK GDPR Article 6(1)(b), performance of a request you initiated, and our legitimate interests in providing it).
To assess whether follow-up consultancy may be relevant (lead qualification) — our legitimate interests in operating the consultancy (Article 6(1)(f)). A legitimate-interests assessment supports this and you can object at any time.
To improve the assessment using aggregated, anonymised statistics — our legitimate interests. Individual reports are not published; only aggregate patterns are used.
To send marketing updates — only if you opt in (consent, Article 6(1)(a); PECR). You can withdraw at any time using the unsubscribe link in any such message, with no effect on your report.

How long we keep it

Abandoned or incomplete assessments: deleted after 30 days.
Completed assessments and associated contact details: kept for up to 24 months, then deleted.
Funnel/usage events: kept for up to 13 months for year-on-year comparison, then deleted.

Deletion is automated. You can also ask us to erase your data sooner (see your rights below).

Who processes it on our behalf

We use a small number of service providers (processors) to run the service. Each processes data only on our instructions:

Hosting and delivery of the web application (cloud hosting provider).
Database hosting for storing your submission.
An AI model provider, used only to draft the written narrative of your report. Your email address and marketing preference are not sent to it.
A workflow/automation provider used to send the report email.

Where any processing involves transfers outside the UK, appropriate safeguards (such as UK-approved transfer mechanisms) are used.

Automated report — and human review

Scores and recommendations are generated automatically from your answers. They are a preliminary indication only, not professional advice, and should be validated by a qualified person before any decision. The assessment does not make any legally or similarly significant decision about you.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. Where we rely on consent (marketing), you can withdraw it at any time. To exercise any right, contact us at the address above. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.