Terms
AI Adviser data processing terms
Last updated 20 October 2026
These terms form part of our service terms. They cover personal data in the information you provide for advisory consultancy, including any benchmark findings you choose to share. They do not govern taking an index or generating a Benchmark Lab report; those services are explained by Benchmark Lab’s privacy notice and its applicable service terms.
1. Who does what
The processor is The AI Adoption Lab Limited, a company registered in Scotland under company number SC900444, whose registered office is 5 South Charlotte Street, Edinburgh, EH2 4AN. The AI Lab is a trading name of that company, and the contracting party is the company, not the trading name. Our ICO registration number is ZC251110.
For personal data in the files you give us for the AI Adviser, your organisation is the controller and we are your processor. We process it only to deliver the AI Adviser to you, and only on your documented instructions, which include the scope we agree in writing and the files you choose to give us, unless the law requires us to do otherwise. If we think an instruction breaks data protection law, we will tell you.
2. What we process
- Subject matter: delivering the standalone AI Adviser strategy package and optional monthly advice.
- Duration: for as long as the AI Adviser runs, and then until the data is returned or deleted under section 8.
- Nature and purpose: receiving, storing, reading and analysing the information and files we agree with you, including through Microsoft 365 Copilot and our own software on Microsoft Azure and Microsoft Foundry. This supports pre-meeting research, benchmark review, the strategy session, further analysis and research, the strategy report, the remote follow-up and, if selected, monthly advice and six-month plan reviews.
- Types of personal data: whatever the agreed files contain, typically names, work contact details, job roles, and details in business correspondence, customer records and working documents.
- Data subjects: your staff, your customers and contacts, and anyone else your files mention.
You are responsible for having a lawful basis to share the personal data with us, and for sharing no more than the work needs. Please do not give us special-category data (such as health information) or information about criminal convictions unless we have agreed in writing beforehand that the work needs it.
3. Our obligations
- Process the personal data only on your instructions and only to deliver the AI Adviser.
- Make sure everyone who works on it is bound by a duty of confidentiality.
- Keep it secure, as described in section 4.
- Use sub-processors only as described in section 5, and remain responsible for them.
- Help you, taking account of what we process and the information we have, with requests from data subjects, with security, with notifying breaches, and with any data protection impact assessment or consultation with the regulator.
- Return or delete the data at the end, as described in section 8.
- Give you the information you reasonably need to show that these terms are being met, as described in section 9.
4. Security
- Your files are handled within our business Microsoft 365 and Microsoft Azure services, including our own software, rather than personal accounts. We agree a suitable way to share files with you and avoid email attachments where possible.
- Access is limited to the people delivering your AI Adviser, and every account uses multi-factor authentication.
- We use encryption in transit and at rest within the Microsoft 365 and Azure services used for this work.
- We use Microsoft 365 Copilot and our own software on Microsoft Azure, including Microsoft Foundry, to process agreed client information. That software is operated by The AI Adoption Lab Limited, not a separate company or sub-processor. Outside these agreed services, we use other AI tools only on material with personal data removed.
- Microsoft does not use your data to train the models behind Microsoft 365 Copilot.
5. Sub-processors
We use Microsoft for Microsoft 365 (file storage, email and Teams), Microsoft 365 Copilot and Microsoft Azure, including Microsoft Foundry, used by our own software. Processing takes place in the United Kingdom or the European Economic Area. Microsoft is bound by data protection terms no less protective than these, under the Microsoft Products and Services Data Protection Addendum, and engages its own sub-processors under that addendum.
We will tell you before we add or replace a sub-processor, and you may object on reasonable data protection grounds. If you do, we will not use the new sub-processor for your data until we have discussed the objection with you and resolved it.
6. International transfers
Our service processing is configured to take place in the United Kingdom or the European Economic Area. Processing in the EEA is permitted under the UK’s adequacy regulations. This does not exclude Microsoft support or service-operation access from other locations. Where that access involves an international transfer, it is subject to the applicable safeguards in Microsoft’s Data Protection Addendum, such as the UK International Data Transfer Addendum. If our own position ever needed to change, we would tell you first and rely only on an adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement.
7. Breaches
If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any event within 24 hours of becoming aware of it, with the information you reasonably need to meet your own obligations.
8. Return and deletion
When the standalone strategy engagement ends, or when any agreed ongoing monthly advice ends, we will return your files to you if you ask, and delete them and any copies we hold within 30 days, unless the law requires us to keep something. That includes our own copies of your strategy report and the notes we wrote for you, which may contain personal data from your files; you have them already. Copies held for a limited period in Microsoft's own backups are deleted by Microsoft on its own schedule, which we cannot shorten or verify; we say so rather than promise an erasure we cannot perform. This deletion provision covers client data processed to deliver the consultancy. Our own administrative records, such as booking and payment records, are covered separately by our privacy notice; retaining those records does not extend retention of client files or reports.
9. Information and audit
We will give you the information reasonably necessary to show that these terms are being met, and allow and contribute to reasonable audits by you or an auditor you appoint, with reasonable notice, at a mutually convenient time and subject to confidentiality. Email hello@theailab.co.uk.
10. How these terms fit with the rest
These terms apply alongside our terms & conditions, including the limits of liability in section 9 there. If the two conflict on how personal data is handled, these terms win.