← Back to home

Privacy

Privacy notice

Last updated 28 October 2026

This notice covers information used for The AI Lab’s website, training and advisory consultancy, why we use it, and the choices you have. We keep it short and plain. If anything is unclear, email hello@theailab.co.uk and we will help.

Who we are

The AI Lab is a trading name of The AI Adoption Lab Limited, a company registered in Scotland under company number SC900444, which provides practical AI training and strategic advice for people and organisations, based in Edinburgh and delivered across the UK. Benchmark Lab is another trading name of the same company. Our registered office is 5 South Charlotte Street, Edinburgh, EH2 4AN. The AI Adoption Lab Limited is the data controller for its own enquiry, booking, contact and website records. When we handle personal data supplied by a client on their instructions for advisory consultancy, the client is the controller and we act as their processor, as explained in the AI Adviser data processing terms. We are registered with the UK Information Commissioner’s Office under registration number ZC251110. For any privacy question, contact hello@theailab.co.uk.

What we collect, and why

• Enquiry form. When you send an enquiry we collect your name, work email, organisation and your message, so we can reply and arrange a call. If you tell us which session or course you are asking about, and how many people it is for, we keep that too, so we can quote accurately. If you ask us to call you back, we also collect your phone number and your preferred days and times, and we use the number only to make that call. Our lawful basis is our legitimate interest in responding to people who contact us.
• Taking an Index. Benchmark Lab operates the indices and produces their reports. For information about answers, results and reporting, read Benchmark Lab’s privacy notice and the information shown when you take an index. Benchmark Lab is a trading name of the same company. The AI Lab uses findings you choose to share with us for training or advice.
• Answers you gave on this site before the Indexes moved. We still hold earlier answers collected on this site in our customer records for three years from each response. Benchmark Lab holds a copy so your results remain available. Existing research use is based on our legitimate interest; you can object free of charge. See the retention and rights sections below.
• Your scores on a personal index you took through The AI Lab. This is the one exception to Benchmark Lab’s rule that a partner sees your result on a personal index only if you choose to share it with them. Where you take a personal index, such as the Personal AI Index, through The AI Lab’s link and answer it under version 10 or later of Benchmark Lab’s Index terms of use, The AI Lab sees your name, your headline scores on that index from your latest take through The AI Lab, and the day you took it, without your being asked. It never sees your answers or your report. This is because The AI Lab and Benchmark Lab are both trading names of the same company, The AI Adoption Lab Limited, so your result does not go to another organisation. It changes nothing else: your employer and your manager still never see your own result. We use your name and scores, as we use findings you share with us, for training or advice for you. Our lawful basis is our legitimate interest in following up the people who took an index through us. You can stop this at any time on your Benchmark Lab page, and it then stays stopped unless you choose to share with The AI Lab again. An index you took before those terms, or not through The AI Lab, is seen only if you choose to share it.
• Your Index results in Your training. Your training hub can show your own index results from Benchmark Lab, only to you. When you open it, we give your browser a short-lived signed identity confirmation to send to Benchmark Lab, carrying our own reference for you and, where it is the address you signed in with, your email address, so that Benchmark Lab can find the results you are authorised to see. Because The AI Lab and Benchmark Lab are both trading names of the same company, where you use the same email address on both sites your results can show here without you having to connect: your latest result on each index The AI Lab offers, when you took it and how it has moved. That covers an index you took through The AI Lab and answered under version 9 or later of Benchmark Lab’s Index terms of use, and, from version 11, an index you took any other way, on Benchmark Lab directly, through another partner or with your organisation. An index you answered before version 11 and did not take through The AI Lab shows only if you choose to connect it. Once an index shows here, it is your latest result on it that shows, whichever way you took it most recently. Until results can show this way, you may be asked to connect first. Your browser displays your results without this site storing them. Our lawful basis is our legitimate interest in showing your results alongside your training. You can stop your results showing here at any time under Connected sites on your Benchmark Lab page, and doing so does not affect the rest of the hub. If you stopped them yourself, you can turn them back on there with “Show my results there again”. We may still send your email address when you open the hub, even when no results show. Benchmark Lab uses it to check whether there is anything to show you and, because we are the same company, to tell this page whether you look after your organisation or read its figures on Benchmark Lab, so that we can link you to that page, or whether your address is on a domain an organisation has already set up there, so that we do not offer to set one up for you. It sends no organisation name and no figure for this, and tells us neither once you have stopped your results showing here. Benchmark Lab keeps no record of the address, and this site stores none of what comes back.
• Emails about our training. If you tick the box for it, we will send you a small number of emails about AI training for your team. Our lawful basis is your consent, and you can unsubscribe from any of them.
• Newsletter. If you tick the box for it, we will send you our newsletter, which is practical writing about using AI in an organisation, sent occasionally rather than often. Our lawful basis is your consent. It is a separate choice from the training emails: you can subscribe to one without the other, and unsubscribing from one does not stop the other. Every issue carries an unsubscribe link.
• Checking again after a course. Course follow-ups include optional invitations to repeat an index on Benchmark Lab. These service emails are separate from marketing; reply to a course email to stop the follow-ups. Our lawful basis is our legitimate interest in delivering your booked course. Benchmark Lab manages its own index emails and their opt-out controls, as explained in its privacy notice.
• Course emails and your replies. If you are booked onto a course, we send you a booking confirmation, a reminder before the day, and follow-ups afterwards. Those emails, and any email you send us at hello@theailab.co.uk, are kept in our customer records, so we have a record of what we sent you and what you told us. Our lawful basis is our legitimate interest in running the courses people have booked.
• Signing a contract. If we send you a contract to sign, the signing page records the name and job title you type, the two confirmations you tick, the time you sign, the IP address you used, your browser's user agent and the fingerprint of the document you were shown, together with the email address we sent the link to. That is the evidence of who signed, that they meant to, and what they signed, and we keep it with the signed contract. Our lawful basis is that it is necessary to enter into and perform the contract, and our legitimate interest in being able to show what was agreed.
• Signing in. You can sign in to see your training. We email you a sign-in link that works once and expires after 15 minutes. One other email also carries a link that signs you in: the email after a course you attended, which opens your hub. That link also works once, but lasts for 30 days, so that they still work when you get round to them. Using any of them sets one cookie that keeps you signed in for up to 30 days, or until you sign out. Once sign-in is shared with Benchmark Lab’s hub (described below), each time you use the hub we also check that your sign-in still counts: that your record is still active and still has the address you signed in with, and that you have not pressed “Sign out everywhere” since you signed in. Our lawful basis is our legitimate interest in letting you reach your own results, and nobody else's.
• Signing in with Microsoft or Google. Where it is offered, you can sign in with a Microsoft work or school account or a Google account. We ask the provider only for your basic sign-in details, and from its signed reply we keep the account’s fixed identifier and issuer, the email address it had when it was connected, and the dates, never a name or photo from it. An account is connected only to your own address here: when you connect one from Your details, we email that address a link to confirm it was you, which works once for a day. Where Microsoft or Google vouches for the address, as a work domain or Google mail does, signing in with that account connects it to your record straight away, or sets up your record, exactly as a first sign-in link would, if you do not have one. We email you whenever an account is connected or removed. We keep a connected account until you remove it under Your details or your record is deleted. If your address here changes, an account connected by the old one no longer signs you in and is deleted within a day of the change; to use it again, connect it afresh. A request you did not confirm stops working after its day and is deleted within a day after that. Microsoft and Google handle your sign-in with them under their own privacy terms. Our lawful basis is our legitimate interest in giving you a secure way to sign in.
• Passkeys. Where it is offered, one passkey works on both The AI Lab’s hub and Benchmark Lab’s, and Benchmark Lab holds it: this site stores no passkey. When you sign in with a passkey here, or add one, our server asks Benchmark Lab, in a signed request, to check it. To add one we send your email address, your name, how and when you signed in here and the name you give the passkey; to sign you in, Benchmark Lab tells us the addresses it holds for the person the passkey belongs to, and we sign you in on whichever of them is yours here. Your device keeps the private part of the passkey, and your fingerprint or face never leaves it. Once you hold a passkey, an emailed link alone no longer signs you in fully here, as on Benchmark Lab, and you are asked for your passkey too. To apply that, we ask Benchmark Lab, by your address, whether it belongs to someone on Benchmark Lab and whether they hold a passkey, when you sign in and at most every 15 minutes after; the answer is held for up to 15 minutes and not stored. Benchmark Lab’s privacy notice says what it keeps about a passkey. Our lawful basis is our legitimate interest in keeping your account secure.
• Moving between The AI Lab and Benchmark Lab. Where it is offered, if you are signed in on The AI Lab’s hub and follow a link to Benchmark Lab’s hub, or the other way round, you arrive signed in. The hub you are leaving tells the other who you are in a signed message that is accepted for little more than a minute and is not stored: its own reference for you, your email address and when you signed in. When you arrive here from Benchmark Lab, its reference for you is recorded in our service logs, as a note that the hand-off happened. From this hub it also says, where you proved that address here with an emailed link or with a Microsoft or Google account whose email it is, which of the two, so that Benchmark Lab can count the address as proved. Arriving here from Benchmark Lab signs you in exactly as an emailed sign-in link would, and sets up your record here if you do not have one. The hub you arrive at keeps a record of the hand-off for up to two minutes, holding a scrambled code and the page you were going to (which, for Benchmark Lab’s page for connecting your results, carries your email address); it is deleted as soon as it is used in time, and one that runs out first is deleted within a day. Each hub keeps its own sign-in: if you sign out of one, a sign-in the other hub already had does not sign you back in, though signing in afresh on either does. “Sign out everywhere” under Your details ends every sign-in you have on this hub and sends Benchmark Lab your address so that it can end yours there; pressing it on Benchmark Lab does the same here, by your addresses, and Benchmark Lab also does this when a Microsoft or Google account you use there is disconnected. Our lawful basis is our legitimate interest in letting you move between the two sites securely.
• Analytics. With your consent, we use Google Analytics to understand, in aggregate, how the site is used and which steps people take. Nothing is sent to Google unless you accept. Until you choose, and if you decline, our pages do not load Google's analytics tag at all, so no request goes to Google and no analytics cookie is set. If you accept in our cookie banner, Google Analytics sets first-party cookies (for example _ga) to measure visits. We do not use it for advertising: Google signals and ad personalisation are turned off, and IP addresses are anonymised. Our lawful basis is your consent, which you can withdraw at any time from "Cookie settings" at the foot of any page that uses analytics.

Advisory consultancy

We use the information agreed with you, including any benchmark findings you choose to share, to research and deliver your strategy package and any optional monthly advice.

For the AI Adviser service we process information with our own software, operated by The AI Adoption Lab Limited on Microsoft Azure, including Microsoft Foundry. It is not a separate company receiving your information. Where we process personal data in your files on your behalf, the AI Adviser data processing terms explain our responsibilities and the services we use.

Cookies

We do not set advertising cookies. What this site does store in your browser:

• Analytics cookies from Google Analytics (_ga and _ga_ followed by an identifier), only if you accept them in the cookie banner shown on your first visit. If you decline, or have not chosen yet, Google's tag is not loaded and nothing is sent to Google.
• Your cookie choice, kept in your browser's local storage so that we do not ask on every page. This is strictly necessary to remember your choice.
• A sign-in cookie, if you sign in to see your training, which keeps you signed in for up to 30 days or until you sign out. It is strictly necessary for signing in and is not used for anything else.
• Short-lived sign-in cookies, also strictly necessary: one for up to ten minutes while you sign in with Microsoft or Google, one for up to an hour while you confirm connecting a Microsoft or Google account from the link we emailed, one for up to two minutes while you arrive from Benchmark Lab’s hub, and, when you sign out, one that remembers for up to 30 days that this browser signed out, so that a sign-in Benchmark Lab’s hub already had does not sign you back in here.

You can change your analytics choice at any time: "Cookie settings", at the foot of every page that uses analytics (this one included), reopens the banner. Your account pages do not use analytics, so they have no banner and no such link. If you withdraw consent, we stop analytics straight away and delete the analytics cookies from your browser. Clearing this site's data in your browser also brings the banner back.

Who we share it with

We use a small number of trusted providers to run the site and contact you. They process data on our behalf, under contract, and only as needed:

• Microsoft Azure and Microsoft 365 host the website, our customer records and our email, and send the course emails described above. Microsoft Azure, including Microsoft Foundry, also processes information through our own software for the AI Adviser service.
• Azure Communication Services sends our other automated emails, such as sign-in links.
• Google Analytics provides aggregate usage measurement when you consent.

Benchmark Lab is not on this list because it is not a separate company: what passes between this site and Benchmark Lab, as described above, stays within The AI Adoption Lab Limited.

We do not sell your information, and we do not use it for advertising.

Where your information is held

Your contact details, your course records and any Index answers you gave on this site before the Indexes moved are stored in Microsoft Dataverse in the United Kingdom. Some of the Azure services that run this site are hosted in Microsoft's West Europe region, in the Netherlands. UK law recognises the European Economic Area as protecting personal data adequately, so no further safeguard is needed for those. Our own software’s processing for the AI Adviser service takes place in the United Kingdom or the European Economic Area using Microsoft Azure and Microsoft Foundry. If you accept analytics, Google may process that data outside the UK, including in the United States.

How long we keep it

Advisory client files and reports. These are separate from our administrative records. When the strategy engagement ends, or any agreed ongoing monthly advice ends, we return client files if requested and delete our copies, including reports and notes containing client personal data, within 30 days unless the law requires retention. Microsoft backup copies follow the arrangements described in the AI Adviser data processing terms. The contact, booking and correspondence periods below concern our administrative records; they do not extend the retention of client files or report copies held to deliver the consultancy.

Answers you gave on this site: three years. Each set of answers is kept for three years from the day you gave them, and then deleted. The research record holds no name, email address, organisation or exact date, so from that day nothing in it can be matched back to you. If you take an Index more than once, or take more than one, each set has its own three years rather than the newest one extending the older ones.

Your contact details: three years from the last time we heard from you. If you keep in touch, or book with us again, that clock keeps resetting, which is the ordinary way a business keeps a customer's details. Unlike the deletion of your answers, this is not yet done automatically. If you have booked a course, your contact details are also part of your booking record and are kept with it, as described below.

If you ask us not to contact you, we keep the minimum needed to honour that, which is enough to recognise your address so we do not email you again by mistake. We keep that for as long as the promise lasts, which is indefinitely. It is the one thing we do not delete on request, because deleting it is what would let us contact you again.

If you have booked or attended a course, we keep your booking record and the related emails for as long as we are working with you or your employer, and for a reasonable period afterwards. Enquiries are kept for as long as we need them to respond to you and for a reasonable follow-up period. You can ask us to delete any of it sooner at any time.

Published research findings stay published. Once a figure about a group has been published, objecting or asking us to delete your answers does not remove it, but it does mean your answers are not used in anything we work out from then on.

Your rights

You have the right to ask for a copy of the information we hold about you, and to have it corrected or deleted.

Where we rely on your consent - for training emails, the newsletter, analytics, and research use if you gave your permission as part of a course - you can withdraw at any time, and we stop using your information for that from then on. Withdrawing one does not affect the others, and none of them affects your training or your results.

Where we rely on our legitimate interests, which covers running the courses you book, showing you your own results in Your training, The AI Lab seeing your name and scores on a personal index you took through it, signing you in with Microsoft or Google, checking with Benchmark Lab whether you hold a passkey, signing you in securely across The AI Lab and Benchmark Lab, Benchmark Lab telling this page whether you look after your organisation there or your address is on a domain already set up, and using the answers you gave on this site in our benchmark, you have the right to object. For the benchmark, we simply stop, and it costs you nothing. For anything else, we stop unless we have a compelling reason not to that overrides your rights, which we would explain.

To exercise any of these, email hello@theailab.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk). Our ICO registration number is ZC251110.

Changes

If we change how we use your information, we will update this page and the date above.

Back to the site