Privacy Notice

This Privacy Notice explains what Private AI Ltd does with personal information that it collects in its own right as a data controller. This means information that we collect through our website, through correspondence with us, and through our marketing and business-development activities. It does not cover personal data that we process on behalf of our clients within their AI deployments; that processing is governed by the Master Services Agreement and the Standing Data Processing Agreement in force between Private AI Ltd and the relevant client, and is the responsibility of the client as data controller.

---

Who We Are and How to Contact Us

Data controller: Private AI Ltd

Company number: SC881079 (registered in Scotland)

Registered office:

Private AI Ltd
48 West George Street
Office 2/3, 2nd Floor
Glasgow
Scotland
G2 1BP

Privacy and data protection enquiries:  privacy@privateai.scot

General business correspondence:  team@privateai.scot

The privacy mailbox is monitored every working day and is the single canonical channel for data subject rights requests, data protection complaints, processor-assistance requests under Article 28 of the UK GDPR, and correspondence from the Information Commissioner’s Office (and, when its rebrand under the Data (Use and Access) Act 2025 takes effect, the Information Commission).

Data Protection Officer

Private AI Ltd has assessed its obligation to designate a Data Protection Officer under Article 37(1) of the UK GDPR and concluded, on the basis of its current processing activities, that the statutory triggers for mandatory designation are not engaged. We have therefore not appointed a Data Protection Officer at this time. The assessment is documented internally, kept under review, and will be revisited on defined operational triggers including the execution of our first paying client contract in the regulated legal or healthcare sectors.

All data protection enquiries, rights requests, and complaints are handled through the canonical privacy contact at privacy@privateai.scot.

What Information We Collect and Why, at a Glance

The table below summarises each processing activity. Full detail follows in the next section.

Providing your business contact details when you submit an enquiry or correspond with us is a contractual requirement of any subsequent engagement and is necessary for us to respond. If you do not provide them we cannot reply. Outside of an enquiry context, providing personal data to us is not a statutory or contractual requirement.

The Detail of Each Processing Activity

Responding to enquiries and providing services to clients

Personal data: Names; business email addresses; business telephone numbers; job title and organisation; correspondence; records of meetings, calls, and decisions taken with you.

Why: To respond to enquiries, scope and deliver services, and maintain our commercial relationship with you and your firm.

Lawful basis: Where we have a contract with you or your firm, processing is on the basis of Article 6(1)(b) of the UK GDPR (performance of a contract, or steps prior to entering into a contract at your request). Where no contract is yet in place, the basis is Article 6(1)(f) legitimate interests — our legitimate interest in responding to a business enquiry made to us. The privacy impact is minimal as we process only the business contact details necessary to respond, and you initiated the contact.

Marketing and service updates

Personal data: Names; business email addresses; job title and organisation.

Why: To send service updates, security advisories, and targeted business-to-business communications about sovereign AI infrastructure that may be relevant to regulated professional services firms.

Lawful basis: Where you have opted in, the basis is Article 6(1)(a) consent. Where you are an existing business contact in a similar role at a firm we have previously engaged with, the basis is Article 6(1)(f) legitimate interests; our legitimate interest is the efficient marketing of relevant services to a defined commercial audience. In either case you may opt out at any time by following the unsubscribe link in any communication or by emailing privacy@privateai.scot. We do not share marketing contact details with external third-party marketers.

Complying with legal and tax obligations

Personal data: Name; contact information; invoice records; bank-transfer records; counterparty details on transactions.

Why: To comply with UK tax, accounting, anti-money-laundering, and regulatory obligations.

Lawful basis: Article 6(1)(c) legal obligation.

Investigating and resolving queries, complaints, and claims

Personal data: Names; business contact details; correspondence and supporting records relating to the query, complaint, or claim.

Why: To investigate, address, and resolve queries, support requests, complaints, and potential legal claims, including coordinating any Just-In-Time access requests required to resolve a technical query under the Master Services Agreement.

Lawful basis: Where the matter arises under a contract, Article 6(1)(b) contract. In other cases, Article 6(1)(f) legitimate interests — our legitimate interest in providing professional customer service and protecting our business in any legal claim. We process only the information necessary to resolve the matter.

Operating the website and cookieless analytics

Personal data: Transient IP address; technical request metadata such as browser type, referrer, and page path.

Why: To deliver the website, protect against abuse, and understand minimal traffic patterns.

Lawful basis: Article 6(1)(f) legitimate interests — our legitimate interest in operating and securing the website. The analytics service is cookieless and does not set identifiers in your browser.

Where We Get Personal Information From

We collect personal information from the following sources:

• Directly from you — when you submit an enquiry through the website contact form, email us, telephone us, meet with us, or enter into a contract with us.
• Publicly accessible sources — including company websites, professional directories, LinkedIn, the Law Society of Scotland and other professional registers, and Companies House.
• Independent referral partners and professional contacts — limited business-contact information (name, job title, business email, company name) where a partner or professional contact makes an introduction to a firm that may benefit from our services.

Where we obtain personal data from a source other than you directly, we will provide you with this Privacy Notice at the latest when we first communicate with you, or within one month of obtaining the data, whichever is sooner. This complies with our obligations under Article 14 of the UK GDPR.

How Long We Keep Information

We retain personal information only for as long as is necessary for the purposes for which it was collected. Specific retention periods are:

How We Keep Your Information Secure

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, alteration, or disclosure, as required by Article 32 of the UK GDPR. These measures include encryption at rest and in transit, access controls with multi-factor authentication, regular backups, and careful selection of vendors who meet equivalent standards. A summary of our security measures is available on request by emailing privacy@privateai.scot.

Who We Share Information With

Processors acting on our behalf

The following processors support Private AI Ltd’s own corporate operations — our website, email, and analytics — and are entirely separate from any client AI deployment. They have no involvement in, and no access to, client AI infrastructure or any personal data processed within a client deployment:

• Cloudflare, Inc. (United States) — provides DNS, content delivery, and website hosting for the privateai.scot website; hosts a Cloudflare Worker that processes website contact-form submissions; hosts the self-hosted Counterscale website analytics service (operating on Cloudflare Workers and writing to the Cloudflare Analytics Engine dataset); and acts as the domain registrar for our domains other than privateai.scot.
• Migadu Email Services (Switzerland; mail servers located in France) — provides corporate email hosting (sending, receiving, and storage of business correspondence). Inbound enquiries received by email — including replies to website contact forms and complaints submitted to privacy@privateai.scot — are processed by Migadu in the course of email delivery.

No client data from any client AI deployment, no client deployment traffic, and no client authentication traffic passes through Cloudflare or Migadu.

Other organisations to whom we may disclose personal data

We may disclose personal data to the following categories of recipient where the disclosure is necessary and lawful:

• Our external legal counsel — for the purpose of obtaining legal advice or conducting legal proceedings.
• Our accountants and auditors — for the purpose of preparing statutory accounts and tax returns.
• HM Revenue & Customs — for the purpose of complying with UK tax law.
• The Information Commissioner’s Office (and, in due course, the Information Commission) — in the course of responding to regulatory enquiries or notices.
• UK courts, law enforcement agencies, and other regulators — where we are legally obliged to disclose personal data, or where it is necessary for the establishment, exercise, or defence of legal claims.
• A purchaser or successor entity — in the event of a sale, merger, or restructuring of Private AI Ltd; in such case we would inform you in advance and ensure that the recipient was bound by equivalent obligations.

Sharing Information Outside the UK

Where our processors share personal information outside of the UK, they do so in compliance with the UK GDPR and with appropriate safeguards in place.

You may request a copy of the appropriate safeguard for any of the above transfers by emailing privacy@privateai.scot.

Cookies, Analytics, and Similar Technologies

The privateai.scot website does not set any cookies and does not use local storage, session storage, or similar tracking technologies on visitors’ devices. Our self-hosted Counterscale analytics is configured in cookieless mode and does not store identifiers in your browser. The processing of transient request metadata for analytics purposes is carried out on the lawful basis of legitimate interests (see “Operating the website and cookieless analytics” above).

Automated Decision-Making and Profiling

We do not currently use your personal data for solely automated decision-making that produces legal effects concerning you or that similarly significantly affects you, as defined by Articles 22A to 22D of the UK GDPR (as inserted by the Data (Use and Access) Act 2025). We do not engage in profiling.

If this changes, we will update this Privacy Notice before any such processing begins, and we will ensure that the safeguards required by Article 22C — meaningful notice, the right to make representations, the right to obtain human intervention, and the right to contest the decision — are available to you.

Children

Our services are business-to-business and aimed at professional services firms. We do not knowingly collect or process personal data of children under the age of eighteen. If you believe we have inadvertently received personal data of a child, please contact privacy@privateai.scot and we will delete it promptly.

Your Data Protection Rights

Under UK data protection law, you have rights in respect of your personal data. The rights below apply in different ways depending on the lawful basis we rely on for the relevant processing:

• Your right of access — you may request a copy of your personal data, together with related information about our processing of it. Some exemptions may apply.
• Your right to rectification — you may ask us to correct personal data that is inaccurate or incomplete.
• Your right to erasure — you may ask us to delete your personal data in defined circumstances.
• Your right to restriction of processing — you may ask us to limit how we use your personal data.
• Your right to object to processing — you may object to processing carried out on the basis of legitimate interests or for direct-marketing purposes.
• Your right to data portability — for processing based on consent or contract and carried out by automated means, you may ask us to transfer your personal data to you or to another organisation in a structured, commonly used, machine-readable format.
• Your right to withdraw consent — where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
• Your right not to be subject to a solely automated decision — see “Automated decision-making and profiling” above.
• Your right to lodge a complaint with the Information Commissioner — see “How to complain” below.

To exercise any of these rights, please email privacy@privateai.scot or write to us at the registered office address above.

We will respond to your request without undue delay and in any event within one month of receipt. Where a request is complex or where we have received a number of requests from you, we may extend the response period by up to two further months and will inform you within the first month of any such extension and the reasons for it.

How to Complain

If you have any concerns about our use of your personal data, you can make a complaint to us by email to privacy@privateai.scot or by post to the registered office address at the top of this notice. Complaints made by any other channel — including by telephone, post, or in other written correspondence — will also be accepted and handled in accordance with the process below.

Our complaint-handling process

This complaint-handling process operates under section 164A of the Data Protection Act 2018, as inserted by section 103 of the Data (Use and Access) Act 2025 and in force from 19 June 2026.

We will:

1. Acknowledge receipt of your complaint in writing within 30 days of the day we receive it, regardless of the channel through which you contact us. The acknowledgement will confirm receipt and explain, at a high level, what will happen next.
2. Investigate your complaint without undue delay, beginning from the day we receive it. We will make appropriate enquiries, review relevant records, and liaise with relevant teams as needed.
3. Keep you informed of the progress of our investigation, particularly where the investigation is likely to take a significant period of time.
4. Communicate the outcome to you in writing when our investigation is complete, with an explanation of how we reached our conclusion and any action we have taken as a result.

Records we keep

We maintain a Data Protection Complaints Register recording the date your complaint is received, the date acknowledgement is sent, key dates of investigation milestones, the outcome, and the actions we have taken. These records are retained for seven years from the date the complaint is closed.

Complaining to the Information Commissioner

If you remain unhappy with how we have handled your complaint, you may complain to the Information Commissioner’s Office under section 165 of the Data Protection Act 2018. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Information Commissioner’s Office:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

Online:  https://www.ico.org.uk/make-a-complaint

The Data (Use and Access) Act 2025 will, in due course, rename the Information Commissioner’s Office as the Information Commission; this Privacy Notice will be updated when the rebrand takes effect.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time. When we do, we will revise the “Last updated” date at the top of this notice. Where the changes are material, we will take reasonable steps to bring them to your attention before they take effect.

---

Last updated: 20 May 2026