Draft, not legal advice. This notice is a draft for Fedworks to review. It is not in force, and the parts marked "Lee to confirm" are open.
AI training
Privacy notice
AI training helps organisations write an AI policy, train their people on it, test their understanding and record that they have read it. Fedworks Ltd ("Fedworks", "we") runs it. This notice explains what personal data the service holds about you, why, who else handles it, and your rights.
Who is responsible
Your organisation (the employer or business that invited you) decides why your data is used: it is the controller. Fedworks processes the data on its behalf, under a data processing agreement with it: we are its processor. For questions about how your organisation uses your training records, ask the person who invited you or the contact your organisation's AI policy names.
Fedworks is the controller only for its own business records: who signed a contract with us, and our own staff's accounts.
Lee to confirm: Fedworks Ltd's registered address, company number, ICO registration number and a privacy contact address, before this notice is published.
What we hold
- Your name, work email address, role (learner, admin or approver), team, and whether you are a manager, as your organisation gave them.
- How you signed in: by email link, or with Microsoft or Google if your organisation offers them (for Microsoft, your organisation's tenant ID and your account's object ID, which is how we recognise you).
- Your training: which modules and exercises you finished, and when.
- Your test: the questions you were given, your answers, your score and the result for each policy clause.
- Your sign-off: the policy version and fingerprint you signed, when, and the IP address and browser you signed from. Your certificate shows your full name; its public check page shows only your first name and the initial of your surname.
- Tips: when you opened a tip and your answer to its question.
- A record of actions in the service (the audit log), such as signing in and changing settings.
- If you are an admin or approver: the interview answers and the policy text you write and approve, which may name colleagues (for example the policy owner).
We don't use your data for advertising, sell it, or use it to train AI models.
Why
To give you the training, test and sign-off, and to give your organisation evidence of AI literacy and of its AI policy being understood (for example for ISO 42001, to which the service is aligned, and the EU AI Act Article 4). Your organisation decides the lawful basis for this; for most employers it is their legitimate interests or a legal obligation. Lee to confirm with an adviser.
Who else handles it
We use these companies to run the service. Each acts on our instructions under its terms with us.
| Company | What for | What data | Where |
|---|---|---|---|
| Amazon Web Services EMEA SARL (AWS) | Hosting: the application, its database, backups, rendered videos, logs. | Everything the service holds. | AWS Europe (London) region, eu-west-2, in the UK. |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending email: invitations, sign-in links, re-sign reminders, tips by email. | Recipient name and work email address, and the message. | AWS Europe (London) region, eu-west-2. |
| Anthropic, PBC | Drafting: Claude drafts the AI policy, test questions and tips, which a person at the organisation reviews and approves. | The organisation's interview answers and published policy, which can include the names and job titles of the people the policy names (for example its owner and approver). Never staff lists, test answers, scores or sign-offs. | United States (Anthropic's API). Lee to confirm the transfer mechanism and Anthropic's data retention under its commercial terms. |
| Microsoft (Entra ID), Google | Sign-in, when the organisation offers it. The organisation's own account provider, not a processor for this service. | Name, work email, and the account identifiers (Microsoft tenant and object IDs). | The provider's own terms with the organisation. |
| Microsoft (Teams), Slack | Delivering tips to the organisation's own channel through a webhook the organisation sets up. | The tip (no personal data); a tracked link. | The organisation's own tenant. |
How long
For as long as your organisation uses the service. When it stops, or asks us to, we delete its organisation and everything in it, including your account unless you belong to another organisation on the service. Backups are kept for 14 days and then expire, so deleted data leaves the backups within 14 days of deletion. Your organisation may export an evidence pack before then; it keeps that copy under its own rules.
Security
The data is kept in the UK, encrypted at rest and in transit. Each organisation's data is kept apart from every other's, by the application and, as a second guard, by the database itself. Sign-in is by invitation only. Webhook addresses for Teams and Slack are encrypted.
Your rights
You can ask to see your data, to correct it, to have it deleted, to restrict or object to its use, and to receive it in a portable form. Ask your organisation first (it decides); we help it answer. You can also complain to the Information Commissioner's Office (ico.org.uk). Lee to confirm the wording with an adviser.
Changes
We will update this notice when the service changes what it does with personal data, and say so in the service.