Yorkshire, UK
Privacy and data handling
Our privacy notice covers this website, the portal that administrators use and the census that staff complete. AI Enablement Holdings Ltd, trading as AI Enablement Labs (company 17490026, Yorkshire, UK), is the data controller for the website and the portal.
For census responses, however, AI Enablement Holdings Ltd is the processor (acting on behalf of the organisation that runs the census), and the organisation that runs the census is the controller. Questions about the privacy notice should be sent to sales@aielabs.co.uk.
Draft for reviewThis notice has not yet been reviewed by a data protection specialist and is not in force. Points marked "to be confirmed" will be settled before the first live census.
If you are completing a census
We collect the business area the respondent chooses, the respondent's answers to the questionnaire, the time taken and the date.
Where the organisation has asked for them, we also collect answers to a few context questions (the respondent's role in a few words, years in the organisation, and how much of the working week is screen work). Where a respondent received a personal link, the use of that link is recorded.
We do not collect the respondent's name, email address, device identifiers or IP (internet protocol) address as part of the response, and the shared link collects no account details. We set no cookies on the questionnaire page. Ordinary web-server logs are recorded by our hosting provider – we do not join these logs to responses.
The organisation's administrators see results for each business area and never an individual response. A business area with fewer than 5 responses shows its count and no scores, due to the risk that an individual's answers may be inferred from so few responses. Administrators who send personal links can see that a link has been used, however they cannot see which business area was chosen or what was answered. The response rows (without names) are seen by AI Enablement Labs staff with the researcher role, for scoring, for quality checks and for the pooled analysis that builds the comparison set.
The organisation runs the census to find which of the four conditions limits how its people use AI. As such, we process responses on the organisation's instructions (as the processor).
To be confirmed: the lawful basis the respondent's organisation relies on (we expect legitimate interests, with the amnesty statement and this notice provided to staff beforehand) and the lawful basis for our own pooled analysis of responses (the analysis that builds the comparison set).
Responses from every organisation are pooled (with the organisation and the business area replaced by codes) to build the comparison set, against which each organisation's profile is read. Nothing in another organisation's report identifies a respondent, the respondent's business area or the respondent's organisation.
The organisation agrees to this pooling when it creates its account.
Responses without identifiers are kept for as long as the comparison set exists, due to the fact that removing these responses would change the comparison for every other organisation.
Free-text answers are reviewed before they enter the pooled set, and any incidental personal detail found in the review is removed. To be confirmed: the review period for free text and the retention of the "link used" record for personal links.
A response through the shared link carries no identifier. Thus, an individual response cannot be found or deleted by us after submission.
A personal link can be matched to its response only while the record for that link exists. A respondent can ask the organisation not to send them a personal link, can choose not to answer any item ("don't know" is an answer), or can decide not to take part. A respondent can also complain to the Information Commissioner's Office (ico.org.uk).
If you hold a portal account
We collect the administrator's name, work email address and a hashed password (not the password itself); the organisation's name, sector and size band; the business areas and rounds the administrator creates; and the email addresses the administrator enters for personal links.
A record of each sign-in to the administrator's account is also kept.
We use these details to run the administrator's account and the organisation's rounds, and to contact the administrator about those rounds. We do not sell or share an administrator's details, and we send no marketing without first asking the administrator.
An administrator's details are kept for as long as the account is active and for 12 months after the account closes, and are then deleted.
The anonymised responses collected in the organisation's rounds are not deleted with the account – these responses remain in the comparison set for as long as the comparison set exists.
The website is served by Netlify.
To be confirmed: the database host and its region, which will be named here before the first live census, together with the data-processing agreement that covers the database host.
If you are reading this website
The contact form, the enquiry form on the How to start page, the partner form and the register-interest form send what an enquirer types to our mailbox through Netlify Forms. We use these details to reply to the enquiry and for nothing else. The register-interest form on the launch page also records, in hidden fields, the source tags in the link the visitor followed, the name of the referring site and the address of the page they landed on, so that we know which channel brought each registration. Nothing is stored on the visitor's device for this.
Enquiries that do not lead to work are deleted after 12 months.
While the portal runs in demonstration mode, what a visitor enters is stored by the portal in that visitor's own browser storage, and nothing is sent to us.
Changes to the privacy notice are dated here, and the first draft is dated September 2026.
For your data protection lead
| Data | Subject | Controller | Purpose | Retention |
|---|---|---|---|---|
| Census answers, business area, duration | Staff | Your organisation (we process) | Profile by business area | Anonymised, kept in the comparison set |
| Pooled anonymised responses | Staff | AI Enablement Labs | The comparison set and its norms | Indefinite, without identifiers |
| Personal-link email and "used" flag | Staff | Your organisation (we process) | One-use links | To be confirmed |
| Administrator account details | Administrators | AI Enablement Labs | Running the account | Account life plus 12 months |
| Form enquiries | Enquirers | AI Enablement Labs | Replying | 12 months if no work follows |