# boardiqo Privacy Notice (v1.1)
## Who is responsible
boardiqo is operated by STREDGEPARTNERS, registered office 167 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom, place of registration London, United Kingdom. STREDGEPARTNERS is the controller of the personal data described in this notice.
Data-protection contact: contact@stredgepartners.co
## What we collect
Account and profile information, governance experience you enter, assessment responses, evidence documents you upload, purchase and billing records, consent records, and technical logs needed to operate and secure the service.
## Why we process it, and on what basis
- Delivering the assessment, evaluation, scoring and report you requested — performance of our contract with you.
- Generating AI-assisted evaluations of your responses and evidence — performance of our contract, with your separate recorded consent to AI processing.
- Taking payment, issuing receipts and keeping accounting records — performance of our contract and compliance with a legal obligation.
- Security, fraud prevention, audit logging and service integrity — our legitimate interests in operating a trustworthy service.
- Service and lifecycle emails about your own assessment — performance of our contract; optional marketing only with your consent.
## How long we keep it
- Assessment responses, evidence and reports: for as long as your account is active, so you can revisit and export them.
- After a deletion request: erased within 30 days at the latest.
- Accounting and payment records: retained as an anonymised billing record for the period required by tax and company law, without your assessment content.
- Audit and security logs: retained for the period needed to investigate incidents and to evidence access to confidential material.
- Contact enquiries: 24 months from last contact.
## Who processes data for us
We use sub-processors in four categories, each under a data-processing agreement: hosting and database, transactional email, payment processing, and AI evaluation. The named list is provided on request under NDA. Production data is hosted in the European Union (Paris region). Data is encrypted in transit with TLS 1.2 or above and at rest with AES-256.
## AI processing
Your responses and linked evidence may be processed by AI models to evaluate quality and produce summaries. Outputs are tagged, traceable and, where a critical finding arises, reviewed by a person before a report is released. See the AI Processing Notice.
## Confidentiality
Board and committee data is treated as confidential and is access-controlled by workspace membership and role. Your report is yours: we do not disclose it to an employer, a board or a search firm.
## Your rights
Where data-protection law applies to you, you hold rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Exercise them in your account settings or by writing to the data-protection contact above. You may also complain to your national data-protection authority.