Privacy Policy

1. Data Controller

The data controller for the processing of personal data described in this Privacy Policy is:

• Company: AktAI
• Legal form: Norwegian Enkeltmannsforetak (sole proprietorship)
• Contact: support@aktai.eu

2. Data We Collect

We collect and process the following categories of personal data:

3. Purpose of Processing

We process personal data for the following purposes:

• Account data: To create and manage your account, authenticate your identity, and communicate with you about the service.
• Organization data: To configure the platform for your organization, provide tailored compliance guidance, and support multi-user access within your organization.
• AI system data: To perform risk classification, generate compliance documentation, and maintain your AI system inventory.
• Employee data: To deliver and track AI literacy training, manage team compliance assignments, and generate training completion reports.
• Usage data: To improve the platform, monitor performance, identify and fix issues, and understand how features are used.
• Payment data: To process subscription payments, manage billing, and comply with financial record-keeping obligations.

4. Legal Basis (GDPR Article 6)

We process your personal data on the following legal bases under the General Data Protection Regulation:

• Contract performance (Article 6(1)(b)): Processing of account data, organization data, AI system data, and employee data is necessary for the performance of the contract between you and AktAI, namely the provision of the compliance assistance platform.
• Legitimate interest (Article 6(1)(f)): Processing of usage data for analytics, platform improvement, security monitoring, and fraud prevention is based on our legitimate interest in operating and improving the service, provided that such interests are not overridden by your rights and freedoms.
• Consent (Article 6(1)(a)): Processing for the purposes of marketing emails and non-essential cookies is based on your explicit consent, which you may withdraw at any time.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

6. Third-Party Processors

We share personal data with the following third-party processors, each of which is bound by a data processing agreement:

7. International Data Transfers

Some of our third-party processors are located outside the European Economic Area (EEA). When personal data is transferred to countries that have not received an adequacy decision from the European Commission, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We have entered into EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with each US-based processor to ensure an adequate level of data protection for international transfers.
• Adequacy decisions: Where available, we rely on European Commission adequacy decisions as a basis for data transfers.
• Data Processing Agreements: All processors processing personal data on our behalf are bound by data processing agreements that require compliance with GDPR-equivalent data protection standards.

8. Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data.
• Right to rectification: You have the right to request correction of inaccurate personal data.
• Right to erasure: You have the right to request deletion of your personal data under certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to restriction: You have the right to request restriction of processing of your personal data under certain circumstances.
• Right to object: You have the right to object to the processing of your personal data based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The relevant supervisory authority for AktAI is the Norwegian Data Protection Authority (Datatilsynet).

To exercise any of these rights, please contact us at support@aktai.eu. We will respond to your request within 30 days.

9. Cookie Policy

We use cookies and similar technologies on our platform:

• Essential cookies: Required for the platform to function correctly (e.g., authentication, session management). These are set by default and cannot be disabled.
• Analytics cookies: Used to understand how visitors interact with the platform. These are only set with your explicit consent.
• Session cookies: Temporary cookies that are deleted when you close your browser. Used to maintain your session state.

You can manage your cookie preferences at any time through the cookie settings on our platform.

10. Children's Privacy

AktAI is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data as promptly as possible. If you believe that a child under 16 has provided us with personal data, please contact us at support@aktai.eu.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. For material changes, we will provide at least 30 days' advance notice by email to the address associated with your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

12. Contact

If you have any questions about this Privacy Policy or wish to exercise your data subject rights, please contact us at:

support@aktai.eu

If you are unsatisfied with our response, you have the right to lodge a complaint with the Norwegian Data Protection Authority:

• Datatilsynet
• Website: www.datatilsynet.no