Privacy notice

Who we are

AI Risk Readiness is provided by Lumaris Consulting Ltd, trading as Lumaris Consulting, a company registered in England and Wales with company number 17533997, registered office 20 Wenlock Road, London, England, N1 7GU.

Lumaris Consulting is the data controller for the personal information described here.

For questions about your personal information or to exercise your data protection rights, contact privacy@airiskreadiness.com

Do you have to give us information?

You do not need to give your name or contact details to take the assessment. If you want to book a results review, you need to give the contact and organisation details needed to arrange it. Sharing your result is optional and is never required to book.

The assessment

Your answers describe your organisation's AI governance. While you take the assessment, we save your answers against a random code held in a cookie on your device, so you can return and carry on. When you finish, we calculate an indicative result and keep it with your answers. You see your result through a second random code held in a cookie.

We keep only a one way coded version (a hash) of each code, so the codes themselves cannot be read from our records.

We do not store your name with your answers. Your answers and result are still personal information, because they can be linked to you: while the cookies are on your device, and if you choose to share your result with us.

The assessment calculates an indicative result automatically from your answers. It is meant to support a conversation about your organisation's AI governance. We do not use it to make decisions about you that have legal or similarly significant effects.

We never sell your answers or your result.

Your report

You can print your report or download it as a PDF. The PDF is created when you ask for it and is not stored. We count requests to print reports and PDFs successfully prepared, without linking these counts to anyone.

Booking a results review

You book a free results review on a booking page that HubSpot provides for Lumaris Consulting. The booking form asks for your name, work email, organisation and your role, chosen from a short list.

It also asks three questions about your organisation: whether it is regulated, how many people it employs and the region where it is based. We use these answers to check that the free review suits your organisation and to prepare for it.

Your exact job title and a share code are optional. These details are held in HubSpot, not in the assessment.

The booking link also tells us how you found the assessment, for example the campaign or channel that brought you. Those labels are recorded with your booking in HubSpot.

Sharing your result

Sharing your result is your choice. If you tick "Share my results with Lumaris Consulting so they can prepare for my review", we create a share code and show it to you. If you paste it into the optional share code question when you book, we can find the result you saw and read it before your review. Without your code, we cannot link your booking to your result.

There are two separate time limits:

• The code itself works for 30 days from when we create it. After that it finds nothing, and the copy of your result kept with it is deleted.
• A code you entered in a booking is cleared from your booking after your review, or at the latest 30 days after you booked if the review does not take place.

If you get a new code, the old one stops working at once, and the copy of your result kept with it is deleted. That does not remove an old code you have already entered in a booking, and it cannot undo anything we read before. To stop sharing, email us. We disable your code, delete the copy of your result kept with it, clear the active code from your booking and do not look up your result again. Earlier code values may remain in HubSpot's property history, as described under Who receives it.

A share code only lets us find your result. It cannot be used to see a result in the assessment.

If you take part in the pilot

From 16 November 2026, a small number of invited people test the assessment before it opens to everyone. If you are invited, we use your name and contact details from your existing professional contact with Lumaris Consulting to invite you and arrange the pilot.

During the pilot, we contact participants about testing and feedback. We do not send promotional follow up emails as part of the pilot.

Each participant receives a personal access code. We keep only a hash of each code. Pilot access codes are used only to control access. We do not record which access code produced an assessment or result. You can choose to share your result separately when booking a review. Codes stop working when the pilot ends.

Participants can give feedback through a Google Form. The form does not ask for your name, email address or share code and does not need you to sign in. Please do not include names in your answers. Any findings we keep have names and other identifying details removed first. Because the pilot group is small, we do not describe the responses as anonymous.

We delete pilot invitation records, access code records and feedback within seven days of the pilot closing. While the pilot runs, we regularly review whether we still need to collect and keep this information. Assessment answers and results created during the pilot follow the normal assessment retention periods described below.

Contact details we already held before the pilot are kept under our existing professional relationship with you, as the Lumaris Consulting privacy policy explains at lumarisconsulting.com/privacy-policy

Keeping the site working and secure

When you visit, our hosting provider receives your IP address and browser details so it can deliver pages, check that requests come from a person rather than an automated program, and limit repeated requests. We keep counts of refused or suspicious requests, with no IP address or other identifier.

During the pilot, our hosting provider counts attempts to enter an access code from each network address for 10 minutes, to stop guessing. The count holds no access code.

Our hosting provider keeps request logs for up to 30 days, and keeps records of its firewall and automated request checks under its data processing terms, for security purposes only.

If a page fails, an error report is sent to our error monitoring service. Our settings are designed to remove personal information before a report is sent. Reports can still show the approximate location of our own server.

Fonts are served from this site, so your browser does not contact a font service. The site runs no analytics.

Why we use your information

We have weighed these interests against your rights and expectations. You can ask us for a copy of that assessment.

After public launch, we may send one personal email following your results review about working with Lumaris Consulting. This is direct marketing. We send it only where the applicable data protection and electronic marketing rules permit it. For corporate subscribers, we may rely on legitimate interests where appropriate. For individual subscribers, we require consent unless a valid exception applies. If we cannot establish which rules apply, we require consent. We send no more than one such email in any 12 months. Each email identifies Lumaris Consulting and explains how to opt out. If you object, we stop marketing to you and keep only the information necessary to respect your choice.

When we look at trends, we never publish anything that could identify an organisation. We never publish figures based on fewer than 10 responses, and we hold back other figures where a small or distinctive group could be recognised.

How long we keep it

The 12 month retention period restarts when the person books or attends a review, responds about their review, or makes a substantive request relating to their booking, review or agreed actions. It may also restart where Lumaris is actively carrying out agreed follow up work that genuinely requires continued retention. Unrelated enquiries, unanswered emails, routine marketing and administrative reminders do not automatically restart the period.

Who receives it

These suppliers process information to provide their services to us under their data processing terms. Some may also process limited service or account information for their own purposes, as their own privacy terms explain. You can ask us for details of the transfer safeguards described below.

We use Vercel to host the site. Where Vercel processes personal information outside the UK, its data processing addendum protects the transfer with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

We use Supabase to store assessment answers, results and share codes in a database hosted in London, UK. Supabase creates daily database backups, currently retained for seven days. Information deleted from the live database may remain in these backups until they expire. Supabase and its subprocessors may process certain information outside the UK for support, security and operational purposes. International transfers are protected by contractual safeguards, including the UK Addendum to the EU Standard Contractual Clauses.

We use HubSpot to arrange results reviews and manage our contact with you. When you book, HubSpot stores your name, work email, organisation and role, your answers about your organisation, booking time and where the booking came from. It also stores your job title and share code if you provide them. HubSpot hosts our account in its EU data centre. HubSpot and its subprocessors may process certain information outside the UK and EU, including in the United States. These transfers are protected by applicable safeguards under HubSpot's data processing terms, including the UK Extension to the EU-US Data Privacy Framework or the EU Standard Contractual Clauses with the UK Addendum.

When a share code expires or is cleared, we remove its active lookup information so it can no longer be used to retrieve your assessment result. HubSpot may retain the previous code in the contact's property history while that contact record is retained. These records remain subject to our contact retention and deletion procedures.

We use Sentry to detect and fix errors on our site. Our error reporting controls are designed to prevent assessment answers, share codes and unnecessary personal information from being included in error reports. We also use Sentry's data scrubbing controls and have configured Sentry not to store visitors' IP addresses. Sentry stores error reports in its European Union region and retains them for 30 days. Sentry and its subprocessors may process certain information outside the UK and EU, including in the United States. International transfers are protected by applicable safeguards under Sentry's data processing terms, including the EU-US Data Privacy Framework and its UK Extension, or the EU Standard Contractual Clauses with the UK Addendum.

We use Google Workspace for our airiskreadiness.com email, pilot feedback form and internal records. Google may store and process this information in data centres outside the UK, including in the European Union, United States and other countries. International transfers are protected by applicable arrangements under Google's Cloud Data Processing Addendum, including recognised adequacy arrangements and contractual safeguards such as Standard Contractual Clauses where required.

Your rights

You can ask for a copy of your personal information and ask us to correct it, delete it or restrict how we use it.

You can object to any use based on legitimate interests. An objection to marketing takes effect as soon as we receive it.

If we rely on your consent to send marketing, you can withdraw it at any time by contacting us or using the opt out link in the email. Where the right applies, you can also ask for personal information you gave us in a portable format.

We do not store names with assessment answers. If you did not share your result, we may not be able to tell which answers are yours, and we will tell you so rather than ask for more information. If you shared your result and the share code is still active, the code lets us find it. After the code expires, we may not be able to tell which assessment is yours from your booking.

To make a request, email privacy@airiskreadiness.com We may ask you to reply from the work address you booked with, to confirm it is you. We reply within one month, and tell you if we need longer and why.

If you have a concern about how we handle your personal information, you can complain to us at privacy@airiskreadiness.com We acknowledge complaints within 30 days, investigate them without undue delay, keep you informed about progress and explain the outcome.

You can also complain to the Information Commissioner's Office at any time, on 0303 123 1113 or at ico.org.uk/make-a-complaint

Cookies and other websites

This site uses only cookies it needs to work, listed in our cookie policy. The HubSpot booking page and the Google feedback form are run by those providers and may use their own cookies, under their own policies.

Changes to this notice

The version and date at the top show when this notice last changed. We update it before we start using personal information in a new way.