Privacy Policy

1. Who we are

AI AZ TRUST EUROPE is a brand operated by the sole proprietorship of Zoi Anastasopoulou, registered in Greece under G.E.MI. No. 172461553000, with its business establishment in Trikala, Greece.

For the purposes of applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Zoi Anastasopoulou, operating AI AZ TRUST EUROPE, acts as the data controller where we determine the purposes and means of processing personal data.

In some circumstances, particularly where customers upload documents or other information containing personal data relating to third parties, our role may depend on the circumstances and the relationship with the relevant customer.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through the AI AZ TRUST EUROPE website, platform, contact forms, user accounts, assessments, AI system records, document and evidence functionality, and related services.

It explains what personal data we may process, why we process it, how it may be used and protected, and the rights available to individuals under applicable data protection law.

3. Personal data we may process

Depending on how you interact with AI AZ TRUST EUROPE, we may process the following categories of information.

Account and user information

This may include your email address, account credentials, name or other profile information where provided, job title, user role, account status and email verification status.

Organization information

Where you use the platform on behalf of an organization, we may process information such as the organization's name, legal name, country, VAT number, industry, organization size, website and your membership or role within that organization.

AI system information

We may process information entered about AI systems, including their name, description, provider, model name, intended purpose, risk classification and operational status.

Assessment and compliance information

When you use assessment or compliance functionality, we may process responses to assessment questions, comments, supporting information, evidence notes, assessment results, result summaries, review decisions, review notes and other information relevant to the assessment.

Documents and evidence

Users may upload documents and evidence relating to their AI governance and compliance activities. These may include policies, technical documentation, risk assessments, data protection impact assessments (DPIAs), testing reports, human oversight documentation, supplier contracts, certifications and other supporting materials.

We may also process information associated with those documents, including document titles, categories, versions, notes, upload information and evidence review information.

Documents uploaded by customers may contain personal data or confidential information relating to third parties. Customers should only upload information that they are lawfully entitled to provide and should avoid including unnecessary personal data.

Contact and enquiry information

If you contact us through the website, we may process your name, email address, organization, role, service of interest, approximate number of AI systems, message, privacy consent and information relating to the handling of your enquiry.

Technical and security information

When you access the website or platform, technical information may be generated or processed as necessary to operate, secure and troubleshoot the service. This may include information normally contained in server, application or security logs, such as IP addresses, request information, timestamps and technical error or security information.

4. How we obtain personal data

We primarily obtain personal data directly from you when you create or use an account, submit a contact request, provide information about an organization or AI system, complete an assessment, upload documents or evidence, or otherwise interact with our services.

We may also receive personal data from an organization or another authorized user using the platform, for example where information or documents relating to colleagues, suppliers or other individuals are included in compliance materials.

5. Why we process personal data

We may process personal data for purposes including:

• creating, verifying and administering user accounts;
• providing and operating the AI AZ TRUST EUROPE platform and services;
• managing organizations, memberships and access permissions;
• enabling AI governance, readiness and compliance assessments;
• storing and reviewing documentation and supporting evidence;
• generating assessment outputs and compliance-related information based on information provided through the platform;
• responding to enquiries and service requests;
• communicating with users about their accounts or services;
• maintaining the security, reliability and integrity of the website and platform;
• preventing misuse, unauthorized access or fraudulent activity;
• complying with applicable legal and regulatory obligations; and
• establishing, exercising or defending legal claims where necessary.

6. Legal bases for processing

Depending on the circumstances, we process personal data on one or more of the following legal bases:

• Performance of a contract or steps before entering into a contract, where processing is necessary to provide requested services or manage the contractual relationship.
• Legitimate interests, where necessary for the operation, administration, security and improvement of our services, handling business communications, protecting our systems or establishing and defending legal claims, provided those interests are not overridden by the rights and freedoms of the individual.
• Legal obligations, where processing is necessary to comply with applicable law.
• Consent, where we specifically ask for consent and consent is the appropriate legal basis for the relevant processing.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Uploaded documents and customer-provided data

The platform allows authorized users to upload compliance-related documents and evidence. Customers and users are responsible for ensuring that they have an appropriate legal basis, authorization or other lawful right to provide personal data contained in materials they upload.

Users should apply data minimisation and should not upload personal data that is unnecessary for the relevant compliance, governance or assessment purpose.

Access to uploaded documents through the platform is restricted according to user authentication and organization access permissions. Authorized administrative access may also occur where reasonably necessary for operation, security, support or legal purposes.

8. Automated assessment functionality

The platform may automatically process information submitted by users in order to generate assessment results, readiness indicators, summaries or other compliance-related outputs.

These outputs are intended to support AI governance and compliance activities. They are not intended to make decisions about individuals that produce legal effects or similarly significant effects solely through automated processing.

The platform also supports human review of assessment information and evidence where applicable.

9. Who may receive or access personal data

Personal data may be accessible to authorized persons involved in operating and supporting AI AZ TRUST EUROPE and, where applicable, to authorized users of the relevant customer organization.

We may also use service providers that support the operation of our business and technical infrastructure, such as hosting, server infrastructure and email services. Such providers may process personal data only to the extent necessary to provide the relevant services and subject to applicable data protection requirements.

We may disclose information where required by law, regulation, court order or a competent public authority, or where reasonably necessary to establish, exercise or defend legal claims.

We do not sell personal data.

10. International data transfers

Where the use of a service provider or other processing activity involves a transfer of personal data outside the European Economic Area, we will apply safeguards required by applicable data protection law where such safeguards are required.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the services, maintaining business and compliance records, resolving disputes, enforcing agreements and meeting legal, accounting or regulatory obligations.

Retention periods may vary depending on the type of information, the nature of the service, the relationship with the customer and applicable legal requirements. When personal data is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable requirements.

12. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction.

Access to platform information is controlled through authentication and authorization mechanisms, including organization-based access controls for relevant customer information and documents.

No method of electronic transmission or storage can be guaranteed to be completely secure. Users are also responsible for maintaining the confidentiality of their account credentials and for using the service in an appropriate and secure manner.

13. Cookies and similar technologies

The website and platform may use cookies or similar technologies that are necessary for core functionality, authentication, session management, security and user interaction.

We do not currently use third-party advertising or analytics tracking technologies on the public website. If this changes, this Privacy Policy and, where required, our cookie or consent mechanisms will be updated accordingly.

14. Your data protection rights

Subject to the conditions and limitations of applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data in applicable circumstances;
• request restriction of processing;
• object to processing based on legitimate interests in applicable circumstances;
• receive or request transfer of certain personal data where the right to data portability applies;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent data protection supervisory authority.

We may need to verify your identity before acting on a request in order to protect personal data against unauthorized disclosure.

15. How to exercise your rights

For privacy enquiries or requests concerning your personal data, please use the Contact form available on the AI AZ TRUST EUROPE website and indicate that your request concerns privacy or personal data.

We will handle requests in accordance with applicable data protection law.

16. Complaints

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Greece, the competent supervisory authority is the Hellenic Data Protection Authority (HDPA).

17. Third-party information provided by customers

Customers may provide information relating to employees, representatives, suppliers, contractors or other third parties as part of their AI governance and compliance activities.

The customer is responsible for ensuring that such information is provided lawfully and that relevant individuals receive any information required under applicable data protection law.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, processing activities, legal requirements or business operations.

The current version will be published on this page and the "Last updated" date will be revised when appropriate.

19. Contact

Privacy enquiries and data protection requests may be submitted through the Contact form available on the AI AZ TRUST EUROPE website. Please indicate that your request concerns privacy or personal data.

AI AZ TRUST EUROPE
Operated by Zoi Anastasopoulou
G.E.MI. No. 172461553000
Trikala, Greece