Privacy Policy

1. Who We Are

Data Controller: Whitehall Strategic Alliance Ltd (trading as Cardinal AI Systems)

Registered in: England and Wales · Company No. 16814534

Registered address: Unit A, 82 James Carter Road, Mildenhall, Bury Saint Edmunds, United Kingdom, IP28 7DE

Contact: ronke@cardinalaisystems.com

2. What Personal Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, organisation, and role — when you book a Gap Review, complete the diagnostic tool, or contact us directly
• Usage data: Pages visited, time on site, browser type, device type, and IP address — collected automatically via our analytics tools
• Document content: Text you submit to our compliance scanning or policy generation tools — processed in real time and not stored beyond your session
• Communications: Content of emails or messages you send to us

3. How We Use Your Personal Data

We process your personal data for the following purposes and on the following legal bases:

• To provide our services (Legal basis: Contract / Legitimate interests) — running the diagnostic tool, generating policy documents, and responding to enquiries
• To book and manage Gap Review sessions (Legal basis: Contract) — scheduling via Calendly, sending confirmation and reminder emails
• To send relevant communications (Legal basis: Legitimate interests / Consent) — follow-up emails about AI governance matters relevant to your enquiry
• To improve our platform (Legal basis: Legitimate interests) — analysing usage patterns to improve tool functionality and user experience
• To comply with legal obligations (Legal basis: Legal obligation) — maintaining records required by law

4. Document Content Submitted to Our Tools

When you paste document text into our compliance scanning or policy generation tools, that text is transmitted to the Anthropic API for AI processing. We do not store the content of documents you submit beyond the duration of your session. Anthropic processes data in accordance with their privacy policy and data processing agreement. We have confirmed that Anthropic's enterprise API terms prohibit using submitted data for model training.

We strongly advise you not to submit documents containing personal data, confidential client information, or privileged communications into our tools without first ensuring you have appropriate authorisation to do so.

5. Who We Share Your Data With

We share personal data only with the following categories of recipients:

• Anthropic: For AI processing of text submitted to our tools — under data processing agreement
• Calendly: For booking and managing Gap Review sessions — under their privacy policy
• Vercel: For website hosting — under their data processing agreement
• Google Analytics / analytics providers: For website analytics — under appropriate agreements

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

6. International Data Transfers

Some of our service providers (including Anthropic and Vercel) process data in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs) — to protect your data in accordance with UK GDPR requirements.

7. How Long We Keep Your Data

• Enquiry and booking data: 2 years from last contact
• Document submissions: Not retained beyond your session
• Analytics data: 26 months (aggregated, anonymised)
• Legal and financial records: 7 years as required by law

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data in certain circumstances
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Rights related to automated decision-making: Not to be subject to solely automated decisions with significant effects

To exercise any of these rights, contact us at ronke@cardinalaisystems.com. We will respond within 30 days.

9. Cookies

We use cookies and similar technologies on this website. Please see our Cookie Policy for full details of the cookies we use and how to manage your preferences.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our website is served over HTTPS. Access to personal data is restricted to authorised personnel only.

11. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects when it was last updated. We will notify you of material changes by email where we hold your contact details.

13. Contact Us

For any privacy-related queries: ronke@cardinalaisystems.com

Whitehall Strategic Alliance Ltd · Unit A, 82 James Carter Road · Mildenhall · Bury Saint Edmunds · IP28 7DE