Privacy policy

1. Information we collect

We collect information you provide directly to us through Microsoft Entra ID authentication, including your name, email address and organisational information. We also collect information about your use of the Service, including your conversations and interactions with its AI-powered features.

2. How we use your information

• Provide, maintain and improve the Risk Alert for LCSPs Service.
• Process and respond to your inquiries and requests.
• Send you technical notices and support messages.
• Analyse usage patterns to enhance service functionality.
• Ensure compliance with regulatory requirements.

3. Information sharing and disclosure

We do not sell, trade or otherwise transfer your personal information to third parties without your consent, except as described in this policy. We may share your information with trusted partners who assist us in operating the Service, provided they agree to keep this information confidential.

4. Data security

We implement industry-standard security measures to protect your personal information against unauthorised access, alteration, disclosure or destruction. This includes encryption of data in transit and at rest, regular security assessments and strict access controls. Access to the Service is restricted to an explicitly provisioned list of users.

5. Data retention

We retain your information, including your saved conversations, for as long as necessary to provide the Service and as required by applicable law. When you discontinue use of the Service, we will delete or anonymise your personal information within a reasonable timeframe.

6. Microsoft Entra ID integration

The Service integrates with Microsoft Entra ID for authentication. Your use of Microsoft services is also governed by Microsoft's privacy statement. We access only the minimum information necessary to authenticate you and provide the Service.

7. AI processing

The Service uses large language models hosted within Amazon Web Services to analyse news and web content and to generate responses. Your queries and the documents you upload are processed to produce those responses. They are not used to train third-party foundation models.

8. Your rights

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information, subject to legal requirements.
• Object to processing of your information.
• Request data portability.

9. International data transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards.

10. Changes to this policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "last updated" date below.

11. Contact us

If you have any questions about this privacy policy or our privacy practices, please contact your Deloitte representative or our privacy team.