Privacy Notice

1. Who We Are

This Privacy Notice is issued by Lashan Digital LTD (trading as AI Sentri, "we", "us", "our"), a company registered in England and Wales, in connection with the AI Sentri service available at https://aisentri.co.uk.

We are registered with the UK Information Commissioner's Office under registration number ZC254265.

Our two roles

Under UK GDPR we hold two different roles, and which one applies depends on whose data it is and who decided to collect it.

We are the controller of the data about your relationship with us: the account you sign in with, your name, work email and job title, your organisation's subscription and billing records, your support correspondence, and how you use the Service. We decide why and how that data is processed, and the rest of this Notice explains those decisions.
We are the processor of the information our customers record inside the Service: their AI system register, risk registers, policies, assurance reviews, incidents, survey responses, and any personal data contained within them. The customer organisation decides what to record and why. We process it only on their documented instructions to provide the Service, and never for our own purposes.

Put simply: we are the controller for data about you as a user of AI Sentri, and the processor for the governance information your organisation chooses to keep in it.

If you are an individual whose personal data appears inside a customer's account — for example as a named system owner, a risk owner, or a survey respondent — that organisation is the controller and is the right party to contact about your rights. We will assist them in responding to you.

The terms governing our processing on our customers' behalf are set out in our Terms of Use.

For any privacy-related questions or to exercise your rights, contact us at sales@lashandigital.co.uk.

2. Personal Data We Collect

We handle the following categories of personal data. The role shown is the one we hold for that category, as explained in section 1.

Account data (controller) — name, email address, password (hashed), organisation name, job title.
Customer content (processor) — the information your organisation records in the platform, including AI system records, risk registers, policies, assurance reviews, incidents, survey responses, and the team details entered alongside them. Your organisation decides what goes in here.
Communications (controller) — support enquiries, feedback, and any correspondence with our team.
Usage and telemetry data (controller) — pages visited, features used, login times, and device or browser identifiers.
Technical data (controller) — IP address, approximate location derived from IP, session identifiers, and cookies.
Billing reference data (controller) — subscription status, plan, and the invoicing details needed to bill your organisation. Plans are invoiced directly and no payment card details are taken through the platform.

3. How We Use Personal Data

We process personal data for the following purposes:

Creating and managing your account.
Providing and operating the AI Sentri service.
Processing subscriptions and recording entitlements.
Providing customer support and responding to enquiries.
Securing the service, detecting fraud, and preventing abuse.
Improving the service through aggregated analytics.
Sending service notifications and, where you have opted in, marketing communications.
Complying with legal, regulatory, and tax obligations.

4. Legal Basis for Processing

These bases apply to the personal data for which we are the controller. Where we act as a processor on a customer's behalf, that organisation determines the purpose and the legal basis, not us.

We rely on the following legal bases under UK GDPR:

Performance of a contract — to provide the service you have signed up for.
Legitimate interests — to secure our service, prevent fraud, improve features, and communicate with users about their accounts.
Consent — for non-essential cookies and optional marketing communications. You can withdraw consent at any time.
Legal obligation — to comply with tax, accounting, and other applicable laws.

5. Who We Share Personal Data With

We share personal data with the following categories of recipients:

Hosting and infrastructure providers — cloud hosting, database, and storage providers used to operate the platform.
Email and communications providers — used to deliver transactional and account emails.
Analytics and monitoring providers — to measure performance and detect issues, with data minimised where possible.
Professional advisers — legal, accounting, and audit advisers, where required.
Authorities — where required by law, regulation, or legal process.

We do not sell personal data.

6. International Transfers

Some of our service providers are located outside the UK and EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or adequacy decisions issued by the UK Government or the European Commission.

7. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this notice. In general:

Account and content data — kept while your account is active and for up to 12 months after closure, after which it is deleted or anonymised.
Billing and tax records — kept for at least 6 years to meet UK accounting and tax obligations.
Support communications — kept for up to 3 years after the last interaction.
Security and audit logs — kept for up to 2 years.

8. Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure of your personal data, where applicable.
Restrict or object to processing in certain circumstances.
Receive your data in a portable format.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

We aim to respond to verified requests within one month, in line with UK GDPR.

Which of us to ask. Exercise these rights with us directly for the data we control — your account, your usage of the Service, your billing records and your correspondence with us. If your request concerns information held inside a customer's account, that organisation is the controller: ask them, and we will support them in answering you. If you are not sure which applies, write to us anyway and we will tell you.

9. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, encrypted storage, role-based access controls, audit logging, and regular security reviews. No system is completely secure, so we cannot guarantee absolute security.

10. Cookies

We use cookies and similar technologies to operate the service, remember your preferences, secure your session, and measure usage. Non-essential cookies are only set with your consent, which you can manage at any time through the cookie banner or your browser settings. Categories include:

Essential — required to log in and use the service.
Analytics — to understand how the service is used and improve it.
Marketing — only set with explicit consent.

11. Changes to This Notice

We may update this Privacy Notice from time to time. We will post the updated version on this page with a new "last updated" date and, where changes are material, notify you by email or in-product notice.

12. Contact Us

Lashan Digital LTD, sales@lashandigital.co.uk.