Privacy notice — the free AI Readiness Self-Assessment
This notice covers the assessment form at /ai-readiness-governance/free-assessment only. Last updated 3 September 2026.
This is a complete working draft, written to match what the form actually collects and what the handler actually does with it. Build Spec §10 requires it to be confirmed with a data protection adviser before launch, and §13 lists the final text as still outstanding. Two claims below must be verified as true of the live hosting before they are published: UK/EEA hosting, and ISO/IEC 27001-aligned handling. If either is not accurate, change the sentence rather than the practice.
The short version
You give us answers about how your organisation uses AI, plus your name, work email and organisation. We use them to prepare and send you a scored readiness report, and to work out which of our services — if any — would actually help you.
Sending you the report and sending you marketing are two separate permissions. You can have the first without the second, and you can withdraw either at any time.
We keep the record for 24 months. You can ask us to delete it sooner, and you don’t need an account or a login to do that.
Who we are
VisionXY7 Ltd, Milton Keynes, Buckinghamshire, United Kingdom. VAT GB 513195802. We are the data controller for the information collected through this form. For any question about this notice, or to exercise any of the rights below, email Hello@visionxy7.com.
What we collect
- About your organisation — sector, size band, your role, whether you operate in or serve the EU, whether you are in a regulated sector, whether AI-supported decisions affect individuals, how long you have used AI, and whether any of it is built or customised for you.
- Your answers to the assessment questions — around forty questions about how AI is used, governed and overseen in your organisation.
- Three free-text answers — what made you look at this now, which AI tools are in use, and the one thing you would fix. These are optional.
- Profiling answers — your region, your position on decisions like this, what is driving the timing, when you might act, what you would most like help with, and how you would like us to follow up. See the next section for why.
- Contact details — first and last name, work email, organisation, and optionally job title, website and phone number. The phone field only appears if you tell us a short call would be welcome.
- Technical context — how long the form took you, how far through you got, the page that sent you to us, and any campaign tags in the link you followed.
- Your two consent choices, and the time you made them.
What we deliberately do not collect
We sell AI governance advice. Our own form is the first thing you can judge us by, so it collects only what it needs.
- No turnover, revenue or budget figures. Those read as qualifying you rather than helping you.
- No document uploads at the free tier. That would create a data-handling obligation out of all proportion to a free assessment.
- No information about named individuals other than you. Please don’t put personal, client or patient information in the free-text boxes — the form says so at the point you type.
- No required phone number. It is optional, and only offered after you have said a call would be welcome.
- No “how did you hear about us” question — the referrer and campaign tags already tell us, without spending one of your twelve minutes.
Why we ask the profiling questions, plainly
Those questions — your region, your decision-making position, your timing and what you would like help with — are commercial, not diagnostic. They do not affect your score in any way. We use them to judge which of our services is actually relevant to you, to decide how and how quickly to follow up, and to understand the market we are serving. We would rather tell you that directly than dress it up as part of the assessment.
Our lawful bases — two, kept separate
Preparing and sending your report
This is a service you asked us to perform. We rely on the necessity of processing to deliver what you requested, together with the consent you give in the first checkbox. Without it we cannot prepare the report, so this one is required.
Insights and service suggestions
Consent, given separately in the second checkbox, freely and optionally. You can withdraw it at any time and it does not affect your report. We never bundle these two into one tick box.
What we do with it
- Score your answers automatically, so that the human review takes fifteen minutes rather than two hours. The report you receive is reviewed personally by Dr. Mahdi Seify and is not sent out automatically.
- Send you the report by email within two working days, with one recommended next step.
- Send two further emails only: an immediate confirmation, and the report itself. A third — a re-assessment reminder six months later — goes only to people who ticked the second box.
- Keep one row per submission in a running record, so we can see which questions lose people and which services the market actually wants.
- Use anonymised, aggregated data for research and published insight — for example, an average governance score for a sector. Before anything is published we remove organisation, contact and free-text fields, and check that no combination of sector, size and region could identify a single respondent. We never publish a figure for a group of fewer than 30 completed assessments.
Who sees it
Submissions go to a named, access-controlled VisionXY7 mailbox and are reviewed by Dr. Mahdi Seify. We do not sell your information, and we do not share it with anyone for their own marketing. We use a small number of service providers to host the website, store the record and send email; they process the data only on our instructions. We will tell you exactly who they are if you ask — a regulated buyer usually does, and answering immediately is the point.
Where it is kept, and how it is protected
Encrypted in transit and at rest, hosted in the UK or the EEA, with access limited to named individuals, consistent with our stated ISO/IEC 27001-aligned practice.
How long we keep it
24 months from the date you submit, then deleted or irreversibly anonymised. That covers the assessment itself, the six-month re-assessment reminder, and one further cycle after it. We chose that period deliberately and we have written down why.
Your rights
Under UK data protection law you can ask us to give you a copy of what we hold about you, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on consent, you can withdraw it at any time.
To ask for deletion: email Hello@visionxy7.com with the email address you used. You do not need an account, a password, or a login of any kind. We will do it within 30 days and confirm when it is done.
To stop marketing but keep your report: say so in the same email, or use the unsubscribe link on any message. Your report still comes.
Complaints
If you think we have handled your information badly, please tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, and you can do that without coming to us first.