Privacy Notice

Privacy Practice Lab teaches practical privacy. It would be difficult to do that credibly while collecting more data than we need, so this notice describes a deliberately small set of processing activities.

Who we are

Privacy Practice Lab is an independent privacy and AI governance education and advisory practice. You can contact us at any time using the details on our contact page.

What we collect and why

• Learning account details — name, email, job role, company, country, organisation size and primary interest. We use these to operate your account, record course progress and issue certificates, and to understand which topics to prioritise.
• Course progress and results — lessons completed, quiz answers and scores, and certificates issued. Used to deliver the course experience and verify certificates.
• Assessment submissions — your responses and the contact details you provide. Your results are calculated and shown in your browser immediately, and you can download the report yourself from that page; we do not email it. We store the submission so we can improve the assessment, and we use your contact details only to reply about your results where you asked us to.
• Enquiries — the details submitted through consultation and contact forms, used to respond to your enquiry.
• Newsletter subscriptions — first name, email and area of interest, recorded only so we can send the newsletter you explicitly asked for once that mailing is running. We add no one to this list without a separate, explicit opt-in.

Optional share links and shared summaries

Our tools and assessments run in your browser. If you choose to create a share link for a result, we store only the short summary you can see in the preview card — a headline, band, score, date and a few generic lines — under an unguessable token. Individual answers, organisation names, scanned addresses and free text are never included. Shared summaries expire automatically (90 days by default) and you can delete one at any time with the delete token shown when you create it.

Aggregate, cookieless product events

To understand which tools are useful we record a small number of aggregate events: an event name (for example "tool completed"), the feature it belongs to and, if you arrived from a colleague's share link, an opaque random referral code. No cookie is set, no IP address, user agent or fingerprint is stored, and nothing recorded here identifies you or contains your answers.

Website privacy hygiene scanning

Local scan (the default). The bookmarklet runs entirely inside your own browser, on the page you are looking at. It inspects only link, script and form attributes and page metadata, and where the browser allows it, that page's own response headers. It never reads what you type, your cookies, your browser storage or anything behind a login. No page HTML, address, hostname or finding is sent to Privacy Practice Lab or to any third party. Your result reaches our result page in a URL fragment, which browsers do not transmit to any server, so we never receive it — the site name shown on screen stays on your device. The same applies to the optional “paste response headers” fallback: the text you paste is parsed in your browser against a fixed list of five header names and is never sent or stored.

Optional server scan. Where the hosting runtime can safely support it, we also offer a scan that our server performs. In that case our server fetches the publicly available HTML and response headers of the address you enter and analyses them in memory. We do not store the address, the page HTML, the response headers or any query string. To prevent abuse we keep only a keyed, one-way hash of the hostname with a short-lived counter, which is deleted automatically. On our production hosting this server scan is switched off, because the runtime cannot pin outbound connections safely.

However a scan was produced, findings stay in your browser unless you choose to create a share link, and a shared scan summary contains only category scores and generic finding labels — never the scanned domain or the underlying evidence.

Ask Privacy Practice Lab submissions

If you send us a question, we store the question and any background you provide so an editor can review it. Your email address is optional; when you provide it, it is used only to follow up on that question, is visible only to our editorial team, and is never published or copied into a published answer. Published answers are rewritten in general terms by our editorial team.

Anonymised benchmarks

When you save a readiness assessment result you may separately and explicitly opt in to having your scores included in anonymised benchmark statistics. This is a distinct choice from storing or being contacted about your result. We publish aggregate figures only, never individual answers, and only where a group contains at least 25 submissions.

Lawful bases

We rely on performance of a contract for operating your learning account, legitimate interests for responding to enquiries and improving our educational content, and consent for marketing communications. Where consent applies, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

What we do not do

• We do not sell or rent personal data.
• We do not use advertising or cross-site tracking cookies.
• We do not build behavioural profiles for targeting.
• We do not require a learning account to read articles or download resources.

Retention

• Learning accounts and progress: retained while the account is active, and deleted on request.
• Certificates: retained so that certificate verification continues to work, unless you ask us to revoke them.
• Assessment submissions: retained for 24 months.
• Shared result summaries: deleted automatically when the link expires, or sooner if you delete it.
• Ask submissions: retained for 24 months; the optional email is removed once the question is answered or rejected.
• Scanner throttling hashes: deleted automatically within a few hours.
• Enquiries: retained for 24 months after the last contact.
• Newsletter records: retained until you unsubscribe, plus a suppression record so we do not contact you again.

Sharing

We use a small number of service providers to host this site and operate the database and authentication. They process data on our instructions under written terms. We do not currently send any automated or marketing email from this site — replies come directly from us. If we introduce an email provider, this notice will be updated first. We do not share your data with advertisers.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to or port your personal data, and to withdraw consent. You can exercise these from your account page once signed in, or by contacting us. We respond within the timeframes required by the applicable law, and we will not charge you or treat you differently for exercising a right.

Security

Access to personal data is restricted to those who need it. Learner progress, assessment results and certificates are protected by row-level access rules so that each account can only reach its own records.

Changes

If we change how we use personal data, we will update this notice and, where the change is material, tell you directly.