Privacy

AI Build Group Ltd is the data controller for the personal information processed through AI TrustMark and is registered with the Information Commissioner's Office (ICO), registration number ZC244803. AI TrustMark is operated by AI Build Group Ltd (company number 17151645). It does not have a separate ICO registration. Registered office: Unit 19, Castle Road Technical Centre, Eurolink Industrial Estate, Sittingbourne, Kent, ME10 3RG, United Kingdom.

Privacy enquiries: info@ai-build.ltd. We have not published a Data Protection Officer for this service.

What this service processes

Depending on how you use AI TrustMark, we process account and contact details, organisation and product listing information, assurance and verification submissions, reviews, procurement questionnaire answers, certificate and scorecard records, and technical logs needed to run the site.

Information you choose to publish in the directory, including a public provider or product profile and a review you agree to publish, is intended to be visible to visitors. Private assurance evidence, reviewer identity evidence and procurement working papers stay private. They are not placed in public HTML, metadata, structured data, sitemaps, public APIs or search indexes.

Why we use it

We use this information to operate listings, check reviews, carry out assurance work you ask for, issue and verify certificates, prevent fraud, and respond to procurement enquiries. Contract covers the assessment or listing service you request. Legitimate interests cover security, fraud prevention and keeping the public directory accurate. Consent covers publication of a review and any separate marketing choice. Legal obligation applies where the law requires a record.

AI TrustMark processes personal data to verify reviews, prevent fraud, and operate TrustMark certificates. Publication requires explicit consent. Marketing consent is separate.

AI-assisted processing

Some assurance and directory workflows may use AI to help sort or draft material from information submitted to the service. That assistance does not by itself decide a legal or similarly significant outcome. A published score, certificate or directory status is a conclusion of the assurance process, not an unsupervised model decision. Where a supplier contract prohibits use of customer content to train that supplier's model, we rely on that contract. We do not claim that every connected tool is covered by the same prohibition.

Data minimisation

Private reviewer evidence defaults to private storage and is never included in HTML, metadata, structured data, sitemaps, public APIs or search indexes.

Sharing and international transfers

We do not sell personal information. Hosting, email, analytics (where you accept non-essential cookies) and payment providers may process it to run the service. Some of those providers are outside the UK. Where a transfer is not covered by UK adequacy regulations, we use a recognised contractual safeguard.

Retention

Public directory entries stay while the listing is published. Private assurance evidence is kept for the assessment and for the period needed to support the certificate and handle a dispute. Account data is kept while the account is active. A single numbered retention schedule is not published on this page. Staff workflows can apply a shorter or longer hold where the record requires it.

Your rights

You can ask for access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where consent is the basis, including consent to publish a review. Complaints can be made to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Security

Transport is encrypted (HTTPS). Evidence objects use encrypted storage where configured. Access is role-based. Material changes are audit-logged.