Conduct AI Ltd. ("Conduct”, “we” “us", “our”) is committed to protecting the rights and privacy of individuals in accordance with applicable privacy laws, in particular the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

This Privacy Notice explains what personal data we collect, how and why we use it, how we share it, and your rights. If you have questions about this Notice or our data practices, contact us at data@conduct.ai.

1. Who we are

Conduct AI Ltd is a company registered in England and Wales with its registered office at:

Conduct AI Ltd. 42 Berners Street, London, W1T 3ND United Kingdom legals@conduct.ai

For the purposes of UK GDPR, Conduct AI is a “Controller” for the processing described in Sections 2 below, unless stated otherwise.

2. Scope

2.1 This Privacy Notice applies to personal data we process when you:

1. Visit or interact with our website and online channels, including landing pages and social media;

2. Contact or communicate with us, including as a prospect, customer, partner, supplier, or other business contact;

3. Register for or attend our events, webinars, demos, or newsletters (where offered);

4. Apply for a job with Conduct AI (unless a separate applicant privacy notice is provided).

2.2 If you use Conduct AI products or services through an organisation that is our customer, that organisation typically acts as the controller and Conduct AI acts as a processor, meaning we process personal data on behalf of the customer and under the customer’s instructions. In that case, your organisation’s privacy notice explains why and how your data is used.

3. Personal data we collect

3.1 Depending on your interaction with us, we may collect:

• Contact and identity data: name, business email address, business telephone number, job title, company/organisation, country and other professional details you provide.

• Communications data: content of emails, messages, contact forms, support requests, feedback, and any other information you choose to share.

• Event/marketing data: registrations, attendance status, preferences, and feedback.

• Commercial and contract data (B2B): details required for contracting, billing, and service administration (e.g., purchase order information, billing contacts).

• Applicant data: CVs, cover letters, references, work history, and interview notes if you apply for a role.

We do not intentionally collect special category data (e.g., health, religion, political opinions) via our website. If you provide such data voluntarily, we will handle it in line with applicable law.

3.2 When you visit our website, we may automatically collect:

• Device and usage data: IP address, browser type/version, operating system, device identifiers, time zone setting, referral URL, pages viewed, time spent on pages, clickstream and similar log information.

• Cookie and tracking data: cookie IDs and web analytics events, but only where non-essential cookies are enabled based on your consent (see Section 7).

3.3 We may receive personal data from:

• Business partners, for example if you register for a joint event;

• Public sources, such as company websites or professional networking sites, for B2B outreach;

• Service providers that help us run marketing, analytics, recruiting, or communications.

4. How we use personal data (Purposes)

We use personal data for the following purposes:

1. Website operation and security

   • to provide, secure, maintain, and improve our website;

   • to monitor performance, detect faults, prevent fraud, abuse, or unauthorised access.

2. Analytics and improvement

   • to understand how visitors engage with our website and content;

   • to improve user experience, marketing campaigns, and our products/services.

3. Communications and relationship management

   • to respond to enquiries and requests;

   • to manage relationships with prospects, customers, partners, suppliers, and other business contacts.

4. Sales, marketing, and events

   • to arrange demos, send relevant updates, and invite you to events or webinars where permitted;

   • to measure and optimise marketing effectiveness.

5. Contracting and administration

   • to onboard customers and vendors;

   • to manage contracts, billing, and payments.

6. Recruiting

   • to assess applications, schedule interviews, and manage hiring decisions.

7. Legal compliance and protection

   • to meet legal obligations;

   • to establish, exercise, or defend legal claims.

5. Lawful bases for processing

We process personal data in accordance with a legal basis, in particular under Article 6 UK GDPR. This does include in particular:

1. Consent

   • Used for non-essential cookies/analytics and, where applicable, newsletters or marketing to individuals.

   • You may withdraw consent at any time.

2. Contract or pre-contract steps

   • Used to provide requested services, manage customer/vendor relationships, or take steps at your request prior to entering a contract.

3. Legal obligation

   • Used where processing is required by law, including tax, accounting, or compliance duties.

4. Legitimate interests

   • Used for operating and securing our website, B2B communications, improving services, and managing relationships.

   • We balance our interests against your rights and apply safeguards such as data minimisation.

   • Where we rely on legitimate interests, you may object and opt-out.

6. How we share personal data

6.1 We share personal data only where necessary for the purposes above, including with:

• Hosting, infrastructure, and security providers used to operate and protect our website;

• Analytics and performance providers, where needed;

• Communications and CRM providers supporting emails, forms, customer support, or relationship management;

• Professional advisers (e.g., legal, auditors, insurers) where needed;

• Business partners in connection with joint events or initiatives where you choose to participate;

• Public authorities or courts where required by law or to protect our rights.

6.2 Where these providers process data on our behalf, they act as our processors under written agreements requiring appropriate safeguards and confidentiality.

7. Cookies and similar technologies

7.1 We use cookies and similar technologies to:

• enable essential website functionality and security;

• analyse website usage and improve performance (non-essential cookies).

7.2 Non-essential cookies are used only with your consent, as required under applicable (data protection) laws. You can manage your choices and change or withdraw consent at any time via your Cookie Settings. Full details are provided in our Cookie Statement.

8. International data transfers

We may transfer personal data outside the UK/EEA where necessary, for example, where service providers operate globally. In such cases, we ensure an adequate level of protection by relying on in particular:

• Adequacy decisions; or

• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, plus supplementary measures where required.

9. Data retention

9.1 We keep personal data only as long as necessary for the relevant purpose and then delete or anonymise it. The retention period depends on the type of data and legal requirements.

9.2 Typical retention approach:

• Website logs and analytics data: retained per tool configuration, often in aggregated or anonymised form.

• Business contact and communications data: retained while the relationship is active and for a limited period afterwards.

• Contracting and billing data: retained for statutory periods (e.g., tax and accounting).

• Recruiting data: retained for the hiring process and a short period afterwards unless you agree to extended retention.

10. Your rights

10.1 You have rights under applicable laws, in particular UK GDPR, including the right to:

• Access your personal data and obtain a copy;

• Rectify inaccurate or incomplete data;

• Erase your data in certain circumstances;

• Restrict processing in certain circumstances;

• Object to processing based on legitimate interests;

• Withdraw consent at any time where processing is based on consent (this will not affect processing already carried out);

• Data portability, where applicable;

• Not be subject to solely automated decisions that produce legal or similarly significant effects.

10.2 To exercise your rights, email data@conduct.ai. We may need to verify your identity. We typically respond within one month unless the request is complex or numerous.

11. Complaints

11.1 If you have concerns about our data practices, please contact us first.

11.2 You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner’s Office (ICO). Details on how to complain are available on the ICO website.

12. Security

12.1 We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure.

12.2 These measures include access controls, secure hosting, encryption where appropriate, monitoring, and backup/recovery processes. While no system is completely secure, we continuously work to protect personal data.

13. Children

Our website and services are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us so we can delete it.

14. Changes to this privacy notice

We may update this Privacy Notice (and any supplemental privacy notice), from time to time, as shown below. We will notify you of the changes where required by applicable law to do so.

15. Contact us

If you have any questions or wish to exercise any of your rights. In that case, you can contact the Company appointed Data Protection Officer (DPO) who is responsible for overseeing this policy and ensuring that the Company complies with the UK GDPR and DPA 2018. The DPO can be contacted at

Conduct AI Ltd. 42 Berners Street, London, W1T 3ND United Kingdom legals@conduct.ai