Privacy Policy

1. Introduction

AI Lab UK ("AI Lab", "we", "us", "our") is a practical AI capability programme operated by Zygens Consulting Ltd. This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, attend an AI Lab session, volunteer with us, or partner with us.

AI Lab UK is a programme and trading name of Zygens Consulting Ltd. Zygens Consulting Ltd is the data controller for all personal data described in this policy.

We run free, hands-on AI sessions for a wide range of people — students, school and college learners, job seekers, career changers, small business owners, professionals, educators and members of the public. Because our sessions are open to young people as well as adults, this policy includes specific sections on children's data and photography and filming. Please read those if they apply to you or to someone in your care.

Data controller

Zygens Consulting Ltd
Platform, New Station Street
Leeds, West Yorkshire, LS1 4JB
United Kingdom
Company Registration Number: 16406295

Contact for privacy matters: infosec@zygens.com

2. Information We Collect

2.1 Information you give us through the website

When you use our contact form, partner enquiry form or newsletter signup, we collect:

• Contact information — your name, email address, and phone number where you choose to provide it
• Professional or educational information — your organisation, job title or role, and the region or city you're based in
• Enquiry content — what you tell us about your organisation, your goals, or your question
• Enquiry type — whether you're contacting us as a general enquiry, about an event, as a potential partner, or as a potential sponsor
• Consent records — whether you agreed to us storing your details, and whether you opted in to our newsletter, together with the date and time

2.2 Information relating to sessions you register for or attend

Booking is handled by Eventbrite. When you register for an AI Lab session, workshop, meetup or pop-up lab, you book through Eventbrite, not through our website. Eventbrite collects your booking information on its own platform, under its own privacy policy, and provides us with the attendee list.

The questions on that form are ours — we decide what is asked and why — and we are responsible for the information we receive and for what we then do with it. Eventbrite also processes your data for its own purposes as a platform, including your Eventbrite account. Please read Eventbrite's privacy policy as well as this one.

What we receive from Eventbrite:

• Registration details — your name, email address, and the session you're attending
• Audience information — whether you're attending as a student, a business, a community participant, or in another capacity, so we can pitch the session correctly
• Accessibility and access requirements — any adjustments you need in order to take part. Optional. See section 4.
• Dietary requirements — where food is provided at a session. Optional. See section 4.
• Photography preference — whether you're happy to be photographed and for images to be published. See section 12.
• Accompanying adult, parent or carer details — where the person attending is under 18, contact details for the adult registering them or confirming their attendance, and an emergency contact number. See section 11.3.

What we collect directly, at or after the session:

• Attendance records — whether you attended, and which sessions you have attended over time
• Feedback and evaluation data — your responses to before-and-after confidence questions, session ratings, written feedback, and any comments you give us
• Work you produce in the session — the prompts, agents, workflows or documents you build, where you choose to share these with us

Where a session is booked another way — by email, or by a school, employer or partner organising a group — we receive the same booking information directly rather than through Eventbrite, and everything in this policy applies in the same way.

Some of this is sensitive. See section 4 on special category data.

2.3 Information we collect if you volunteer with us

If you become an AI Lab volunteer or student mentor, we additionally collect:

• Your contact details and emergency contact details
• Your availability, skills and areas of interest
• Records of the sessions you've supported
• Any training you've completed, including safeguarding briefing

We do not currently carry out DBS checks on volunteers or facilitators. Young people under 16 are accompanied throughout by a parent, carer or member of their school's staff, and our sessions do not run at a frequency that makes facilitating them regulated activity under the Safeguarding Vulnerable Groups Act 2006. If that changes — for example if we increase how often we run sessions — we will review this position and update this policy.

2.4 Information we collect automatically

We do not use website analytics, and we do not track you across our website or across other websites. We do not build a profile of you.

Our website host keeps standard server logs so it can serve the site and keep it secure. These records include:

• Technical information — IP address, browser type and version, device type, operating system
• Request information — which pages were requested, and when

We do not use these logs to build a picture of individual visitors, and we do not combine them with anything else we hold about you.

Section 14 sets out the one item of storage we set on your device, and what happens when you play a video.

2.5 Information we receive from other people

• From education partners — where a school, college or university books a group onto a session, they may share a participant list or group details with us. See section 11.4.
• From employers and partner organisations — where an employer books their team onto a session, they may share attendee names and roles.
• From Eventbrite — we receive the attendee list and the registration details you submitted on the Eventbrite form. See section 2.2.
• From third-party platforms — if you interact with us on LinkedIn, Instagram or at a professional event, we may receive basic professional information from those platforms.

3. Legal Basis for Processing

Under UK GDPR we must have a lawful basis for processing your data. Ours are:

Consent — Article 6(1)(a). Newsletter and marketing emails. Publishing photographs, film and quotes that identify you. Processing any data about a person under 18 where we rely on consent. You can withdraw consent at any time.

Legitimate interests — Article 6(1)(f). Responding to your enquiry. Running and administering sessions you've registered for. Managing relationships with partners, sponsors and education institutions. Understanding and improving our programme. Keeping our website secure and working properly. We have assessed in each case that our interests do not override your rights and freedoms, and you can object at any time.

Contract — Article 6(1)(b). Where we have an agreement with you or your organisation — for example a sponsorship agreement, a venue agreement, an education partnership, or a volunteer agreement.

Legal obligation — Article 6(1)(c). Where the law requires us to keep or disclose records, including tax, accounting, health and safety, and safeguarding obligations.

Vital interests — Article 6(1)(d). In an emergency at a session, to protect someone's life or safety.

4. Special Category Data

Some of the information we collect is "special category" data under Article 9 of UK GDPR, which needs extra protection:

Accessibility and access requirements. If you tell us about a disability, health condition or adjustment you need in order to take part, that is health data.

Dietary requirements. These can reveal health information or religious belief.

We rely on your explicit consent under Article 9(2)(a) to process this data.

These are optional questions on the Eventbrite booking form — both are clearly marked as optional, and you can leave either blank and still book and attend. We ask because we'd rather know than guess, not because we need it on file. Where a session is booked another way, we ask the same optional questions directly.

What consent means here:

• You choose whether to tell us. You do not have to, and it makes no difference to your place at the session.
• We ask only what we need to make an arrangement. Please don't give us more detail than that — a note that you need step-free access is more useful to us than a diagnosis.
• We use it only to make the arrangements you've asked for.
• We share it only with the people who need it to make those arrangements — for example telling a venue about step-free access, or a caterer about an allergy. We share the requirement, not your name and full details, wherever that's possible.
• We delete it within 30 days of the session, unless you ask us to keep it.
• Keeping it on file is your choice. At registration we ask, as a separate question, whether you'd like us to keep your access or dietary requirements for future AI Lab sessions so you don't have to tell us again. Saying no makes no difference to anything. Saying yes is a separate consent from the one that lets us use the information for the session itself, and you can withdraw it at any time by emailing infosec@zygens.com. If you do, we delete it and go back to asking each time.

We do not collect any other special category data, and we ask you not to include health, religious, political or similar information in free-text fields where it isn't needed.

5. How We Use Your Information

5.1 Running the programme

• Responding to your enquiry and putting you in touch with the right person
• Registering you for sessions, sending joining instructions, and telling you about changes
• Making accessibility and dietary arrangements you've asked for
• Running the session, including any activity where you build something
• Issuing certificates of attendance or completion
• Managing the volunteer and student mentor pathway
• Keeping a register of who attended, for safety and for our records

5.2 Improving the programme and evidencing impact

• Analysing before-and-after confidence data, feedback and ratings to improve how we run sessions
• Producing impact reports for funders, sponsors, education partners and local authorities
• Producing case studies and written stories about our work

Important: impact reports we give to sponsors, funders and partners contain aggregated and anonymised data only — numbers, percentages and themes. We do not give sponsors, funders or partners your name, contact details or individual responses, and we do not give them access to participants as a marketing list. If we ever want to name you or quote you, we will ask you first. See section 12.

5.3 Partnerships and commercial relationships

• Managing relationships with sponsors, universities, colleges, schools, employers, venues and local authorities
• Negotiating and administering agreements
• Sending partnership and sponsorship correspondence

5.4 Marketing

• Sending you our newsletter, if you asked for it
• Telling you about future sessions and practical AI content

We use a double opt-in for our newsletter: you'll get a confirmation email and you're only subscribed once you click the link. Every marketing email has an unsubscribe link. We do not send marketing emails to anyone under 18. See section 11.

5.5 Legal, safety and administrative purposes

• Meeting our tax, accounting and legal obligations
• Health and safety, and emergency response at sessions
• Safeguarding, where a concern arises about a young person or an adult at risk
• Protecting our systems and preventing fraud

We do not use your personal data for automated decision-making or profiling.

6. How We Share Your Information

We do not sell, rent or trade your personal data.

6.1 Service providers

We use trusted third parties to run our operations. Each is bound by contract to process your data only on our instructions:

We do not use any website analytics provider. We do not track visitors across our site.

6.2 Venues and event partners

Where a session is held at a partner venue, we share what the venue needs to admit and accommodate you — usually an attendee list, and any access requirements you've told us about.

6.3 Education partners

Where you attend through a school, college or university, we may share attendance and aggregated feedback with that institution, because they need it to evidence the activity they've funded or organised. See section 11.4.

6.4 Sponsors and funders

Aggregated, anonymised reporting only, as described in section 5.2. We do not pass your details to sponsors.

6.5 Zygens Consulting Ltd

AI Lab UK is a programme of Zygens Consulting Ltd, and Zygens is the controller for this data. Zygens staff deliver AI Lab sessions and have access to AI Lab data in that capacity.

We keep AI Lab participant data separate from Zygens' commercial client and prospect data. We do not use AI Lab participant data for Zygens commercial marketing, and attending an AI Lab session will not put you on a Zygens sales list. If you separately ask about Zygens' commercial services, that's handled under the Zygens privacy policy at zygens.com/privacy.

6.6 Legal requirements

We may disclose your information where required by law, court order or a public authority, or where necessary to comply with a legal obligation, protect our legal rights, prevent fraud, or protect someone's safety. This includes disclosing information to safeguarding authorities where we have a concern about a young person or an adult at risk.

6.7 Business transfers

If Zygens Consulting Ltd is merged, acquired, or sells all or part of its business, personal data may transfer to the acquiring entity, subject to the same protections set out here.

7. International Transfers

We primarily store and process data in the United Kingdom and the European Economic Area.

Some of our service providers process data in the United States or elsewhere. This includes Eventbrite, HubSpot and Vimeo, all of which are US-based. Where data goes outside the UK or EEA we rely on:

• UK International Data Transfer Agreements or the UK Addendum to EU Standard Contractual Clauses
• Adequacy regulations, where the UK Government has decided a country provides adequate protection
• Additional technical and organisational safeguards

8. Data Retention

We keep your data only as long as we need it.

After the retention period we securely delete or fully anonymise the data. Anonymised data may be kept indefinitely for statistical and impact purposes, because it can no longer identify you.

9. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (Article 15)
• Rectify data that's inaccurate or incomplete (Article 16)
• Erasure of your data in certain circumstances (Article 17)
• Restrict how we use your data in certain situations (Article 18)
• Portability — receive your data in a structured, commonly used format (Article 20)
• Object to processing based on legitimate interests, and to direct marketing at any time (Article 21)
• Not be subject to solely automated decisions (Article 22) — we don't make any
• Withdraw consent at any time, where consent is our basis

Withdrawing consent doesn't affect processing we did lawfully before you withdrew it.

Photographs and film: you can ask us to remove an image of you at any time, and we will, without needing a reason. See section 12.4.

To exercise any right, contact us at infosec@zygens.com, or write to Zygens Consulting Ltd, Platform, New Station Street, Leeds, West Yorkshire, LS1 4JB.

We'll respond within one month. For complex requests we may extend by up to two further months, and we'll tell you if we do.

Complaints. If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at any time:

Information Commissioner's Office
ico.org.uk
0303 123 1113

10. Data Security

We use appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Access controls, so staff and volunteers can only see the data they need
• Documented information security policies
• Security and data protection training for staff and volunteers who handle participant data
• Monitoring for security threats
• A documented incident response procedure

If a breach happens that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, notify affected individuals without undue delay where the risk is high, and take immediate steps to contain and fix it.

11. Children and Young People

This section matters. AI Lab sessions are open to young people, including school leavers, sixth form and college learners, and school groups. If you are under 18, or you are a parent, carer or teacher, please read this.

11.1 Our approach

We collect as little data about young people as possible, keep it for the shortest time we reasonably can, and never use it for marketing.

How a young person attends depends on their age. We have set the threshold at 16 because our sessions are aimed in part at school leavers and college learners, and we don't think a 17-year-old should need a parent in the room to learn how to use AI.

11.2 Who can attend, and how registration works

• Under 16. A parent, carer, or other responsible adult aged 18 or over must register on the young person's behalf, attend with them, and remain on site throughout. We do not accept online registrations submitted by anyone under 16, and we cannot admit an unaccompanied young person under 16 to an open session.
• 16 and 17. You can register and attend on your own, but we need a parent or carer to confirm at registration that they're happy for you to take part, and to give an emergency contact number. Where we rely on consent for anything else — photography in particular — we ask both you and your parent or carer.
• 18 and over. The rest of this policy applies as normal.
• Organised group bookings, any age under 18. Where a school, college, university or youth organisation books a group, their own staff act as the accompanying adults. See section 11.4.

11.3 Information about parents, carers and accompanying adults

If you register a young person under 16 and attend with them, we collect your name, email address, phone number and your relationship to the young person. We use it to contact you about the session, to confirm at the door that the young person is with the adult who registered them, and to reach you in an emergency.

If a 16- or 17-year-old registers themselves, we collect a parent or carer's name, their confirmation that the young person can take part, and an emergency contact number. We use it for that confirmation and for emergencies only. We do not add parents or carers to any mailing list.

We keep this information for the same period as the young person's registration data — see section 11.6.

11.4 School, college and group bookings

Where a school, college, university or youth organisation books a group onto an AI Lab session:

• The institution is responsible for obtaining any parental consent needed for the young people to take part, and for deciding what participant information to share with us.
• The institution provides the accompanying adults and its staff remain responsible for supervision and safeguarding of their group throughout the session.
• We are usually acting on the institution's instructions in relation to the participant list, which makes us a processor for that data. Where we also use the data for our own impact reporting, we act as a controller for that purpose.
• We will have a written agreement with each institution setting out who is responsible for what, what data is shared, how long we keep it, and what happens to it afterwards.

If your child is attending through their school or college, please direct questions about consent to the school in the first instance, and to us about anything we hold.

11.5 What we do not do with young people's data

• We do not send marketing or newsletter emails to anyone we know to be under 18.
• We do not include identifiable young people in sponsor-facing materials, promotional content or case studies without written parental or carer consent.
• We do not pass young people's details to sponsors, employers or commercial partners.
• We do not use young people's data for profiling.

11.6 Retention of young people's data

• Registration and attendance data for anyone under 18, and any parent, carer or accompanying adult contact details: 12 months, then deleted or anonymised
• Feedback from anyone under 18: anonymised within 3 months
• Photographs and film of anyone under 18: only while parental or carer consent stands, and removed immediately on request from the young person, their parent or their carer

11.7 Safeguarding

We have a safeguarding responsibility to the young people who attend our sessions. We have a named safeguarding lead and a written safeguarding policy, and everyone who facilitates or volunteers at a session is briefed on how to raise a concern.

Where a young person under 16 attends, they are accompanied throughout by a parent, carer or member of staff from their school or organisation, who remains responsible for them. Where a 16- or 17-year-old attends on their own, our facilitators are responsible for them for the duration of the session.

If we have a concern that a young person or an adult at risk may be at risk of harm, we may need to share information with the relevant safeguarding authority, the person's school or organisation, or the police. We will do this in line with statutory safeguarding guidance. We will not always be able to seek consent first, because doing so may increase the risk. Our lawful basis is Article 6(1)(c) and (d).

12. Photography, Filming and Sharing Your Story

We take photographs and film at AI Lab sessions, and we publish attendee stories, quotes and images on our website, in case studies, in impact reports and on social media. Our website already contains photographs of session attendees.

12.1 Our lawful basis

We rely on your consent to publish any photograph, film or quote that identifies you. Consent must be:

• Given freely — you can say no, and it will make no difference to your ability to attend or take part
• Specific — we'll tell you where the image or quote will be used
• Recorded — we keep a record of who consented to what, and when
• Withdrawable — you can change your mind at any time

12.2 How we ask

• We ask at registration whether you consent to being photographed and to images being published.
• We ask again on the day. When you sign in you are given a lanyard, and the colour tells our photographer whether you are happy to be photographed. If you'd rather not be, take the other colour. Nobody will ask you why, and it makes no difference to the session.
• We put clear signage in the room saying that photography is taking place and how to opt out.
• If you have opted out, we will not include you in published images. If you appear incidentally, we'll blur, crop or not use the image.

12.3 Under-18s

For anyone under 18, we need written consent from a parent or carer before publishing any identifiable image or quote — as well as the young person's own agreement.

• Under 16. The accompanying adult is with the young person throughout, so they can give this in person on the day. We record it at the same time.
• 16 and 17 attending alone. We need the parent or carer's written consent in advance, at registration. We will not publish an identifiable image of a 16- or 17-year-old on the strength of their own agreement alone.
• School and college groups. The institution handles parental consent, and must confirm to us in writing which young people can be photographed.

12.4 Withdrawing consent

Email infosec@zygens.com and tell us which image, quote or story you want removed. You don't need to give a reason. We'll remove it from our website and our own channels promptly.

Please be aware that where an image has already been shared on social media, reposted by someone else, or included in a printed report, we may not be able to recall every copy. We'll remove everything within our control and tell you what we couldn't reach.

12.5 Quotes and testimonials

We only publish a quote attributed to you — by name, role, organisation, or in a way that could identify you — with your consent. We'll show you the quote and how we've attributed it before it goes live.

13. Third-Party Websites

Our website links to and embeds content from other websites, including zygens.com, our partners' sites, Eventbrite, Vimeo and social media. This policy doesn't apply to those sites and we're not responsible for their privacy practices. Please read their policies — Eventbrite's in particular, since that's where session booking happens.

14. Cookies and Similar Technologies

We have deliberately kept this simple. We do not use advertising cookies, and we do not use any website analytics. We do not track you across our website or across other websites, and we do not build a profile of you.

14.1 What we set

One item, and it is strictly necessary:

It contains no identifier and is not shared with anyone.

Because this is the only thing we set and it is strictly necessary for the website to work as expected, we do not need to ask for your consent, and we do not show you a cookie banner.

14.2 Videos

The videos on our website are hosted by Vimeo. They do not load until you click play. Until you do, your browser makes no request to Vimeo and Vimeo sets nothing on your device.

When you click play, Vimeo loads the video and may set cookies at that point. We ask Vimeo not to track you by enabling its Do Not Track setting, which means Vimeo does not use your viewing for analytics or advertising. Vimeo's own privacy policy applies to what it does at that point.

If you would rather Vimeo set nothing at all, simply don't click play.

14.3 Fonts

We load fonts from Google Fonts. This does not set any cookies.

14.4 Your browser controls

You can block or delete cookies and site data through your browser settings at any time. Blocking storage from our site may mean the page loses your scroll position when you navigate back, but nothing else will break.

15. Changes to This Policy

We may update this policy to reflect changes in how we work, in the law, or in our programme. When we make significant changes we will update the "Last Updated" date, post the updated policy here, and where the change materially affects how we process your data, tell affected people directly.

16. Contact Us

For any question, concern or request about this policy or your data:

Email: infosec@zygens.com

Post:
Zygens Consulting Ltd
Platform, New Station Street
Leeds, West Yorkshire, LS1 4JB
United Kingdom

Company Registration Number: 16406295

We aim to respond to all enquiries within 5 working days, and to formal rights requests within one month.

This Privacy Policy is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.