This agreement applies when IGC Technical Solutions Ltd processes personal data for a customer through AI Assure. It forms part of the Terms and Conditions. The customer is the controller for personal data it chooses to submit or monitor through the service. IGC Technical Solutions Ltd acts as processor for that customer data. Each party remains responsible for its own controller activities.
1. Processing details
The subject and purpose are providing, securing, and supporting AI Assure. Processing continues for the customer's service term and as needed to meet legal obligations, resolve disputes, and protect the service.
Data may include business user names, work email addresses, roles, and sign-in records; device names, Windows machine identifiers, operating system and agent versions, and a fingerprint of installed programs; the names and websites of listed AI services identified on devices, with times; which listed AI applications are installed; AI programs closed under policy; blocked website or application attempts identified by the agent; agent check-ins; sites, departments, policy settings and status; support requests; customer-written AI policy answers, optional company logos and document records; the contact the customer sets for staff to ask about blocked AI tools (an email address or web page); and audit records. Data subjects may include the customer's employees, contractors, and other people who use its enrolled devices, and the customer's authorised users. The monitoring agent is designed not to collect prompts, typed content, uploaded files, AI responses, remote page content, emails, messages, or screen content. Information the customer chooses to submit in support forms or the written policy builder, including a company logo, is processed for that request or document. The local web-filtering proxy checks requested hostnames against policy. Where enabled, a device-created trust certificate serves only local responses for blocked hosts, as described on the Security page. The proxy forwards allowed browser connections to their destinations, and does not forward blocked requests to the blocked destination. It does not decrypt allowed HTTPS traffic. IGC Technical Solutions has no remote access to the customer's devices. The only software the agent installs is updates to the AI Assure agent itself that we publish (from version 1.3.0), and it attempts to uninstall after receiving an authorised uninstall or service-end instruction at check-in. Offline devices cannot receive that instruction until they reconnect.
2. Customer instructions
We process customer data to provide the service, follow the customer's account configuration and documented instructions, and meet applicable legal obligations. If the law requires processing outside those instructions, we will inform the customer before processing unless the law prohibits that notice. We will inform the customer if we consider an instruction to infringe applicable data protection law. The customer is responsible for ensuring its instructions and use of monitoring are lawful.
3. Confidentiality and security
We restrict access to authorised personnel who need it to operate or support the service and require them to protect customer information. We maintain appropriate technical and organisational measures to protect customer data, including encrypted connections, hashed passwords, encrypted authenticator secrets and device keys, two-step sign-in for every account, sign-out after a period of inactivity, role and site-based access controls, and audit records.
4. Assistance
Taking account of the nature of processing, we will provide reasonable assistance with data subject requests, security obligations, and information needed to demonstrate compliance, including appropriate assistance with security, breach assessment, data protection impact assessments and prior regulatory consultation where required. This assistance does not transfer the controller's decisions or responsibilities to AI Assure. Contact hello@aiassure.net.
5. Security incidents
We will notify the customer without undue delay after becoming aware of a personal data breach affecting its customer data and provide information reasonably available to help the customer meet its obligations.
6. Subprocessors and transfers
Customer data is hosted on our own servers in our data centre in the United Kingdom. Our current provider information and provider roles are listed on the Subprocessors page. The customer gives general written authorisation for the identified subprocessors processing its service data. We will notify the customer before adding or replacing such a subprocessor and give it an opportunity to object on data protection grounds before the change. Payment and website providers may act under their own controller responsibilities rather than as a processor of device-monitoring records. We will impose relevant data protection obligations on subprocessors and remain responsible for their processing as required by law. If a restricted international transfer of customer data is proposed, we will put the required transfer mechanism and safeguards in place before the transfer.
7. Return and deletion
At the end of the service, the customer may request return or deletion of customer data by contacting us. Otherwise, customer service data is deleted automatically 90 days after cancellation takes effect, subject to the retention below. Before deletion, the agent is instructed to uninstall itself from the customer's devices. An offline device cannot receive uninstall instructions until it reconnects and may retain cached policy locally; the customer must arrange authorised local removal where necessary. Retiring a record on the server does not itself remove software from a disconnected device. Invoices, payment records, account credit records, and associated billing details are retained for six years after the end of the financial year they relate to, to meet applicable accounting and tax record-keeping requirements. Security audit records are retained for six years after the end of the financial year they relate to under our operational retention schedule, not because accounting or tax rules specifically require that period. Records are assessed for deletion under that schedule; active-customer financial records remain while needed to administer the account. Security audit retention follows the separate operational schedule described above. A specific deletion schedule can be agreed in the customer order.
8. Audit information
We will make available information reasonably necessary to demonstrate compliance with this agreement. A customer may request a proportionate review, subject to confidentiality, security, and other customers' rights. This includes reasonable information and audit or inspection assistance to the extent required by applicable data protection law.
9. Contact
IGC Technical Solutions Ltd, 3 The Studios, 320 Chorley Old Road, Bolton, England, BL1 4JU. Email hello@aiassure.net.