Data Processing & Security
This page explains the principles Colligere AI Analytics Limited applies to the design and delivery of its products and services. Contractual data-processing obligations for a customer engagement or deployment will be set out in the applicable customer agreement and Data Processing Agreement.
1. Controller and processor roles
For information collected through the public Colligere website and Contact Us form, Colligere will normally act as controller. For customer research, programme, participant or operational data, the customer will normally act as controller and Colligere will normally act as processor, depending on the engagement and applicable law.
2. Customer data ownership
Customers retain their rights in customer data. Colligere does not claim ownership of customer or participant data merely because it is stored or processed through our products or services.
3. Processing instructions
Where Colligere acts as processor, customer data will be processed only for authorised service delivery, support, security, maintenance and other purposes agreed with the customer. If an instruction appears to conflict with applicable data-protection law, we may pause the instruction and raise the issue with the customer.
4. Security controls
Our production services are being designed around layered safeguards including encryption in transit and at rest, role-based access, least-privilege access, logging and audit history, secure credential and key management, backups, recovery controls, security monitoring, incident response, access reviews and security testing.
5. Hosting and data residency
Production infrastructure is planned on Amazon Web Services (AWS) where appropriate. Hosting regions and data-residency arrangements will be selected according to applicable regulatory, institutional and customer requirements.
6. Regulated workloads
Where an engagement involves regulated or sensitive data, Colligere will use contractual, technical and organisational safeguards appropriate to the applicable requirements and the agreed deployment.
7. Subprocessors
We may use vetted subprocessors to support hosting, communications, security and service delivery. Subprocessors that process customer personal data will be subject to appropriate contractual obligations. A current production subprocessor list will be made available to customers where appropriate.
8. Personnel access and confidentiality
Access to customer data will be limited to authorised personnel with a legitimate need, subject to confidentiality obligations, role-based controls and appropriate training. External advisers do not receive access to production customer or participant data unless specifically authorised under appropriate contractual and access controls.
9. AI use
AI may assist with tasks such as workflow design, structured definitions, analysis and quality-review support. Customer data is not used to train AI models without explicit authorisation, a lawful basis and appropriate safeguards. AI-assisted outputs remain reviewable and subject to human oversight.
10. Data subject rights
Where Colligere acts as processor, we will support customers in responding to lawful data-subject requests in accordance with the applicable agreement. Where Colligere acts as controller, individuals may contact us directly through our Your Data Rights page.
11. Security incidents
We are establishing documented procedures for detecting, investigating, containing and responding to security incidents and personal-data breaches. Where customer data is affected, notification and cooperation obligations will follow applicable law and the customer agreement.
12. Return and deletion
At the end of a customer relationship, customer data will be returned, exported or deleted in accordance with the applicable agreement, documented customer instructions and any legal retention requirements.
13. Compliance programme
Our production services are being developed with technical, organisational and contractual safeguards intended to support applicable privacy, security and regulatory requirements. Where relevant, assurance activities and control frameworks will form part of the security roadmap for the applicable product or service.
14. Questions
For privacy or data-processing questions, contact privacy@colligereai.com.