PRIVACY POLICY
Last updated: September 2026
Keryon Governance is committed to protecting the privacy and confidentiality of the personal information entrusted to us.
This Privacy Policy explains how personal data is collected and processed through this website, including information submitted when requesting an AI Exposure Assessment or contacting Keryon Governance.
1. Data Controller
The controller responsible for the processing of personal data through this website is:
[LEGAL NAME / COMPANY NAME] Trading as Keryon Governance Tax ID: [●] Registered address: [●] Email: [PRIVACY EMAIL]
Website: keryongov.com
2. Personal Data We Collect
Depending on how you interact with Keryon, we may process:
Identification and professional information, including your name, position, company or organisation, industry and professional contact details.
Information submitted through our forms, including information concerning your organisation, its activities, technology environment and known or suspected uses of artificial intelligence.
Communications, including information contained in enquiries, emails or subsequent correspondence with Keryon.
Technical information, where applicable, including information generated when accessing or interacting with the website, such as IP address, browser or device information and technical logs.
Information submitted in connection with an AI Exposure Assessment may occasionally contain personal data relating to other individuals. You should only provide such information where it is relevant to the assessment and you are authorised to do so.
3. Purposes of Processing
We process personal data for the following purposes:
AI Exposure Assessment. To review assessment requests, analyse the information provided, communicate with the requesting organisation and prepare or determine the scope of an Initial AI Exposure Report.
Enquiries and professional communications. To respond to requests for information and communications received through the website or other contact channels.
Professional services. Where a professional relationship is subsequently established, to manage the relationship and provide the agreed advisory services.
Website operation and security. To maintain the availability, integrity and security of the website and its underlying systems.
Legal and regulatory obligations. Where necessary, to comply with obligations applicable to Keryon or to establish, exercise or defend legal claims.
Personal data will not be used for purposes incompatible with those for which it was collected.
4. Legal Basis
The legal basis depends on the circumstances and purpose of the processing.
Information submitted through the AI Exposure Assessment or other voluntary website forms is processed on the basis of the steps requested by the data subject prior to entering into a professional relationship and, where appropriate, consent.
Where an advisory or other contractual relationship is established, processing necessary to provide the relevant services is based on performance of the contractual relationship.
Certain processing necessary for website security, fraud prevention, management of professional communications and the protection of Keryon’s legal interests may be based on legitimate interests, provided that those interests are not overridden by the rights and freedoms of the individuals concerned.
Where processing is required by applicable law, the legal basis is compliance with a legal obligation.
5. AI-Assisted Processing
Keryon uses AI-assisted methodologies and technological tools as part of its regulatory, legal and technical analysis.
Information submitted in connection with an AI Exposure Assessment may therefore be processed using AI-enabled systems where their use is appropriate for the requested analysis.
AI tools support Keryon’s analytical work. They do not independently determine the conclusions or recommendations provided to clients. Relevant findings and conclusions are subject to professional review and senior legal and technical judgement.
Keryon applies data minimisation and confidentiality considerations when determining what information is appropriate for AI-assisted processing.
For this reason, users should not submit passwords, authentication credentials, financial account information, special categories of personal data, medical information, highly sensitive personal information or other information presenting a material confidentiality or security risk unless specifically requested and an appropriate channel has been agreed.
6. Recipients and Service Providers
Personal data may be accessible to service providers supporting Keryon’s activities where access is necessary for the provision of their services.
These may include providers of:
- website hosting and infrastructure;
- email and communications;
- website forms and security;
- cloud storage and productivity services; and
- AI and technology services used in connection with Keryon’s analytical methodology.
Such providers process information subject to the applicable contractual, confidentiality and data protection requirements.
Personal data will not be sold to third parties.
It will not be disclosed to third parties for their own marketing purposes.
7. International Data Transfers
Some technology, cloud or AI service providers used by Keryon may process information from infrastructure located outside the European Economic Area.
Where personal data is transferred internationally, Keryon will apply the mechanisms and safeguards required under applicable data protection law, including, where relevant, adequacy decisions adopted by the European Commission, Standard Contractual Clauses or other legally recognised safeguards.
Further information concerning the safeguards applicable to a particular transfer may be requested using the contact details provided in this Privacy Policy.
8. Data Retention
Personal data will be retained only for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal obligations.
Information submitted for an AI Exposure Assessment will be retained for the period necessary to evaluate and prepare the assessment and, where a professional relationship follows, for the duration of that relationship and the applicable legal retention periods.
Where an assessment request does not result in a professional engagement, the information will not be retained indefinitely and will be deleted or anonymised once it is no longer reasonably necessary for the purpose for which it was submitted.
Information relating to professional engagements may be retained for the periods necessary to comply with legal, professional, accounting or liability requirements.
9. Data Security and Confidentiality
Keryon applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
Access to information is limited according to professional and operational requirements.
The nature of internet communications means that absolute security cannot be guaranteed. Users should therefore avoid submitting unnecessarily sensitive information through standard website forms.
10. Your Rights
Under applicable data protection law, you may have the right to:
access your personal data;
rectify inaccurate or incomplete data;
request erasure of your personal data where the applicable requirements are met;
request restriction of processing;
object to processing based on legitimate interests;
request portability of your data where applicable; and
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
These are the principal rights recognised under the GDPR.
Requests may be addressed to:
[PRIVACY EMAIL]
Keryon may request reasonable information to verify your identity before processing a request.
You also have the right to lodge a complaint with the competent supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD). Spanish Data Protection Agency (AEPD)
11. Automated Decision-Making
Keryon does not use information submitted through this website to make decisions producing legal or similarly significant effects on individuals solely by automated means.
The use of AI-assisted tools within Keryon’s analytical methodology does not replace the professional assessment involved in preparing Keryon’s conclusions or recommendations.
12. Cookies and Website Technologies
This website may use technical cookies and other technologies necessary for its operation and security.
Where analytics, measurement, third-party or other non-essential cookies or technologies are introduced, information concerning their purposes, providers and duration will be provided through the corresponding Cookie Policy and consent mechanism, where required.
13. Third-Party Websites
The website may contain links to third-party websites or services.
Keryon is not responsible for the privacy practices or content of external websites. Users should review the privacy information provided by those third parties before providing personal data to them.
14. Changes to this Privacy Policy
Keryon may update this Privacy Policy to reflect changes in its services, technology, processing activities or applicable law.
The current version will be published on this website together with its date of last update.