Privacy Policy
AI Integrity Certification (Pty) Ltd is committed to the responsible, transparent, and lawful handling of personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).
Last Updated: October 2026
Transparency
We clearly disclose what data we collect, why we collect it, and how it is used — before we collect it.
Security
All data is stored in encrypted environments with strict role-based access controls and regular security reviews.
Your Rights
You have the right to access, correct, delete, and object to the processing of your personal information at any time.
1. Who We Are
AI Integrity Certification (Pty) Ltd (“AIC”, “we”, “us”) is a South African company providing AI governance certification services. We operate as a certification body and are the responsible party for personal information collected through this website and our certification platform.
Our Information Officer is responsible for ensuring compliance with POPIA and can be contacted at the details in Section 11 of this policy.
2. What Personal Information We Collect
We collect only the minimum personal information necessary to deliver our services. This includes:
Identity information: Name, job title, and professional credentials of Accountable Persons and certification contacts.
Contact information: Work email addresses and telephone numbers used for certification correspondence.
Organisational information: Business name, registration number, sector, and address of applicant organisations.
Audit evidence: Governance documents, policy records, decision logs, and bias assessment data submitted for certification review.
Practitioner data: Education records, CPD logs, examination results, and competency evidence for CAAP candidates.
AIC Aware accounts: For organisations that register for an AIC Aware badge: the name, job title and email of the named Accountable Person, the answers to the AIC Aware questions, the name of the person who confirmed the declaration and when, and a one-way hash of the IP address used to accept it (never the address itself).
Website usage data: Google Analytics, and only if you allow it (see Section 9).
We do not collect special categories of personal information (race, health, religion, political views, biometric data) unless it is directly relevant to a bias audit and you have provided explicit written consent.
3. Why We Collect It — Lawful Basis
We process personal information on the following lawful bases under POPIA:
Performance of a contract
To execute certification assessments, issue certificates, and maintain the public registry as agreed in the Assessment Agreement.
Legitimate interest
To improve our services, detect fraud, and ensure the integrity of the certification process.
Legal obligation
To maintain records required by POPIA, the Companies Act, and our accreditation obligations.
Consent
For marketing communications, newsletter subscriptions, and any processing not covered above. You may withdraw consent at any time.
4. Audit Evidence and Confidentiality
Audit evidence submitted through the Governance Platform is processed exclusively for the purpose of the certification assessment. AIC does not:
Use client audit data to train, fine-tune, or benchmark AI models.
Share audit evidence with other certified or applicant organisations.
Disclose the content of governance documents to third parties without written consent, except where required by law or accreditation oversight.
Retain audit evidence beyond the defined retention period (see Section 6).
5. Who We Share Information With
We do not sell personal information. We share it only in the following circumstances:
Accreditation bodies
AIC is not currently accredited. If it becomes accredited, the accreditation body may review assessment records as part of its oversight, under confidentiality obligations.
Auditors and assessors
Independent auditors assigned to an assessment receive only the information necessary to conduct that assessment.
Infrastructure providers
Cloud hosting and analytics providers (operating under data processing agreements) may process data on our behalf. They are contractually prohibited from using it for their own purposes.
Legal and regulatory authorities
Where required by South African law, court order, or the Information Regulator.
Public registry
For certified organisations: the organisation name, certification status band and certificate number. No numeric score is published. No personal information is published without consent.
AIC Aware badge verification
Anyone checking a badge code sees the organisation's name as registered when the badge was issued, the issue and expiry dates, whether the badge is valid, expired or revoked (with the reason if revoked), and that a named person is accountable, but never that person's name, the organisation's answers or any result. Organisations that opt in are also listed in the AIC Aware directory by name and date.
6. How Long We Keep Your Information
| Data Category | Retention Period |
|---|---|
| Certification records and audit evidence | Duration of certification + 5 years |
| Accountable Person declarations | Duration of certification + 5 years |
| AIC Aware badges and declarations | Life of the badge + 5 years |
| AIC Aware answers (platform account) | While the account is active + 2 years |
| AIC Aware self-check on the website (email, company, result) | 24 months from last contact |
| Practitioner examination records | Duration of credential + 7 years |
| CPD logs | 7 years from the relevant CPD cycle |
| Website enquiry data | 24 months from last contact |
| Marketing consent records | Until consent is withdrawn, then 2 years |
| Financial/invoicing records | 5 years (Companies Act requirement) |
At the end of a retention period, data is securely deleted or anonymised. You may request early deletion subject to our legal obligations (see Section 7).
7. Your Rights Under POPIA
As a data subject under POPIA, you have the following rights. To exercise any of them, contact our Information Officer (Section 11) with proof of identity.
Right to Access
Request a copy of the personal information we hold about you.
Right to Correction
Request correction of inaccurate or incomplete information.
Right to Deletion
Request deletion of your information where we no longer have a lawful basis to hold it.
Right to Object
Object to processing based on legitimate interest, including direct marketing.
Right to Restrict Processing
Request that we limit how we use your data while a dispute is resolved.
Right to Complain
Lodge a complaint with the Information Regulator of South Africa if you believe we have violated POPIA.
Information Regulator: complaints can be lodged at inforegulator.org.za. We will respond to all requests within 30 days.
8. Automated Decision-Making
AIC uses automated tools to generate preliminary Integrity Scores and flag potential compliance gaps during an assessment. These outputs are advisory only — no certification decision is made without a qualified human auditor reviewing and approving the result. This is consistent with POPIA Section 71 and with the principles of the AIC Declaration of Algorithmic Rights.
9. Cookies and Analytics
This website uses Google Analytics, and it currently loads for every visitor without asking first. We are not going to describe that as anything other than what it is: analytics cookies are set on your first page view, and you are not given the choice beforehand. If you would rather not be measured, block the script or use your browser's tracking protection — or tell us and we will remove your data.
If you allow it, Google Analytics sets cookies that assign your browser a persistent identifier and records which pages you visit, how you arrived, and your device and approximate location. That is personal information under POPIA, and it is processed by Google LLC, including on infrastructure outside South Africa. We enable IP anonymisation. We use it to see which pages are read, and for nothing else — there is no advertising, no remarketing, and no profile is built about you by us.
You can change your mind at any time using the analytics preference link in the footer. Nothing on this site requires analytics to function, so declining costs you nothing.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered platform users and noted at the top of this page. Continued use of our services after the effective date of a change constitutes acceptance of the revised policy.
11. Contact Our Information Officer
Information Officer
Zander Wilken
AI Integrity Certification (Pty) Ltd
South Africa
zander@ztoaholdings.comAll POPIA requests will be acknowledged within 5 business days and responded to within 30 calendar days.