Privacy Policy
Last updated: 28 October 2026
This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
In brief
We collect only what we need to send the newsletter, consider registrations of interest, run the club and operate this website.
We do not sell your personal data.
Our newsletter is delivered by beehiiv, which handles subscriber data on our behalf.
Our dinners are held under the Chatham House Rule unless explicitly stated otherwise. We do not record them or attribute anything said.
You can unsubscribe, object or ask us to delete your data at any time by writing to info@aigrcnetwork.com.
1. Who we are
AI GRC Network (“we”, “us”, “our”) publishes a free weekly newsletter and runs a private, invitation-only club in London for executives accountable for AI in regulated financial institutions.
Company: AI GRC Network Ltd, registered in England and Wales
Company number: 17532334
Registered office: 124 City Road, London EC1V 2NX
ICO registration number: ZC282931
Data protection contact: info@aigrcnetwork.com
AI GRC Network Ltd is the data controller of the personal data described in this policy. As data controller, we are legally responsible for deciding how and why your personal data is used, and for ensuring that it is handled in accordance with applicable data protection law. info@aigrcnetwork.com is our designated contact point for all data protection enquiries.
2. Scope of this policy
This policy covers personal data we collect when you:
visit our website
subscribe to or read our newsletter
register your interest in membership
propose and second someone for membership
become a member, or arrange payment for a member
attend one of our dinners, as a member or a guest
take part in our benchmark survey
contact us, or are contacted by us as a prospective member.
It does not cover other websites we link to, including the sources we cite. We are not responsible for how those websites handle personal data.
Members also agree to separate membership terms. These set out members’ own obligations, such as confidentiality and how attendee lists may be used. They do not change how we handle your personal data, which this policy explains. If membership involves any further use of your data, we will tell you before it starts.
3. Personal data we collect
3.1 Information you give us
Newsletter subscribers. Your email address [and name, if you provide it].
People who register interest. Your name, job title, employer, business email address, [phone number], LinkedIn profile, the function you lead, whether you hold a Senior Management Function, how you heard about us, the name of anyone who proposed you, and anything else you choose to tell us. We keep brief notes of our conversation with you.
Members. The information above, plus billing and invoicing details. Where your employer pays, this includes the name and contact details of the person responsible for payment. We also keep your membership dates, payment history, the dinners you attend and your communication preferences.
Dinner attendees. Any dietary requirements or accessibility needs you choose to share (see section 5), and records of attendance.
Benchmark participants. Your responses to our annual benchmark survey.
Enquiries. Your name, contact details and the content of your message when you contact us.
3.2 Information we collect automatically
Newsletter. The date, time and source of your sign-up, technical data such as IP address and device type, and whether you open our emails and which links you click.
Website. Website. Technical data such as IP address, browser, device and pages visited, collected by our website host and analytics tool. Your IP address is also received by Google when our website loads its fonts (see section 14).
3.3 Information from other sources
Prospective members. Business contact details (name, job title, employer, business email address and LinkedIn profile). We obtain these from public sources, such as the FCA Financial Services Register, company websites, LinkedIn and press coverage, or through introductions from members, contacts or introduction services.
People who register interest. We may check what you tell us against public sources, such as the FCA Financial Services Register, your employer’s website and LinkedIn.
Proposers and seconders. If a member or contact proposes or seconds someone for membership, we record the proposer’s and seconder's names and, where relevant, their job title and institution. We may receive this from the proposer/ seconder or from the person they proposed/seconded.
4. How your personal data is used
Sending the newsletter and understanding how it is read.
Basis: consent. You can withdraw it at any time using the unsubscribe link in every email.
Considering registrations of interest and deciding whether to extend an invitation.
Basis: our legitimate interest in assessing eligibility for a selective club, and steps taken at your request before entering into a contract.
Recording who proposed a candidate, and confirming the proposal with them.
Basis: our legitimate interest in running an invitation-based club, where membership depends on personal recommendation.
Providing membership, organising dinners, invoicing and member communications.
Basis: performance of our contract with you. Where your employer contracts with us, the basis is our legitimate interest in administering that contract.
Sharing the attendee list for a dinner with that dinner's attendees.
Basis: our legitimate interest in letting attendees know who will be in the room.
Catering for dietary and accessibility needs.
Basis: your explicit consent (see section 5).
Producing the annual benchmark.
Basis: our legitimate interest in producing research for members. Results are published only in aggregated, anonymised form, and no individual or institution can be identified.
Contacting prospective members about the club.
Basis: our legitimate interest in introducing a relevant professional service to senior executives. Every message identifies us and offers a simple way to opt out.
Running and securing this website.
Basis: our legitimate interest in operating a secure, working website, and your consent for any non-essential cookies.
Responding to enquiries.
Basis: our legitimate interest in replying to you.
Keeping financial records and meeting tax and legal obligations.
Basis: legal obligation.
Establishing, exercising or defending legal claims.
Basis: our legitimate interests.
Where we rely on legitimate interests, we have weighed our interests against your rights and reasonable expectations.
We do not make decisions about you based solely on automated processing. Every registration of interest is reviewed by a person.
5. Special category personal data
We do not knowingly collect sensitive (“special category”) data, such as information about health or religious beliefs. The only exception is dietary and accessibility information, which can reveal details about health or religious belief.
We ask for it only so the venue can cater for you.
We collect it only with your explicit consent, which you can withdraw at any time.
We share it only with the venue for the dinner you are attending.
We keep it only for the periods set out in section 10.
6. Legal bases for processing
6.1 Contract. We use your data where we need it to provide membership you have agreed to, or to take steps you have asked for before agreeing.
6.2 Legitimate interests. We use your data where it is necessary for our reasonable business interests, and those interests are not outweighed by your rights. Section 4 sets out where we rely on this basis.
6.3 Consent. We rely on your consent for the newsletter, non-essential cookies, photographs, and dietary and accessibility information. You can withdraw consent at any time. This does not affect anything we did before you withdrew.
6.4 Legal obligation. We use your data where the law requires us to keep or share it, for example financial records for tax purposes.
7. Dinners, photography and the Chatham House Rule
All dinners are held under the Chatham House Rule unless explicitly stated otherwise. What is said may be used, but we take every reasonable care that no one who attended is identified.
We do not record dinners. Any notes are written so that no remark is attributed to a person or institution.
Confidentiality is shared. Every member and guest is asked to respect it in the same way.
Before each dinner, we share a list of attendees (name, job title and institution) with that dinner’s attendees only.
We take photographs only with the consent of those pictured.
8. Sharing your personal data
We do not sell your personal data. We share it only with the following.
8.1 Service providers. These process data on our behalf: our website host and form provider (Framer), our form integration provider (Framer Forms Connect, operated by Hella Fast, LLC), which passes newsletter sign-ups from our website to beehiiv without storing them, our newsletter platform (beehiiv), our email and document provider, our accounting software and our contact management tool.
beehiiv also uses some data for its own purposes, such as keeping its service secure, preventing abuse and providing certain optional features. For those purposes, beehiiv acts as a controller under its own privacy policy: https://www.beehiiv.com/privacy
8.2 Dinner venues and attendees. Venues receive attendees’ names and any dietary or accessibility requirements. The other attendees of a dinner receive the attendee list described in section 7.
8.3 Professional advisers and authorities. We share data with our accountants, lawyers and insurers where necessary, and with authorities, regulators or courts where the law requires it.
8.4 A buyer or successor. If all or part of our business is sold, merged or reorganised, data may pass to the new owner. Any new owner would be bound by this policy for data collected under it, and we would tell you of the change.
9. International data transfers
Some of our service providers are based outside the UK, or process data outside it.
Our newsletter is hosted and delivered by beehiiv Inc., based in the United States. When you subscribe, beehiiv collects and stores your email address and related data on our behalf, as our processor.
Data sent to the US is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our agreement with beehiiv. You can read it in beehiiv’s data processing agreement at beehiiv.com/dpa.
Our website host, Framer B.V., is based in the Netherlands and uses Amazon Web Services. Data may be processed outside the UK and EU. These transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our agreement with Framer.
Newsletter sign-ups pass from our website to beehiiv through Framer Forms Connect, operated by Hella Fast, LLC in the United States. It does not store them.
Google Fonts is provided by Google LLC, based in the United States, so your IP address may be transferred there when our website loads its fonts. Google explains how it protects data transferred from the UK in its privacy policy.
10. How long we keep your data
Newsletter subscribers: until you unsubscribe. We then keep your email address on a suppression list, so that we do not contact you again.
Unsuccessful registrations of interest: 48 months from our decision, so that we can consider a future registration.
Proposer details: for as long as we keep the record of the person they proposed.
Membership records: for the duration of your membership and 5 years afterwards.
Financial records: six years from the end of the financial year they relate to, as UK tax law requires.
Dietary and accessibility information (members): for the duration of your membership, so you do not need to tell us before every dinner, unless you ask us to delete it sooner.
Dietary and accessibility information (guests): deleted within one month after the dinner.
Prospective members: up to 48 months from our last contact, or sooner if you ask us to stop.
Benchmark responses: individual responses are deleted 48 months after the results are published. The aggregated results contain no personal data and may be kept indefinitely.
Enquiries: up to 5 years.
Website technical data: for the period set by our website host.
11. Your rights
Under UK and EU data protection law, you have the following rights.
Right of access. You can ask for a copy of the personal data we hold about you.
Right to rectification. You can ask us to correct data that is inaccurate or incomplete.
Right to erasure. You can ask us to delete your data, in certain circumstances.
Right to restrict processing. You can ask us to limit how we use your data, in certain circumstances.
Right to data portability. You can ask to receive your data in a portable format, where we process it on the basis of consent or contract and by automated means.
Right to object. You can object to our use of your data where we rely on legitimate interests. You can object at any time to direct marketing, in which case we will stop.
Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew.
Rights relating to automated decisions. You have the right not to be subject to decisions made solely by automated means that significantly affect you. We do not make such decisions (see section 4).
Right to complain. You can complain to a data protection authority (see section 12).
To exercise any of these rights, write to info@aigrcnetwork.com. We may need to confirm your identity. We will respond within one month. For complex requests, this can be extended, in which case we will tell you why within the first month.
12. Right to lodge a complaint
If you have a concern, please contact us first at info@aigrcnetwork.com. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You also have the right to complain to a data protection authority:
In the UK: the Information Commissioner’s Office (or its successor, the Information Commission), at ico.org.uk or 0303 123 1113.
In the EU: the data protection authority in the country where you live or work, or where the issue arose. The European Data Protection Board lists them at edpb.europa.eu.
13. Security
We use appropriate technical and organisational measures to protect your data, including access controls. Only those who need applicant and member data can access it. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant regulator as the law requires.
14. Cookies and similar technologies
Our website uses only cookies that are strictly necessary for it to work. You can control cookies through your browser settings.
Our website uses fonts from Google Fonts, provided by Google. To display them, your browser connects to Google's servers, which receive your IP address and basic technical information about your browser. This does not involve cookies. You can read how Google handles this information in its privacy policy: https://policies.google.com/privacy
Our newsletter emails contain standard technology that shows whether an email was opened and which links were clicked. This helps us understand what our readers find useful. You can limit it by turning off images in your email program.
15. Children
Our services are for professionals. We do not knowingly collect data from anyone under 18.
16. Web scraping and unauthorised data collection
You must not use automated tools to scrape, harvest or collect personal data from our website or newsletter. Our website terms set out this rule in full.
17. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Where changes are significant, we will tell subscribers and members by email.
18. Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:
AI GRC Network Ltd
Company number: 17532334
Email: info@aigrcnetwork.com
124 City Road, London, EC1V 2NX
We aim to respond to all enquiries within 30 days. For complex or multiple requests, this period may be extended, in which case we will let you know.
This policy explains what personal data we collect, why we collect it, how long we keep it and what rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
In brief
We collect only what we need to send the newsletter, consider registrations of interest, run the club and operate this website.
We do not sell your personal data.
Our newsletter is delivered by beehiiv, which handles subscriber data on our behalf.
Our dinners are held under the Chatham House Rule unless explicitly stated otherwise. We do not record them or attribute anything said.
You can unsubscribe, object or ask us to delete your data at any time by writing to info@aigrcnetwork.com.
1. Who we are
AI GRC Network (“we”, “us”, “our”) publishes a free weekly newsletter and runs a private, invitation-only club in London for executives accountable for AI in regulated financial institutions.
Company: AI GRC Network Ltd, registered in England and Wales
Company number: 17532334
Registered office: 124 City Road, London EC1V 2NX
ICO registration number: ZC282931
Data protection contact: info@aigrcnetwork.com
AI GRC Network Ltd is the data controller of the personal data described in this policy. As data controller, we are legally responsible for deciding how and why your personal data is used, and for ensuring that it is handled in accordance with applicable data protection law. info@aigrcnetwork.com is our designated contact point for all data protection enquiries.
2. Scope of this policy
This policy covers personal data we collect when you:
visit our website
subscribe to or read our newsletter
register your interest in membership
propose and second someone for membership
become a member, or arrange payment for a member
attend one of our dinners, as a member or a guest
take part in our benchmark survey
contact us, or are contacted by us as a prospective member.
It does not cover other websites we link to, including the sources we cite. We are not responsible for how those websites handle personal data.
Members also agree to separate membership terms. These set out members’ own obligations, such as confidentiality and how attendee lists may be used. They do not change how we handle your personal data, which this policy explains. If membership involves any further use of your data, we will tell you before it starts.
3. Personal data we collect
3.1 Information you give us
Newsletter subscribers. Your email address [and name, if you provide it].
People who register interest. Your name, job title, employer, business email address, [phone number], LinkedIn profile, the function you lead, whether you hold a Senior Management Function, how you heard about us, the name of anyone who proposed you, and anything else you choose to tell us. We keep brief notes of our conversation with you.
Members. The information above, plus billing and invoicing details. Where your employer pays, this includes the name and contact details of the person responsible for payment. We also keep your membership dates, payment history, the dinners you attend and your communication preferences.
Dinner attendees. Any dietary requirements or accessibility needs you choose to share (see section 5), and records of attendance.
Benchmark participants. Your responses to our annual benchmark survey.
Enquiries. Your name, contact details and the content of your message when you contact us.
3.2 Information we collect automatically
Newsletter. The date, time and source of your sign-up, technical data such as IP address and device type, and whether you open our emails and which links you click.
Website. Technical data such as IP address, browser, device and pages visited, collected by our website host and analytics tool (see section 14).
3.3 Information from other sources
Prospective members. Business contact details (name, job title, employer, business email address and LinkedIn profile). We obtain these from public sources, such as the FCA Financial Services Register, company websites, LinkedIn and press coverage, or through introductions from members, contacts or introduction services.
People who register interest. We may check what you tell us against public sources, such as the FCA Financial Services Register, your employer’s website and LinkedIn.
Proposers and seconders. If a member or contact proposes or seconds someone for membership, we record the proposer’s and seconder’s names and, where relevant, their job title and institution. We may receive this from the proposer/ seconder or from the person they proposed/seconded.
4. How your personal data is used
Sending the newsletter and understanding how it is read.
Basis: consent. You can withdraw it at any time using the unsubscribe link in every email.
Considering registrations of interest and deciding whether to extend an invitation.
Basis: our legitimate interest in assessing eligibility for a selective club, and steps taken at your request before entering into a contract.
Recording who proposed a candidate, and confirming the proposal with them.
Basis: our legitimate interest in running an invitation-based club, where membership depends on personal recommendation.
Providing membership, organising dinners, invoicing and member communications.
Basis: performance of our contract with you. Where your employer contracts with us, the basis is our legitimate interest in administering that contract.
Sharing the attendee list for a dinner with that dinner’s attendees.
Basis: our legitimate interest in letting attendees know who will be in the room.
Catering for dietary and accessibility needs.
Basis: your explicit consent (see section 5).
Producing the annual benchmark.
Basis: our legitimate interest in producing research for members. Results are published only in aggregated, anonymised form, and no individual or institution can be identified.
Contacting prospective members about the club.
Basis: our legitimate interest in introducing a relevant professional service to senior executives. Every message identifies us and offers a simple way to opt out.
Running and securing this website.
Basis: our legitimate interest in operating a secure, working website, and your consent for any non-essential cookies.
Responding to enquiries.
Basis: our legitimate interest in replying to you.
Keeping financial records and meeting tax and legal obligations.
Basis: legal obligation.
Establishing, exercising or defending legal claims.
Basis: our legitimate interests.
Where we rely on legitimate interests, we have weighed our interests against your rights and reasonable expectations.
We do not make decisions about you based solely on automated processing. Every registration of interest is reviewed by a person.
5. Special category personal data
We do not knowingly collect sensitive (“special category”) data, such as information about health or religious beliefs. The only exception is dietary and accessibility information, which can reveal details about health or religious belief.
We ask for it only so the venue can cater for you.
We collect it only with your explicit consent, which you can withdraw at any time.
We share it only with the venue for the dinner you are attending.
We keep it only for the periods set out in section 10.
6. Legal bases for processing
6.1 Contract. We use your data where we need it to provide membership you have agreed to, or to take steps you have asked for before agreeing.
6.2 Legitimate interests. We use your data where it is necessary for our reasonable business interests, and those interests are not outweighed by your rights. Section 4 sets out where we rely on this basis.
6.3 Consent. We rely on your consent for the newsletter, non-essential cookies, photographs, and dietary and accessibility information. You can withdraw consent at any time. This does not affect anything we did before you withdrew.
6.4 Legal obligation. We use your data where the law requires us to keep or share it, for example financial records for tax purposes.
7. Dinners, photography and the Chatham House Rule
All dinners are held under the Chatham House Rule unless explicitly stated otherwise. What is said may be used, but we take every reasonable care that no one who attended is identified.
We do not record dinners. Any notes are written so that no remark is attributed to a person or institution.
Confidentiality is shared. Every member and guest is asked to respect it in the same way.
Before each dinner, we share a list of attendees (name, job title and institution) with that dinner’s attendees only.
We take photographs only with the consent of those pictured.
8. Sharing your personal data
We do not sell your personal data. We share it only with the following.
8.1 Service providers. These process data on our behalf under contracts that require them to protect it: our website host and form provider (Framer), our newsletter platform (beehiiv), our email and document provider, our accounting software and our contact management tool.
beehiiv also uses some data for its own purposes, such as keeping its service secure, preventing abuse and providing certain optional features. For those purposes, beehiiv acts as a controller under its own privacy policy: https://www.beehiiv.com/privacy
8.2 Dinner venues and attendees. Venues receive attendees’ names and any dietary or accessibility requirements. The other attendees of a dinner receive the attendee list described in section 7.
8.3 Professional advisers and authorities. We share data with our accountants, lawyers and insurers where necessary, and with authorities, regulators or courts where the law requires it.
8.4 A buyer or successor. If all or part of our business is sold, merged or reorganised, data may pass to the new owner. Any new owner would be bound by this policy for data collected under it, and we would tell you of the change.
9. International data transfers
Our newsletter is hosted and delivered by beehiiv Inc., based in the United States. When you subscribe, beehiiv collects and stores your email address and related data on our behalf, as our processor.
Data sent to the US is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our agreement with beehiiv. You can read it in beehiiv’s data processing agreement at beehiiv.com/dpa.
Our website host, Framer B.V., is based in the Netherlands and uses Amazon Web Services. Data may be processed outside the UK and EU. These transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our agreement with Framer.
10. How long we keep your data
Newsletter subscribers: until you unsubscribe. We then keep your email address on a suppression list, so that we do not contact you again.
Unsuccessful registrations of interest: 48 months from our decision, so that we can consider a future registration.
Proposer details: for as long as we keep the record of the person they proposed.
Membership records: for the duration of your membership and 5 years afterwards.
Financial records: six years from the end of the financial year they relate to, as UK tax law requires.
Dietary and accessibility information (members): for the duration of your membership, so you do not need to tell us before every dinner, unless you ask us to delete it sooner.
Dietary and accessibility information (guests): deleted within one month after the dinner.
Prospective members: up to 48 months from our last contact, or sooner if you ask us to stop.
Benchmark responses: individual responses are deleted 48 months after the results are published. The aggregated results contain no personal data and may be kept indefinitely.
Enquiries: up to 5 years.
Website technical data: for the period set by our website host.
11. Your rights
Under UK and EU data protection law, you have the following rights.
Right of access. You can ask for a copy of the personal data we hold about you.
Right to rectification. You can ask us to correct data that is inaccurate or incomplete.
Right to erasure. You can ask us to delete your data, in certain circumstances.
Right to restrict processing. You can ask us to limit how we use your data, in certain circumstances.
Right to data portability. You can ask to receive your data in a portable format, where we process it on the basis of consent or contract and by automated means.
Right to object. You can object to our use of your data where we rely on legitimate interests. You can object at any time to direct marketing, in which case we will stop.
Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew.
Rights relating to automated decisions. You have the right not to be subject to decisions made solely by automated means that significantly affect you. We do not make such decisions (see section 4).
Right to complain. You can complain to a data protection authority (see section 12).
To exercise any of these rights, write to info@aigrcnetwork.com. We may need to confirm your identity. We will respond within one month. For complex requests, this can be extended, in which case we will tell you why within the first month.
12. Right to lodge a complaint
If you have a concern, please contact us first at info@aigrcnetwork.com. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You also have the right to complain to a data protection authority:
In the UK: the Information Commissioner’s Office (or its successor, the Information Commission), at ico.org.uk or 0303 123 1113.
In the EU: the data protection authority in the country where you live or work, or where the issue arose. The European Data Protection Board lists them at edpb.europa.eu.
13. Security
We use appropriate technical and organisational measures to protect your data, including access controls. Only those who need applicant and member data can access it. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant regulator as the law requires.
14. Cookies and similar technologies
Our website uses only cookies that are strictly necessary for it to work. You can control cookies through your browser settings.
Our newsletter emails contain standard technology that shows whether an email was opened and which links were clicked. This helps us understand what our readers find useful. You can limit it by turning off images in your email program.
15. Children
Our services are for professionals. We do not knowingly collect data from anyone under 18.
16. Web scraping and unauthorised data collection
You must not use automated tools to scrape, harvest or collect personal data from our website or newsletter. Our website terms set out this rule in full.
17. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Where changes are significant, we will tell subscribers and members by email.
18. Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:
AI GRC Network Ltd
Company number: 17532334
Email: info@aigrcnetwork.com
124 City Road, London, EC1V 2NX
We aim to respond to all enquiries within 30 days. For complex or multiple requests, this period may be extended, in which case we will let you know.