Privacy Notice

We are CommonAI CIC, known as “CommonAI”. We are a company registered with company number 16148520 and a registered office at C/O Mishcon De Reya LLP, 4 Station Square, Cambridge, United Kingdom, CB1 2GE. If you have any questions about this notice, including any requests to exercise your legal rights, please contact us at privacy@commonai.org.

This notice was last updated in September 2025.

How do you use my data?

• To send you marketing information. Where you have previously expressed an interest in our organisation (and you have not opted-out of receiving marketing) we may use your name and email address to send you updates including information about potential conferences, meet-ups and annual reports, because it is in our legitimate interests to promote our organisation.

  You can withdraw or unsubscribe from marketing at any time by contacting us at privacy@commonai.org or, where relevant, by following the unsubscribe link in any marketing communication you receive from us.

• When you contact us either by phone, email, via a form on our website, or via social media, we will usually collect your name, social media handle and contact details, because it is in our legitimate interest to make sure we can properly respond to your query.

  When you join our calls as a Member, we may use an AI summary tool to record our meetings and provide catch-up summaries. We do this because maintaining a record of Member meetings and improving efficiency is in our legitimate interest.

• When you use our website, we will collect information about how you use our website using necessary cookies.

  We may use your personal data contained within this information to enable the functionality and use of our website.

• When you attend one of our events or a third-party event we also attend (including virtual events via video conferencing providers), we will usually collect your name, address, email address and phone number. We may also be taking photos and videos at our events which we use to promote CommonAI. We collect this personal data because it’s in our legitimate interests to promote our business and to know who is attending our events.

  If you do not wish for a photo or video of you to be included in any marketing materials, please contact us at privacy@commonai.org.

• If our organisation undergoes a merger or restructuring. We process your personal data for this purpose because we have a legitimate interest in ensuring the efficiency and continuity of our not-for-profit activities for the benefit of the community. If you object to our use of your personal data in this way, the successor organisation may not be able to continue providing support or services to you.

• If your organisation becomes a Member, we may collect your representative’s name, job title email address, phone number, nationality, address, company name and address (if applicable). We collect this in order to take steps to enter into a contract with you and facilitate your organisation’s membership.

  We may also collect your GitHub handles when you become a Member. We do this as it is in our legitimate interest to know who has contributed to the open-source repository.

  We may also collect your name and contact information to ensure that our internal code of conduct is being followed and, if needed, to investigate any potential breaches of that code. We do this as it is in our legitimate interest to make sure that our Members treat CommonAI and each other with respect.

• If you are appointed onto the CommonAI Board, we will collect your name, date of birth, nationality, business occupation and address. We will collect this in order to onboard you on the CommonAI Board, take steps to enter into a director contract with you and update Companies House on your appointment.

• If you are appointed onto a CommonAI Board Committee, we will collect your name, and address. We will collect this for the performance of a contract in order to onboard you on the CommonAI Board Committee.

Who do you share my data with?

• Business partners, suppliers and subcontractors for the performance of the contract we enter into with them or you.

• Our associated company CommonAI Compute Ltd, to help provide the services and give training on using compute efficiently.

• Other Members and the public: Depending on your account settings and subject to any embargo agreed with you, we may share your personal data with other Members through annual reports and general marketing. Please be aware that any personal data you share in a collaborative context may become publicly accessible (e.g. author of a file) subject to our agreed embargos.

• Third Party AI model providers for the performance of the contract we enter into with you to deliver the products and services you order.

• Promotional events and marketing organisations, we do not sell data for marketing purposes, but may share your data with an event organiser including where we run workshops with co-presenters. We will always tell you before (usually on the event registration form) and you will be given the chance to opt-out before we do this.

• Regulators / Authorities / Enforcement Agencies if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our membership agreement and other agreements; or to protect our, our members’, and others’ rights. This includes exchanging your personal data with other companies and organisations for the purposes of fraud protection.

• Prospective investors, partners or buyers of our organisation under our legitimate interest to ensure our activities can be continued following a merger or restructuring.

Where do you store my data?

We store your data on multiple third party servers which are based both in the UK and outside of the UK. When working with third parties we may need to transfer your personal data outside of the UK and/or EU. This includes when you have contracted with us to use our CommonAI Compute Ltd services.

Whenever we transfer your personal data outside of the UK and the EU, we ensure it receives additional protection as required by law. To keep this notice as short and easy to understand as possible, we haven’t set out the specific circumstances when each of these protection measures are used. You can contact us at privacy@commonai.org for more information about this.

How long do you keep my data for?

We will only retain your personal data for as long as we need it unless we are required to keep it for longer to comply with our legal, accounting or regulatory requirements.

In some circumstances we may carefully anonymise your personal data so that it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you. We use this anonymised information to improve the way we work and for reporting purposes.

What are my rights under data protection law?

You have various other rights under applicable data protection laws, including the right to:

• access your personal data (also known as a “subject access request”);
• correct incomplete or inaccurate data we hold about you;
• ask us to erase the personal data we hold about you;
• ask us to restrict our handling of your personal data;
• ask us to transfer your personal data to a third party;
• object to how we are using your personal data; and
• withdraw your consent to us handling your personal data.

You also have the right to lodge a complaint with us or the Information Commissioner’s Office, the supervisory authority for data protection issues in England and Wales. If you are based in the EU you can find your relevant supervisory authority here.

Please keep in mind that privacy law is complicated, and these rights will not always be available to you all of the time.