Privacy notice for testing of the AI assistant

Purpose of this document

The Department for Business and Trade (DBT) is committed to protecting the privacy and security of your information. This privacy notice describes how we collect and use personal information about you in accordance with UK Data Protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are required under data protection legislation to notify you of the information contained in this privacy notice. It is important that you read this notice so that you are aware of how and why we are using your information.

What data we process

Personal data we process includes:

• your name
• your email address
• the contents of the messages you enter into the artificial intelligence (AI) assistant such as questions or responses.

We do not require your personal data in order for you to test the AI assistant, and you are asked not to include any personal or commercially sensitive information in your messages. Data minimisation will be applied to remove identifiable data if any is obtained.

We will send a voluntary feedback survey to everyone who participates in testing the AI assistant. The survey has its own privacy notice setting out how data is processed for the survey, and a separate request to consent to this before proceeding with the survey.

Why we need your data

The information you provide will be processed by DBT and selected third parties in order to:

• return relevant answers to your questions about exporting, using AI
• gather feedback to evaluate and/or improve the AI assistant
• monitor use of the site to identify security threats

Our legal basis for processing your data

We rely on the ‘public task’ lawful basis, where we need to process data to perform a task carried out in the public interest or for one of our official functions (Article 6 (1) (e) of the UK GDPR), relying on the Trade Act 1974, to:

• provide businesses with guidance on exporting
• test and evaluate a new service, including to invite you to the test
• ensure the new service will enable the efficient and effective delivery of DBT's functions

DBT’s role includes helping UK businesses grow through exports. By enabling users to ask questions about exporting, DBT ensures that businesses are informed and able to act on relevant trade prospects. This supports the UK’s economic growth and trade strategy, which is a core part of DBT’s public mission.

How we share your information

We will, in some circumstances and where the law allows, share your data with other government departments, agencies, public bodies, and third-party service providers which may include, but are not limited to:

• Amazon Web Services
• Government Digital Service

You will be notified if your information is shared with other third parties not included in this list.

Aggregated analysis of responses may also be shared with the Information Commissioner’s Office, the Government Internal Audit Agency and the National Audit Office.

We will not:

• sell or rent your data to third parties
• share your data with third parties for their marketing purposes

We will also share your data if we are required to do so by law or regulation, for example, by court order or to prevent fraud or other crime.

How long we keep your data

The questions or response you enter into the AI assistant will be stored as chat transcripts, which we will retain for 90 days. We do not require your personal data in order for you to test the AI assistant, and you are asked not to include any personal or commercially sensitive information in your messages. Data minimisation will be applied to remove identifiable data within 30 days, if any is obtained.

How we protect your data and keep it secure

We are committed to doing all that we can to keep your data secure. We have set up systems and processes to prevent unauthorised access or disclosure of your data. For example, we protect your data using varying levels of encryption. All personal data is stored in the European Economic Area.

We also ensure that any third parties keep all personal data they process on our behalf secure.

Your rights

You have the right to request:

• information about how your personal data is processed
• a copy of any personal data we hold about you
• that any inaccuracies in your personal data are corrected immediately

You can also:

• raise an objection about how your personal data is processed
• request that your personal data is erased if there is no longer a justification for it
• ask that the processing of your personal data is restricted in certain circumstances

Contact us

If you have any of these requests or have questions about this privacy notice and how we handle your personal information, you can contact:

Data Protection Officer
Department for Business and Trade
Old Admiralty Building
Whitehall
London SW1A 2DY
Email: data.protection@businessandtrade.gov.uk

Information Commissioner’s Office

Contact the Information Commissioner for independent advice about data protection, privacy, and data-sharing issues.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire  SK9 5AF
Telephone: 0303 123 1113
Textphone: 01625 545860
Email: casework@ico.org.uk

Changes to this privacy notice

We reserve the right to update this privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates.

Confidentiality

Information provided whilst using this service, including personal information, may be disclosed in accordance with access to information regimes, primarily the Freedom of Information Act 2000 (FOIA).

If you want the information you provide to be treated confidentially, please be aware that, in accordance with the FOIA, public authorities are required to comply with a statutory code of practice that addresses obligations of confidence, among other things.