How we handle your details.
This is a draft. Have the Data Privacy Officer and Legal review and approve it before this site is shared outside the team or any real client tenant is onboarded.
Who is responsible
{{product.name}} is owned by {{product.owner}} at {{branding.parent}}. Questions about this notice go to {{product.contactEmail}}. The legal entity acting as controller or processor for a given client is set out in that client's contract and confirmed with the Data Privacy Officer.
What we collect and why
This microsite. It does not collect details through forms. Requests for a session open your email client. The employee area keeps a short-lived unlock flag in your browser session. Usage analytics are not switched on. This will be updated if analytics or a backend are enabled.
The {{product.name}} application. It handles engagement and billing metadata so that we can measure and govern a client's AI spend: tenant and engagement details, cost and usage records from the client's AI providers (cost, token counts, model names), workload and outcome definitions and outcome counts, checkpoint and agent session records, and user account details (name, work email, role and sign-in log). It does not store the content of prompts or completions in this version. The purpose is to deliver the engagement. The legal basis is set per client with the Data Privacy Officer, and a privacy assessment is completed and its reference recorded against each client tenant before that tenant is onboarded.
Who receives your details
Capgemini staff with a role in the engagement, and the client's own users for their own tenant. Tenants are separated, so one client cannot see another's data. The application is hosted on Microsoft Azure. Hosting is in the North Europe Azure region. Any other processors are listed in the client contract and confirmed with the Data Privacy Officer.
How long we keep them
Real-time usage telemetry is kept for 90 days. Reconciled billing records are kept permanently in the current design. Proposed for confirmation with the Data Privacy Officer: user accounts and the sign-in log are kept while the user has access and for a limited period afterwards; audit records are kept per contract, with a legal-hold option; and client data can be deleted at the end of an engagement on request.
Your rights
Under data protection law you may ask what personal data we hold about you, and ask for it to be corrected, deleted or restricted, or object to its use, where the law gives you that right. Write to {{product.contactEmail}} and we will pass the request to the Data Privacy Officer. If you are not satisfied with the answer you may complain to your data protection authority. The procedure is a draft and is subject to Data Privacy Officer approval.