This policy explains how ElioVP and Ready AI Go handle personal data on the public website and in the training platform.
1. Who is responsible?
ElioVP BV is the data controller for the public website, account or demo requests and direct product communications.
For employee accounts and training data, the customer organisation determines why and how that data is used. ElioVP processes it on that organisation’s behalf. Employees can contact their organisation or ElioVP with privacy questions.
Business enquiry data: company name, optional website, organisation size, region, contact name, work email, phone number, preferred language and whether you request an account or demo.
Account data: name, work email, language, role, organisation, account status and invitation or session information.
Training data: assignments, deadlines, course progress, formative responses, assessment answers, scores and completion timestamps.
Technical and security data: IP address, browser user agent, session identifiers and limited audit or delivery records.
Communications you send to us, such as support questions or replies about a business enquiry.
3. Why do we use it?
We use personal data only for defined purposes and a valid legal basis:
To review and answer account or demo requests, based on steps requested before a contract and our legitimate interest in handling business enquiries.
To create invited accounts, deliver training, record progress and send service messages under the customer agreement.
To authenticate users, prevent misuse and keep the platform secure, based on our legitimate interests and contractual obligations.
For employee training and reporting, based on the legal basis determined and communicated by the customer organisation.
To meet legal obligations and establish, exercise or defend legal claims where necessary.
4. Who receives the data?
Access is limited to people and providers who need it for the service:
Authorised administrators of the relevant customer organisation and authorised ElioVP staff.
Cloudflare, as infrastructure provider for hosting, the application database and transactional email delivery.
Public authorities or professional advisers only when disclosure is legally required or necessary to protect legal rights.
We do not sell personal data and do not use it for behavioural advertising.
5. AI and automated decisions
Course and assessment answers are never sent to a language model. The controlled prompt exercise uses fixed, fictional context and does not accept free-form company or personal data.
Assessment scores are calculated deterministically. There is no automated pass or fail decision and Ready AI Go does not make decisions that produce legal or similarly significant effects.
6. How long do we keep data?
We keep personal data only for as long as needed for the purpose, the customer agreement and applicable legal requirements. In particular:
Business enquiries are kept while we handle the request and for a limited period afterwards when needed for follow-up or legal records.
Account and training records are kept during the customer relationship. A company can deactivate a learner while retaining required training history or permanently delete the learner and their personal training record.
Magic-link tokens expire after 30 minutes. Sessions expire after seven days and are revoked when a user or company is deactivated.
An unfinished assessment draft is kept only in the learner’s browser and is removed after successful submission or when site data is cleared.
7. Security and international transfers
Ready AI Go uses tenant-separated access, role-based permissions, hashed single-use sign-in tokens, limited logging and session revocation. Core application data is hosted in the EU.
If a provider processes limited operational data outside the European Economic Area, ElioVP uses the safeguards required by applicable data-protection law.
8. Your rights
Depending on the situation, you may request access, correction, erasure, restriction or portability of your personal data, object to processing, or withdraw consent where processing relies on consent.
For customer-managed training data, contact your organisation first. You can also contact ElioVP using the email address above. We may ask for information needed to verify your identity.
