Privacy Policy

This platform (the "Platform") is operated by The Investment Association, a company limited by guarantee. Registered Office: 10 Norton Folgate, London, E1 6DB. Registered in England and Wales. Company Number: 4343737.

For the purposes of the Data Protection Act 2018 and the UK General Data Protection Regulation (the "UK GDPR") (together the "Data Protection Law"), the IA acts as the data controller.

This privacy policy (the "Privacy Policy") explains how and why we process your personal data when you use the Platform. We will only process personal data where we have a lawful basis to do so under applicable Data Protection Law.

Information We May Collect

We may collect, use, store and process the following categories of personal data when you use the Platform:

• Identity and access data, including the name, email address and account identifier of members who sign in with their theia.org account and the organisation indicated by their email domain, and the name and email address of authorised IA staff and consultants who access the administrative area
• Technical data, including IP address, browser type and version, time zone setting, operating system, device type and other technical information generated when you use the Platform
• Usage data, including the dates you use the Platform, pages visited, features used, navigation paths, time spent on pages and interactions with dashboards, searches and AI features
• AI interaction data, including prompts or questions submitted to AI features, relevant report context retrieved to answer those questions, AI-generated responses and associated performance information. AI interaction data may contain personal data where, for example, a user includes information about an identifiable individual in a prompt
• Presentation content, including text, AI-generated material and other content added to presentations using Present mode. Presentation content may contain personal data depending on the information included by the user.
• Preference and device storage data, including theme, navigation and other preferences stored through cookies, local storage or session storage, to the extent that such information constitutes personal data

Certain Technical Data, Usage Data and Performance Data are collected automatically when you use the Platform. Page-view usage data (page visited, referrer, device/browser information, and time spent on the page) is recorded against a randomly generated session identifier stored in your browser for the duration of your visit. This identifier is not linked to your name, email address.

Although the session identifier does not directly identify you by name, it may constitute pseudonymous information while it remains capable of distinguishing one session from another.

When you sign in with your theia.org account, we keep a record of your account (name, email address and organisation), when you first signed in, how often you have signed in and the date you last used the Platform. We also record the days you use the Platform and the features you use, to understand how the Platform is used, and report this only in aggregate.

Information you provide

When you use the Platform, you may provide information through AI chat queries, search inputs, and interaction with dashboard features. Access to the Platform requires a theia.org account with Platform access; we do not ask you to create a separate account. Any text you enter into AI chat or search fields may be transmitted to our backend services, and in some cases to third-party AI providers (see section 4 below), for processing.

You should not submit personal data, special category personal data or confidential information through the AI assistant (the "AI Assistant") or other Platform features unless it is necessary for your use of the Platform and you are authorised to provide that information.

Authorised IA staff and consultants sign in to the administrative area of the Platform using their IA Microsoft Entra ID (Azure AD) account. When they do, we process their name and email address, as supplied by IA's own identity provider, solely to authenticate them and control access to administrative features.

AI interaction data

When you use the AI Assistant (including the ISA Barometer AI features), your queries are processed using Retrieval Augmented Generation ("RAG") technology.

Your queries are sent to our backend server, which retrieves relevant context from IMS or ISA Barometer report data and forwards the combined prompt to a third-party AI model provider (see section 4.1 below).

We may analyse AI queries to understand, for example, the reports, topics, data points and industry themes that users are interested in. Where practicable, we use aggregated and anonymised information for this analysis and reporting, so that the resulting information does not identify individual users. Where information has not been fully anonymized, we seek to minimize the personal data used and, where appropriate, use pseudonymization or other de-identification measures.

We log queries and responses (the "Logs") for rate limiting abuse prevention, troubleshooting and service improvement purposes.

These logs may include your IP address or other directly identifying information.

The Platform's AI-assisted Presentation Builder (part of Present mode) additionally uses a third-party web search API to retrieve supplementary web context when you ask it to. See section 4.1 below for details.

Present mode content

Present mode lets you build presentations combining Platform data, AI-generated content, and text you write yourself. Presentations you create are stored on our servers and are accessible to anyone who has the presentation's share link; they are not private by default.

Please do not include personal, confidential, or commercially sensitive information in a presentation you intend to share. A separate edit key, generated when you create a presentation, is stored in your browser's local storage so you can find and edit your own presentations again; anyone with this key (or the share link, for viewing) can access the presentation.

Cookies and Local Storage

This Platform uses a small number of cookies and browser local/session storage. For the full list of items, we store and why, see our Cookie Policy at intelligence.theia.org/cookie-policy. In summary, we use cookies and local/session storage to:

• Keep members signed in after they sign in with their theia.org account
• Keep authorised IA staff and consultants signed in to the administrative area
• Store your theme (light/dark mode) and navigation preferences
• Power first-party, anonymous analytics about how pages are used (we do not use third-party analytics or advertising cookies); you can switch this off at any time via the toggle on our Cookie Policy page
• Remember presentations you have built in Present mode so you can find and edit them again

How We Collect and Use Your Information

We collect personal data in the following ways:

• Directly from you, when you enter AI queries, search terms, presentation content or other information into the Platform
• Automatically, when you interact with the Platform, including technical, usage and performance information generated through your use of the Platform and through cookies or similar technologies
• From theia.org, when you sign in with your theia.org account, and from IA's own sign-in system, in relation to authorised IA staff and consultants who access administrative functions

We will only process your personal data where we have a lawful basis to do so. We use information collected via the Platform for the following purposes:

• Provide and maintain the Platform's features, including AI-powered analysis and interactive dashboards
• Process AI queries against IMS and ISA Barometer report data and return relevant responses
• Operate the AI-assisted Presentation Builder, including retrieving supplementary web search context via a third-party provider where you request it
• Store and serve presentations you create in Present mode, accessible via a shareable link
• Authenticate members and authorised IA staff and consultants, and control access to the Platform and its administrative functionality
• Monitor and prevent abuse of AI features through rate limiting
• Troubleshoot technical issues and monitor Platform performance
• Improve the Platform's performance, reliability, and user experience
• Understand how the Platform is used, including the topics, reports and industry themes users are interested in
• Ensure the security and integrity of our systems
• Generate aggregated and, where appropriate, anonymised usage analytics and use pseudonymisation or other de-identification measures where information cannot be fully anonymised
• Generate anonymised, aggregated usage analytics
• Comply with legal obligations.

Lawful bases

Depending on the processing activity, we may rely on one or more of the following lawful bases:

• Legitimate interests: where processing is necessary for our legitimate interests in providing, operating, maintaining, securing and improving the Platform, understanding its use, preventing misuse and supporting IA's research and member services, provided those interests are not overridden by your rights and interests
• Performance of a contract: where processing is necessary to provide Platform functionality or other services that you have requested, where applicable.
• Legal obligation: where processing is necessary for us to comply with a legal or regulatory obligation
• Consent: where we specifically ask for your active agreement to a particular processing activity

Where we rely on legitimate interests, we consider whether the processing is necessary for the relevant purpose and balance those interests against the rights and interests of affected individuals.

Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Third-Party Data Processing

We use third-party service providers to help operate and support the Platform. These may include cloud-hosting providers, identity and authentication providers, AI infrastructure providers, AI model providers, embedding providers and web-search providers. We require service providers acting on our behalf to process personal data only for agreed purposes and in accordance with applicable contractual, security and data protection requirements.

AI model provider

AI queries are routed through OpenRouter, a third-party AI infrastructure provider based in the United States, which forwards your query text, together with relevant context retrieved from IMS or ISA Barometer reports, to the underlying language model for inference (currently a GLM model developed by Zhipu AI) and to an OpenAI embedding model used for retrieval matching. For the AI-assisted Presentation Builder, we also use Tavily, a web search API provider based in the United States, to retrieve supplementary web search context; Tavily results are not used to generate the Platform's quantitative data or charts.

Each provider's data handling is governed by their own privacy policy and our agreements with them regarding our use of their services.

We do not send your name, email address, IP address, or other directly identifying information to these providers. We only send the text of your query or presentation content and relevant report context.

We may change the service providers used by the Platform from time to time. Where a change materially affects how personal data is processed, we will update this Privacy Policy accordingly.

Hosting and infrastructure

The Platform's core infrastructure, including the database that stores dashboard, report, and analytics data, is hosted on Microsoft Azure in the Western Europe (Netherlands) region, within the European Economic Area. Artificial intelligence processing is handled separately by the third-party providers described in section 4.1 above, which involves international transfers as set out in section 5.3 below.

International data transfers

Because OpenRouter, Tavily, and the AI model providers as set out in section 5.1 below are based outside the United Kingdom and the European Economic Area, using the AI Assistant, ISA Barometer AI features, or Presentation AI Builder involves transferring your query or presentation text (and related report context) to servers located outside the UK/EEA, including in the United States. Where we transfer personal data internationally, we rely on an appropriate transfer mechanism recognised under UK Data Protection Law. This may include UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, where applicable. We also assess relevant risks and supplementary safeguards where required.

You may contact us if you would like further information about the safeguards used for a particular international transfer.

Data Retention

The Logs, together with performance metrics such as response time) are retained for as long as necessary to support abuse prevention, quality assurance and service improvement.

Aggregated, anonymised analytics may be retained indefinitely. Presentations you create in Present mode are retained until you delete them (using your edit key) or we remove them in accordance with our Terms of Use at intelligence.theia.org/terms-of-use. We do not retain personal data longer than necessary for the purposes outlined in this policy.

In determining appropriate retention periods, we consider the amount, nature and sensitivity of the information, the purposes for which it is processed, the risks associated with unauthorised use or disclosure, whether the relevant purposes can be achieved by other means and any applicable legal or regulatory requirements.

Data Security

We implement appropriate technical and organizational measures to protect your data, including:

1. Rate limiting on AI endpoints to prevent abuse
2. HTTPS encryption for all data in transit
3. Access controls on backend systems and databases
4. Regular security reviews of the Platform codebase
5. Role-based access controls for administrative functions
6. Periodic review of administrative access rights

The transmission of information via the internet is not completely secure. While we use reasonable endeavors to protect your data, we cannot guarantee the security of data transmitted to the Platform.

Your Rights

Under the UK GDPR, you have the right to:

1. Access: request a copy of any personal data we hold about you
2. Rectification: request correction of inaccurate personal data
3. Erasure: request deletion of your personal data where there is no compelling reason for continued processing
4. Restriction: request that we restrict processing of your personal data in certain circumstances
5. Data portability: request your data in a structured, commonly used, machine-readable format
6. Objection: object to processing based on legitimate interests
7. Withdraw consent at any time where we are relying on consent to process your personal data (see section 3 above for details of when we rely on your consent as the legal basis for using your personal data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to access the Platform. We will advise you if this is the case at the time you withdraw your consent.

To exercise any of these rights, contact us at the details provided in section 11 below.

Links to Other Websites

The Platform may contain links to theia.org and other external websites.

If you follow a third-party link or access a third-party service, that third party may process information about you in accordance with its own privacy policy. We do not control and are not responsible for the privacy practices of third-party websites or services, and we encourage you to review their privacy information.

Children

This Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Platform after changes constitutes acceptance.

Where appropriate, we may also bring material changes to your attention through the Platform.

Contact

If you have any questions, comments or requests regarding this Privacy Policy please contact us:

1. By email: members@theia.org
2. By post: The Investment Association, 10 Norton Folgate, London, E1 6DB
3. By telephone: +44 20 7831 0898

Supervisory Authority

If you have a concern or complaint about the way we have handled your personal data, please contact us first using the details in section 11 above so that we have an opportunity to investigate and respond to your concerns.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.