Privacy & Cookie Policy

This policy explains how we collect, use, and protect personal information on getaicertified.org, the official enrollment site for the GAISB AI Essentials certification, and how we meet the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who we are

getaicertified.org is operated by the Global AI Standards Body (GAISB), the vendor-neutral standards body that governs the GAISB certification programs. Enrollment and checkout are delivered through Prompt Atlas, the official community of GAISB. Examinations are delivered at exams.gaisb.org, and issued credentials are recorded in the Public Verification Registry at registry.gaisb.org.

2. What we collect

• Prospective candidates, name and email when you request information, download a resource, join a webinar or summit, or subscribe to updates; plus your interactions with our emails (opens, clicks) where you have consented.
• Enrollees and certificants, name, email, country, enrollment records, program progress, exam registrations and results, certification status, and credential ID. Issued credentials are published to the Public Verification Registry (holder name, credential, ID, status, dates), publication is intrinsic to the credential and is what makes it verifiable.
• Payment data, checkout is processed by Prompt Atlas and our payment processors; we do not store full card numbers.
• Technical data, IP address, browser, pages viewed, and cookie identifiers, per your consent choices.

3. Why we use it, and our lawful bases (GDPR)

• Providing information you request, and email updates you subscribe to, consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link in every email or privacy@gaisb.org.
• Enrollment, program delivery, examination, and certification, performance of a contract (Art. 6(1)(b)).
• Publishing credential records to the Public Verification Registry, legitimate interests (Art. 6(1)(f)) in public verifiability of professional credentials, and the certification agreement each certificant accepts.
• Invoicing, tax, accounting, legal obligation (Art. 6(1)(c)).
• Analytics and marketing cookies, consent (Art. 6(1)(a)).

4. Cookies

We ask for consent before setting anything non-essential. Change your choice any time via Cookie Settings.

• Strictly necessary, site function, security, and recording your consent choice. Always active.
• Functional, preferences such as language or region. Opt-in.
• Analytics, aggregated usage statistics to improve the site. Opt-in.
• Marketing, campaign measurement, advertising pixels, and retargeting. Opt-in; disabled by a "Do Not Sell or Share" opt-out or a Global Privacy Control signal.

This site loads typefaces from Google Fonts, which involves transmitting your IP address to Google when fonts load.

5. Email marketing

We send program updates and offers only with your consent. Every email includes a working unsubscribe link, honored promptly. Unsubscribing from marketing does not affect transactional emails about an active enrollment or certification.

6. Sharing, and what we don't do

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose personal information only to: service providers under contract (hosting, enrollment and payment via Prompt Atlas and payment processors, exam delivery, email delivery); and authorities where required by law. Public registry data is, by design, public.

7. International transfers

We operate globally. Where personal data is transferred out of the EEA, UK, or Canada, we use appropriate safeguards, including Standard Contractual Clauses and equivalent processor commitments.

8. Retention

Lead and marketing data: until you withdraw consent or after a period of sustained inactivity. Enrollment, exam, and certification records: for the life of the credential plus applicable limitation periods (these records substantiate the credential itself). Financial records: per tax law. Consent records: for as long as your choice is in force.

9. Your rights, GDPR (EU & UK)

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests; where processing rests on consent you may withdraw it at any time. Note that erasure of certification records ends the verifiability of your credential. Write to privacy@gaisb.org; we respond within one month. You may lodge a complaint with your supervisory authority.

10. Your rights, CCPA/CPRA (California)

You have the right to know, delete, and correct your personal information; to opt out of sale or sharing (we do not sell, you may still record a formal opt-out via Do Not Sell or Share My Personal Information); to limit use of sensitive personal information (we use none beyond what the services require); and to non-discrimination for exercising any right. We honor the Global Privacy Control signal automatically. Submit requests to privacy@gaisb.org with "California Privacy Request" in the subject; authorized agents accepted with verification; response within 45 days (extendable once with notice).

11. Your rights, PIPEDA (Canada)

We follow PIPEDA's ten fair information principles, accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Request access or correction, or withdraw consent (subject to legal and contractual limits), at privacy@gaisb.org. If unsatisfied, you may contact the Office of the Privacy Commissioner of Canada.

12. Security

Administrative, technical, and organizational safeguards appropriate to sensitivity: encryption in transit, access controls, least-privilege administration, and processor due diligence.

13. Children

Our services are directed to professionals and adult learners. We do not knowingly collect personal information from anyone under 16; if you believe a minor has provided data, contact privacy@gaisb.org and we will delete it.

14. Changes & contact

Material changes will be posted here with a new effective date and, where required, renewed consent. Questions, requests, or complaints: privacy@gaisb.org.