Version 2.0 · August 2026 · applies to aiacademy.claglobal.com
The AI Academy is operated by CLA Global Limited (“CLA Global”, “we”) as an enablement platform for CLA Global member firms. CLA Global is the data controller for the platform; your member firm remains the controller of its own employment relationship with you. Contact: hugo.pinto@claglobal.com.
Account data (name, work email, job title, team, firm, role) to operate your access — legal basis: legitimate interest in providing a professional enablement service to member firms. Activity data (courses started and completed, quiz attempts and scores, clinic registrations and attendance, use-case nominations, policy drafts you author, badges and certificates, notifications) to deliver the Academy's features, including CPD/EU AI Act Article 4 literacy evidence — legitimate interest and, for certification records, compliance support. Coach conversations, to give the feature continuity between visits. Records of when you signed in, kept as a count of active days so your firm can see whether the Academy is being used. Your firm lead’s confirmation that you completed each phase of Core Training, and their reason if they confirmed a phase you had not attended. If you send the coach something that looks like personal data after being warned, we record that it happened, which kinds of data were detected, and when — but never the data itself. Certificate PDFs uploaded by the programme team, stored privately and accessible only to you and administrators.
We do not sell your data and we do not advertise. We instruct everyone never to enter client data into the platform, and the coach warns you before sending a message that appears to contain personal data.
Being precise about the AI coach: the platform does not add your name, email address or firm to what it sends the AI provider — only the conversation itself, plus which tier and screen you are on. But whatever you type is sent as part of that conversation and stored with it. If you enter personal data, that data is transmitted and retained. This is why the coach warns you first, declines to work with personal data, and why we ask you to use placeholders in [SQUARE BRACKETS] instead.
Your Academy records are held in the EU — specifically Frankfurt, Germany, chosen deliberately because it is in an EU member state rather than a merely adequate jurisdiction.
Our processors are: Supabase (database, authentication and file storage, hosted in Frankfurt), Netlify (hosting and delivery, which processes request logs and IP addresses in the United States), Anthropic (the AI coach, which receives conversation text in the United States), GitHub (source code and project documents), and Microsoft (email delivery, through CLA Global’s own Microsoft 365 tenant). Data processing agreements with standard contractual clauses are in place or being put in place with each; transfers outside the EU rely on those clauses.
Your data is kept while your firm participates in the Academy and you hold an account. Certification and CPD records may be kept longer, as evidence that training was delivered. Deleted accounts are removed together with all linked records; a minimal record of the deletion request itself — the email address and the dates — is kept to evidence that we acted on it.
Specific retention periods for each category are being finalised with CLA Global and will be published in the next version of this notice. If you want to know how long a particular record is kept before then, ask using the contact below and we will tell you.
You can export everything we hold about you and request deletion of your account, both self-serve from Profile & activity → Privacy & data. You additionally have the GDPR rights of access, rectification, restriction, objection and complaint to your supervisory authority. Requests: hugo.pinto@claglobal.com.
This notice describes the platform as it is actually built, and is under review by CLA Global counsel ahead of general availability. Where it says an agreement is “being put in place”, that is literal rather than aspirational. Version 2.0 corrected four statements in version 1.0 that had ceased to be true as the platform changed.