1. Information We Collect

1.1 Information You Provide

• Account & enrollment: Name, email, company, job title, phone number
• AI Risk Assessment: All answers, overall and pillar scores, compliance gaps, department selections, risk classifications, timestamp
• Consultation requests: Name, email, phone, company information, topics of inquiry
• Event registration: Name, email, company, job title, accessibility or dietary needs where applicable
• Payment: Billing name, address, and transaction details (processed by third-party payment processors; TROCOLA INC. does not store card numbers)
• Communications: Content of emails, support requests, and feedback submitted to TROCOLA INC.

1.2 Automatically Collected Data

• Usage data: pages viewed, features used, time spent, navigation paths
• Device and browser information, IP address (used for general geo-location at city/state level only)
• Session data via cookies (see Cookie Policy)
• Assessment activity: start/completion times, question progress

2. How We Use Your Information

Purpose	Data Used	Legal Basis (GDPR)
Providing and delivering services	Account, enrollment, assessment data	Contract performance
Scheduling consultations and events	Name, email, phone, company	Contract performance
Sending communications you requested	Email, preferences	Consent (withdrawable)
Anonymized industry research & reports	De-identified assessment data	Legitimate interests
Improving our services and assessment methodology	Usage data, assessment responses	Legitimate interests
Security, fraud prevention, legal compliance	Account, usage, communication data	Legal obligation / Legitimate interests

2.6 AI and Large Language Model (LLM) Safeguards

The following safeguards apply to AI use across TROCOLA INC. operations:

• Assessment scoring is not AI-generated. Your AI Risk Assessment score is calculated by TROCOLA INC.'s proprietary scoring algorithm using fixed weighted formulas. No third-party AI model sees your responses.
• Certification decisions involve human review. No organizational certification is issued solely on algorithmic output. A qualified TROCOLA INC. auditor reviews evidence and makes the final determination.
• AI tools used internally are restricted to non-client data. Where TROCOLA INC. uses approved LLMs for internal drafting or research, those sessions use only public information or fully anonymized data.
• Client evidence is never used to train AI models. TROCOLA INC. does not sell, license, or provide identifiable client evidence to any AI vendor for training, fine-tuning, or evaluation purposes.
• Practitioners are bound by the same rule. CSAP-certified practitioners and Divisional Partners are prohibited under the Code of Conduct and AUP from inputting identifiable client data into any third-party AI system without an executed data processing agreement covering the specific AI vendor.

2.7 Talent Identification Disclosure

TROCOLA INC.'s Certified Practitioner methodology includes a structured assessment of AI fluency and competency across the organization. During certification engagements, CSAP-certified practitioners may identify employees within your organization who demonstrate strong AI literacy, governance instincts, or ability to serve in AI governance roles. This identification is delivered to you, the client, as part of the engagement report.

The following terms apply to talent identification:

• Talent identification observations are shared with client leadership only. They are not shared publicly, with other clients, or with outside recruiters.
• TROCOLA INC. does not use these observations to recruit employees away from certified clients. Practitioners are bound by the Code of Conduct's 12-month non-solicit provision.
• Employees identified through this process are not added to any external talent pool, recruiter database, or marketing list without the employee's express written consent.
• Clients receive these observations as a governance staffing recommendation. What you do with the information inside your organization is your decision.

If you prefer your engagement to exclude talent identification observations, notify your practitioner or email privacy@trocolainc.com before the engagement begins.

2.8 Fluency Responses and Individual Sentiment

The fluency assessment includes a section that captures individual sentiment: how a person feels about AI. That section is internal to TROCOLA INC. only. It is never disclosed, in any form, about any individual. What an organization receives from the fluency assessment is outcomes only, in aggregate, and an aggregate is produced only when it covers at least five people, so that a small group can never be used to identify a person.

3. How We Share Information

We never sell your personal information. We share data only as follows:

• Service providers: Hosting, email delivery, scheduling (Calendly), payment processing, analytics: all bound by data processing agreements
• Event co-hosts and sponsors: Registration data (name, email, company, title) shared with event partners only when disclosed at registration with opt-out available
• Divisional Partners: If a partner referred you to TROCOLA INC., we may share limited engagement status information with that partner
• Legal requirements: When required by law, court order, or government request
• Business transfer: In a merger or acquisition, with advance notice to you
• With your consent: For any other purpose with explicit permission

3.4 CSAP Practitioner and Divisional Partner Data Access

When a CSAP-certified practitioner or Divisional Partner delivers a consulting, audit, or certification engagement to your organization, they have access to the following data during the active engagement window:

• AI system inventory and IDEN registration details you provide
• Assessment responses and generated compliance gap findings
• Evidence uploads submitted through the IDEN platform
• Policies, procedures, and governance documentation shared for review
• Interview notes, workshop records, and observations documented during the engagement
• Organization contact information required to coordinate the engagement

Practitioner access is governed by the following controls:

• Need-to-know basis. Practitioners access only the data relevant to their engagement scope. Cross-client access is prohibited.
• Binding confidentiality. All practitioners are bound by the Consultant and Partner Code of Conduct (Policy 10) and execute confidentiality obligations as part of their credential or partner agreement.
• Engagement-scoped retention. Practitioner access ends at engagement conclusion. Practitioners may retain their own engagement records for professional liability and tax purposes per their retention schedule, but they are not authorized to use your data outside the engagement.
• No data resale. Practitioners are prohibited from selling, licensing, or disclosing your data to third parties. Violations result in credential revocation.
• No third-party AI input. Practitioners are prohibited from inputting identifiable client data into any third-party AI system without a DPA covering that system.

You may request a list of practitioners who have accessed your engagement data by emailing privacy@trocolainc.com.

3.5 "Do Not Sell or Share" Disclosure (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• "Sale" means disclosing personal information to a third party for monetary or other valuable consideration. TROCOLA INC. does not do this.
• "Sharing" means disclosing personal information to a third party for cross-context behavioral advertising. TROCOLA INC. does not do this.
• TROCOLA INC. has not sold or shared personal information in the 12 months preceding this policy's effective date and has no intention of doing so going forward.

To exercise your right to opt out of any future data sale or sharing (should TROCOLA INC.'s practices change), visit the "Do Not Sell or Share My Personal Information" link in the site footer or email privacy@trocolainc.com. Your request will be honored immediately and recorded.

3.6 Third-Party Data Flow Summary

The following table summarizes who receives what data and under what controls:

Recipient Category	Data Received	Purpose	Governing Control
Hosting and infrastructure providers	All platform data (encrypted)	Application hosting, backups	DPA
Email delivery platforms	Name, email, communication content	Transactional and (if opted-in) marketing email	DPA
Scheduling (Calendly)	Name, email, meeting details	Consultation scheduling	Calendly Privacy Policy
Payment processor	Billing name, address, card data (processor holds card)	Payment processing	PCI-DSS compliant
Learning Management System	Name, email, course progress	Course delivery	DPA
Analytics (anonymized)	Usage patterns (no PII)	Site improvement	DPA, no behavioral ads
Blockchain audit trail (Starchive)	Cryptographic hashes only (no plaintext)	Immutable certification records	DPA, hash-only architecture
CSAP practitioners / Divisional Partners	Engagement-scoped client data	Service delivery	Code of Conduct, Partner Agreement
Event co-hosts and sponsors	Name, email, company, title (if opted-in)	Event coordination	Disclosed at registration with opt-out
Legal and regulatory authorities	Data responsive to lawful request	Legal obligation	Court order or statute

4. Data Retention

Data Type	Retention Period
Assessment data	Account active + 3 years
Account information	Until deletion + 30 days
Communication records	7 years (business records requirement)
Consent records	Until opt-out + 2 years
Anonymized research data	Indefinitely (cannot be linked back to you)
Legal/compliance records	7 to 10 years
Payment/billing records	7 years (tax and financial compliance)

5. Your Privacy Rights (Including California Residents)

All users, regardless of location, have the following rights as an TROCOLA INC. policy commitment:

• Access: Request a copy of all personal data we hold about you
• Correction: Update inaccurate or incomplete information
• Deletion: Request erasure (see Data Deletion Policy for process and exceptions)
• Portability: Receive your data in a structured, machine-readable format (CSV or JSON)
• Restriction: Request limits on how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw consent: At any time, for consent-based processing
• Non-retaliation: TROCOLA INC. will not discriminate against you or deny services for exercising a privacy right

5.1 California Residents (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information TROCOLA INC. has collected, the sources, the purpose, and the categories of third parties with whom it is shared
• Right to Delete: Request deletion of personal information TROCOLA INC. has collected, subject to legal retention exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: TROCOLA INC. does not currently sell or share personal information; if this changes, you may opt out at any time
• Right to Limit Use of Sensitive Personal Information: Request that TROCOLA INC. limit its use of any sensitive personal information to what is necessary to provide services
• Right to Non-Retaliation: TROCOLA INC. will not deny services, charge different prices, or provide a different level or quality of service because you exercised a CCPA right
• Right to Data Portability: Receive your personal information in a portable, readily usable format

Lookback Period: TROCOLA INC. provides information about data collection and sharing for the 12 months preceding your request.

Authorized Agent: You may designate an authorized agent to make a request on your behalf. TROCOLA INC. will verify the agent's authorization through a signed written permission from you and may additionally verify your identity directly. Email privacy@trocolainc.com to begin an authorized agent request.

Verification: TROCOLA INC. will verify your identity before fulfilling a request. See the Data Deletion Policy (Section 2.3) for specific California verification standards.

Response Time: TROCOLA INC. responds to CCPA requests within 45 calendar days. If more time is required, we will notify you of the extension (up to an additional 45 days) and the reason.

5.2 EU/EEA Residents (GDPR)

Residents of the European Union and European Economic Area have the rights listed above plus the right to lodge a complaint with their local data protection authority.

5.3 How to Exercise Your Rights

To exercise any privacy right, email privacy@trocolainc.com with subject line "Privacy Rights Request: [Request Type]." Include your full name, the email address associated with your account, and the specific right you want to exercise. We respond within 30 days for general requests and 45 days for CCPA requests.

6. Security

TROCOLA INC. implements: TLS/SSL encryption in transit, encryption at rest for sensitive data, role-based access controls, multi-factor authentication for administrative access, and documented incident response procedures. In the event of a breach affecting your personal information, you will be notified within 72 hours of discovery as required by applicable law.

No system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.