/Aristotl
Language
Demo

Privacy Policy

Version v1.03Updated

Introduction

Aristotl BV, established at Entrepotkaai 2/802, 2000 Antwerp, with enterprise number 1018.326.784 (“Aristotl”), processes personal data in different roles:

  • As controller: when we process personal data for our own purposes, such as managing our website, marketing, sales, invoicing, account administration and the security of our own systems.
  • As processor: when our business customers (“Customer”) process personal data via the Aristotl platform (for example data that the Customer or its end users enter into or upload to the Services). In that case, the Customer determines the purposes and means of the processing and is the controller. Aristotl processes such personal data solely on behalf of and in accordance with the Customer’s instructions, as set out in our Data Processing Agreement (DPA).

Why do we collect and process personal data?

  • For our own purposes (as controller): e.g. managing customer relationships, invoicing, security, communication, product improvement and (where permitted) marketing.
  • On behalf of our business customers (as processor): the Customer uses the Services to process personal data for its own purposes. Aristotl processes that data only to provide, maintain and secure the Services and to provide support, in accordance with the Customer’s instructions and the DPA.

What data do we collect?

Aristotl collects and processes various types of personal data, depending on how you use our Services. The data we collect may include the following information:

  • Personal Data:
    • Name
    • Email address
    • Job title
    • Company or organization where you work
  • Technical Data:
    • IP address
    • Browser information
    • Device information (such as device type, operating system)
    • Location data
    • Data about your use of the website and Services (such as pages visited, click behavior, duration of the visit)
  • Cookies and similar technologies: We use cookies and similar technologies to collect information about your use of our website, your preferences and your navigation behavior. This helps us improve the website and offer you a personalized experience. More information about the use of cookies can be found in our Cookie Policy.

Sharing of data

As controller (own purposes)

We may share personal data with service providers who act as processors for us (e.g. hosting providers, email/communication services, analytics), only to the extent necessary for the purposes set out in this privacy policy and under appropriate contractual safeguards. When you book a demo on our website, we pass your work email and the chosen time to HubSpot (HubSpot Ireland Ltd.), which schedules the meeting and sends the calendar invite; your name is derived from your email address.

As processor (on behalf of our business customers)

When Aristotl processes personal data on behalf of a Customer, Aristotl may engage sub-processors (e.g. hosting and infrastructure). The terms, safeguards and the notification/objection mechanism regarding sub-processors are governed by the DPA and the (current) sub-processor list referred to in the DPA.

AI assistant connector (Claude, ChatGPT)

Members of a Customer organization can connect an AI assistant they use, such as Claude (Anthropic) or ChatGPT (OpenAI), to the Services. This is allowed in every organization unless an administrator turns it off, but nothing is shared until a member sets up a connection themselves. A connection is always started by the member: they sign in to Aristotl, choose one organization and approve what the assistant may do (read; make changes; generate content). A Customer administrator can turn the connector off for the whole organization, or disconnect any member's connection, at any time. Members can disconnect their own connections under Profile > Connected apps. Disconnecting, or turning the connector off, takes effect immediately, and at the latest within one minute.

While a connection is active, Aristotl sends the assistant only what is needed to answer the member's request, and only data that member can already access in the chosen organization, with the member's role in that organization: for example search results and excerpts from the knowledge base, course and checklist content, calendar items, member and team details for members who manage them and, for members allowed to view analytics, aggregated training analytics. Aristotl does not receive the member's conversation with the assistant, only the requests the assistant sends to Aristotl.

For Customer data, Aristotl remains a processor acting on the Customer's instructions. The AI assistant provider is not a sub-processor of Aristotl: it receives the data because the member chose to use that assistant, and processes it under the member's or the Customer's own agreement with that provider and that provider's privacy policy. Aristotl does not control how the provider stores or uses the data.

Aristotl keeps:

  • a record of each connection (member, assistant, organization, permissions, when it was approved and when it was last used). The record is kept while the connection exists, and is deleted when the connection is disconnected, when the member leaves or is removed from the organization, when the member's account is deleted and when the organization is deleted. A connection that has not been used for 30 days, or that was approved more than 180 days ago, stops working until the member approves it again;
  • an audit record of each connection being approved or disconnected and of each change made through the assistant (member, assistant, action, item, outcome), for the duration of the Agreement;
  • a usage record of AI generation started through the assistant (feature, model, volume, cost), for billing, for the duration of the Agreement.

These records do not contain the member's prompts or conversation, nor the content of the requests the assistant sends. When the assistant asks Aristotl to generate content, the input it provides (such as a course title or brief) is processed like any generation started in Aristotl, including by our AI monitoring tools. Aristotl's technical logs for these requests contain technical identifiers and the name of the action performed, not the content of the requests, and are kept for 30 days. Content the assistant creates or changes in Aristotl is Customer data like any other.

Security of data

Aristotl implements appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, unauthorized modification and destruction. We use, among other things, encryption and secure servers to store your data.

How long do we retain your data?

We retain your personal data only as long as necessary for the purposes for which it was collected or to comply with legal obligations. If we no longer need data for the original purposes, we will securely delete it.

Retention periods vary depending on the type of data and the purpose for which it was collected:

  • Customer data is generally retained as long as you have a customer relationship with Aristotl and thereafter for the statutory retention periods.
  • Cookies are retained according to the duration indicated in our cookie statement.

When Aristotl processes personal data as processor on behalf of a Customer, retention periods are in principle determined by the Customer (controller) and the arrangements in the DPA and Agreement. Aristotl does not retain such data longer than necessary to provide the Services, support, security and in accordance with the Customer’s instructions, subject to legal obligations.

Your rights regarding personal data

Under the GDPR you have certain rights regarding your personal data. These rights include:

  • Right of access: You have the right to know which personal data we process about you.
  • Right to rectification: If your personal data is inaccurate or incomplete, you may request that it be corrected.
  • Right to erasure: You may request that your personal data be deleted, for example when we no longer need the data for the purposes for which it was collected.
  • Right to object: You may object to the processing of your personal data, especially if it is used for direct marketing.
  • Right to restriction of processing: You may request that the processing of your personal data be restricted, for example if you believe the data is inaccurate or if you object to the processing.
  • Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format so that you can transfer it to another service provider.
  • Right to withdraw consent: If we ask for your consent to process your data, you may withdraw that consent at any time.

If Aristotl is the controller (e.g. website, sales, invoicing): you can exercise your rights by contacting us at ben@aristotl.com. If Aristotl is the processor and your personal data is processed via the Services by a business Customer: please direct your request in the first instance to that Customer (the controller). Aristotl will, where appropriate, support the Customer in handling the request.

What if you are not satisfied with our response?

If you are not satisfied with the way we process your personal data, you may lodge a complaint with the data protection authority in your country. In Belgium, they are located at Drukpersstraat 35, 1000 Brussels.

Changes to this privacy policy

Aristotl reserves the right to amend this privacy policy from time to time. We will inform users of material changes via our website or by email.

Contact information

If you have questions about this privacy policy or how we process your personal data, you can contact us at:

Ben Bauwens
Co-Founder & CEO
ben@aristotl.com
Entrepotkaai 2/802, 2000 Antwerp