AI Innovation Accelerator Programme Privacy Notice

1. About this notice

This notice explains how Commsarc Limited, trading as Agent Build Club (“ABC”, “we”, “us”, “our”), handles personal information in the AI Innovation Accelerator programme. It adds the detail for this programme to our Privacy Policy at /privacy-notices/privacy-policy, and the two are read together.

This version replaces Version 1.0 of 3 October 2026. Version 1.0 described sharing business details with the University of Surrey. That is no longer how the programme works. We now introduce a business to the University only when the business asks us to in writing, as section 6 explains.

2. The programme

The AI Innovation Accelerator is delivered by Agent Build Club with the University of Surrey and is supported by Innovate UK under project 10197107. It runs from 1 August 2026 to 31 January 2029.

Businesses register their interest in working with the University on applied AI challenges, in one of three cohorts. The second and third cohorts start in autumn 2027, one with Electrical and Electronic Engineering and one with AI in Engineering. The programme also includes an open online lecture series, events, and access to our community spaces.

Students who take part in projects apply through the University, under the University’s own arrangements and privacy notice. We are not involved in that process.

3. Two organisations, two controllers

Agent Build Club and the University of Surrey are separate, independent controllers.

• We control the information collected through AI Innovation Accelerator branded forms, pages and spaces, and everything else this notice describes as ours.
• The University controls the information it collects directly from you, under its own privacy notice.
• We are not joint controllers. Neither organisation processes personal information as the other’s processor or subcontractor.

Information moves from us to the University only in the way described in section 6. From that point the University holds it as its own controller.

Only information collected through AI Innovation Accelerator branded forms, pages and spaces belongs to this programme. Anything else we collect from you sits outside it and is covered by our Privacy Policy alone.

4. Who this notice is for

• Businesses and other organisations that register interest in the programme, and the people who register on their behalf.
• People who register for the programme’s lecture series or events.
• People who join our community spaces through the programme.

If you are a student, nothing about you passes from the University to us or from us to the University.

5. What we collect at each collection point

We describe each collection point by what it is and what it carries, rather than by the tool that runs it.

The lawful basis for this programme’s processing is legitimate interests under Article 6(1)(f), as set out in section 5 of our Privacy Policy. Marketing, photography, filming and recording rely on separate, optional consents.

6. How introductions work

We do not send the University a list of registrations, periodically or at all. Instead:

1. Your business registers its interest with us, on our forms and under our notice. We are the only controller of that registration.
2. We ask you in writing: “Would you like us to forward your details and introduce you to the University of Surrey programme manager?”
3. Only if you say yes, and we have recorded that answer, do we send one email introducing your business, with you copied in.
4. The University then collects anything else it needs directly from you, as its own controller, under its own privacy notice.
5. Later, we ask you whether the introduction led to a match. If it did not, we can help you approach other institutions.

We follow three rules every time. We ask in writing and record your answer, with the date and the wording we used. We introduce one business at a time and never in batches. We copy you in, so you see exactly what was sent.

If you say no, that has no effect on anything else we offer you.

An introduction gives the University no exclusivity, no right of first refusal and no restriction on our working with your business elsewhere.

7. What reaches the University

For a business that has asked to be introduced, and only for that business, the University receives one email containing:

• your name and role;
• your work contact details;
• your organisation’s name; and
• a structured summary of your registration.

Everything else the University needs, it collects directly from you.

8. What never reaches the University

• Lists of registrations, of any kind or at any time.
• Any information about a business that has not asked to be introduced.
• The raw transcript or recording of an optional interview.
• Lecture series or event attendee lists.
• Whether you joined our community spaces, what you posted or how often you visited.
• Your marketing preferences.
• Any information about any student.

9. Our community spaces

Our community spaces are an open, professional-facing environment for knowledge exchange. Students are welcome on the same terms as everyone else.

• We are the only controller of the community spaces and everything in them.
• Joining is voluntary. It is never a condition of taking part in the programme or in anything else we offer.
• We do not report on anyone. We do not tell the University, an employer or anyone else whether you joined, what you posted or how often you visited. Any figures we publish about the spaces are aggregate and identify nobody.
• The spaces are not a learning environment. They are not used to assess anyone and form no part of any academic record. The University runs its own virtual learning environment, and our community spaces are not part of it.
• The spaces run on a third party platform. The platform’s own terms and privacy notice apply to you as a member alongside ours. The provider is listed on our data processors page at /privacy-notices/processors.

10. Events and the two registers

Where an event forms part of the programme, each organisation keeps its own register, under its own notice. We never exchange attendee lists with the University.

We do not use a sign-in sheet that both organisations use, we do not use a registration form that both organisations can see, and we do not compare our register with the University’s to see who attended both.

11. Reporting on the programme

We report on the lecture series and the wider programme to the University and to Innovate UK as numbers only: totals, attendance, attendance rates, and counts of registrations by organisation email domain. These figures identify nobody.

• We suppress or band any figure below five.
• We never publish a breakdown by email domain that would identify a sole trader, because a domain with a count of one can identify a person. We report by sector and size band instead.

12. The optional interview

Our business registration form offers an optional interview, run by an AI feature of our forms platform.

• It is always optional. Declining has no effect on how your registration is treated.
• Text is the default. Audio is offered. Video is not enabled. If we ever enable video, we will update this notice and our Privacy Policy first.
• A person reviews the result. The interview never decides on its own whether a registration goes forward, so Article 22 of the UK GDPR is not engaged.
• If you ask to be introduced, the University receives the structured summary of your registration, never the raw transcript or recording.
• We keep transcripts and recordings until the end of the programme or for 12 months, whichever is sooner.
• We do not use what you say to train AI models, and we require the same of our providers.

13. How long we keep information for this programme

14. Your rights and who to ask

You have the rights set out in section 14 of our Privacy Policy. Each organisation answers for its own processing, so ask the one that holds the information.

If we have introduced you to the University and you ask us to correct or erase your information, we will tell the University, as the law requires. The University decides for itself what to do with what it holds.

If you are unhappy with how either organisation has handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

15. Version history