1.Introduction and Scope

This AI Use Statement describes how Brightfield Digital Ltd (the “Company”) uses artificial intelligence systems within its digital marketing operations. It is published in accordance with our transparency commitments under Article 50 of the EU AI Act and our UK GDPR Article 13–14 obligations.

The Company is a 15-person UK digital marketing agency headquartered in London, serving SME and mid-market clients across the UK and EU. Approximately 15% of our revenue is attributable to EU-established clients, bringing in-scope processing within the territorial reach of the EU AI Act.

2.Purpose of This Document

We publish this statement so that clients, prospective clients, regulators, and our own staff understand which AI systems we operate, what those systems do, and what controls we have placed around them. It is a living document and is reviewed at least annually.

3.AI Systems in Use

The following table sets out the AI systems used internally by the Company, their purpose, and the regulatory classification we have applied to each system following our internal risk assessment.

4.Systems Not in Use

For the avoidance of doubt, the Company does not currently deploy any AI system falling within the “high-risk” categories of Annex III of the EU AI Act. We do not use AI for biometric identification, employment decision-making, access to essential services, or any other Annex III use case.

5.Human Oversight

All AI-generated output that is delivered to clients or used in customer-facing communications is reviewed by a named human employee before release. The Founder retains overall accountability for AI use across the business.

6.Controls and Safeguards

6.1 Data minimisation

Staff are instructed not to enter client personal data, financial information, or contractually-restricted material into general-purpose AI tools. Where processing of client-confidential information is required, only enterprise tiers with documented zero-retention commitments are used.

6.2 Training and acceptable use

All staff have completed the Company's Internal AI Use Policy training (see Document 05). New starters complete this training within their first week.

6.3 Review schedule

This statement is reviewed annually, and on a triggered basis whenever a new AI system is adopted or an existing system materially changes its function.

1.About This Addendum

This Privacy Notice Addendum supplements the Company's existing Privacy Notice. It describes the AI-specific personal data processing activities carried out by Brightfield Digital Ltd and the lawful bases relied upon for each.

2.Controller Details

3.Scope

This addendum applies to personal data we process about prospective clients, existing clients, end-user audiences of our clients' campaigns, and our own staff, in connection with our use of artificial intelligence tools.

4.AI-Specific Processing Activities

5.Your Rights

You retain all rights set out in the UK GDPR, including the right to access, rectify, erase, and restrict processing of your personal data, and to object to processing carried out on the basis of our legitimate interests.

6.International Transfers

Several AI services we rely on are operated from the United States. We rely on the UK Extension to the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses where required, and we maintain a transfer impact assessment for each onward transfer.

7.Complaints

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time. Our internal complaints procedure is set out in Document 08 of this pack.

1.Purpose

This Register records identified risks arising from the Company's use of artificial intelligence systems, the mitigations in place for each, and the residual risk position after those mitigations are applied. It is a living document and is reviewed at least quarterly.

2.Methodology

Each risk is scored on two dimensions — likelihood of occurrence and severity of impact — each on a three-point scale (Low / Medium / High). The combined score determines the inherent risk band shown on the matrix overleaf.

3.Risk Matrix

4.Risk Register

5.Review Schedule

This Register is reviewed quarterly by the Founder. Material changes — including the introduction of a new AI system, a vendor change, or a near-miss incident — trigger an interim review.

6.Escalation

Any risk rated “High” or “Critical” on the matrix is escalated immediately to the Founder and reviewed against the Company's continuity plan. Where the residual risk after mitigation remains High, the underlying AI system is either replaced or withdrawn pending further controls.

1.Processing Under Assessment

This DPIA-Lite assesses the Company's use of generative AI tools to draft marketing copy and summarise client meetings. It is focused on the data protection impacts on natural persons whose personal data is incidentally processed during these activities.

2.Necessity and Proportionality

AI-assisted drafting and summarisation deliver material productivity gains. The processing is limited to the minimum personal data required to complete the relevant task and uses enterprise-tier tools with documented zero-retention or short-retention commitments from the vendor.

3.Risks to Individuals

4.Conclusion

With the mitigations recorded above, the residual risk to the rights and freedoms of natural persons is assessed as Low. No prior consultation with the ICO is required.

5.Sign-off

1.Purpose

This Policy sets out how staff at Brightfield Digital Ltd are permitted to use artificial intelligence tools in the course of their work. It is binding on all employees, contractors, and freelancers.

2.Scope

This Policy covers all generative AI tools — including ChatGPT, Notion AI, Microsoft Copilot, and any tool subsequently approved by the Founder — and applies wherever those tools touch client data, internal business data, or public-facing deliverables.

3.Roles

The Founder is accountable for AI governance. Each team lead is responsible for ensuring their team complies with this Policy in day-to-day work.

4.Acceptable Use

5.Enforcement

Breaches of this Policy will be handled under the Company's normal disciplinary procedure. Significant breaches that result in a data protection incident are also assessed against the Company's personal data breach procedure.

6.Training and Acknowledgement

Every member of staff must acknowledge this Policy at induction, and again whenever it is materially updated. The Founder maintains the record of acknowledgements.

1.How to Use This Document

The snippets in this pack are ready-to-paste disclosures designed to satisfy Article 50 of the EU AI Act and UK GDPR transparency expectations. Each snippet is tagged with the context where it is intended to appear. Replace the bracketed placeholders before use.

2.Snippet Index

3.Snippets — Public-Facing

Parts of this website and the services we deliver are produced with the assistance of generative AI tools. We review all output before publication. For details, see our AI Use Statement at [link].

You're chatting with an automated assistant powered by AI. A human team member will join the conversation if your enquiry needs one. Read more about how we use AI: [link].

Thanks for your message. This reply was generated by an AI assistant on our team's behalf. A named colleague will be in touch within one working day. — Brightfield Digital

4.Snippets — Client-Facing Deliverables

Sections of this proposal have been drafted with the support of generative AI tools used under enterprise terms with no model training on our content. All recommendations have been reviewed by a named Brightfield Digital strategist before sending.

Brightfield Digital uses AI tools to assist with drafting, research and analysis. We do not enter client confidential information into consumer AI products and do not permit the use of client data for vendor model training. Our full AI Use Statement is available on request.

1.About This Register

This Register lists every third-party AI tool used by Brightfield Digital Ltd, the data categories that touch each tool, and the lawful basis on which we transfer that data. It supports our UK GDPR Article 30 record of processing activities.

2.Maintenance

The Register is reviewed quarterly by the Founder. New vendors are added at the point of sign-off; decommissioned vendors are retained for two years before removal so that historical processing remains traceable.

3.Vendor Register

4.Decommissioning

When a vendor relationship ends, the Founder ensures that any data the vendor retains is deleted in accordance with the contract, and the Register entry is marked “Decommissioned” with the effective date.

5.Onboarding New Vendors

Before a new AI vendor is adopted, the Founder reviews the vendor's data processing terms, transfer mechanisms, and security posture against this Company's standards. Adoption is only authorised in writing.

1.Purpose

This Procedure sets out how Brightfield Digital Ltd receives, acknowledges, investigates and resolves complaints about its processing of personal data, including processing carried out using AI tools. It satisfies the Company's obligation under Section 103 of the UK Data (Use and Access) Act 2025.

2.How to Complain

Complaints may be made by email to privacy@brightfielddigital.example, by post to the registered address, or in person at any pre-arranged meeting with a member of staff.

3.Process

4.Records

A record of every complaint received, the action taken and the outcome is retained for a minimum of six years. The Founder reviews the complaints log quarterly for trends and improvement opportunities.

5.Confidentiality and Non-Retaliation

Complaints are handled in confidence so far as is consistent with carrying out an effective investigation. The Company prohibits any form of retaliation against an individual for raising a good-faith complaint.

6.Escalation Contacts

1.Executive Summary

This Memo summarises Brightfield Digital Ltd's compliance position with respect to UK GDPR, the EU AI Act, and the UK Data (Use and Access) Act 2025. It is intended to accompany procurement responses and supplier questionnaires from enterprise customers.

2.Compliance Snapshot

3.Documentation Index

The following documents are available on request from any enterprise customer and form the complete ReadyPack compliance documentation set for the Company.

4.Points of Contact

5.Review Cycle

This Memo is refreshed at least annually, and on a triggered basis whenever any of the underlying documents in the documentation index materially change.