Wishory Ltd ('Wishory', 'we', 'us', 'our') is a specialist AI Governance and Compliance consultancy registered in England and Wales (Company No. 15989978). Our registered office is at 128 City Road, London EC1V 2NX.

We are registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZB922510 (renewed to 24 June 2027).

We provide AI governance advisory services, digital compliance products, and training to businesses across the UK, EU, United Arab Emirates, and Saudi Arabia.

For all data protection enquiries, contact us at: info@wishory.com

We collect and process the following categories of personal data:

We do not collect any special category data (health, racial or ethnic origin, political opinions, religious beliefs, biometric data, or criminal convictions) in the ordinary course of our business.

We collect personal data through the following channels:

• Website contact form at wishory.com/contact
• Direct email to info@wishory.com
• LinkedIn messages and connection requests
• Discovery call booking via Calendly
• Purchase of digital products via our WooCommerce shop — payment processed by Stripe
• Newsletter sign-up via Mailchimp subscription form
• During consulting engagements — information provided by the client in intake questionnaires, calls, and documents
• Automatically — via Google Analytics 4 (anonymised) when you visit wishory.com

We only process your personal data where we have a lawful basis to do so under UK GDPR.

We do not keep your personal data longer than is necessary for the purpose for which it was collected. Our full retention periods are set out in Section 11. A summary:

• Enquiries that did not lead to an engagement: 12 months from last contact
• Client engagement records: 6 years from completion (Limitation Act 1980)
• Financial and invoice records: 6 years from end of tax year (HMRC requirement)
• Newsletter subscribers: until you unsubscribe
• Website analytics data (anonymised): 26 months (Google Analytics default)
• Calendly booking data: 12 months from the date of the appointment

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

We share your data only with third-party service providers ('sub-processors') who process it on our behalf and under our instruction, for the purpose of delivering our services. These are listed in full in Section 10.

We may also disclose your data where required to do so by law, court order, or regulatory authority — for example, to the ICO in the event of a data protection complaint.

Some of our sub-processors are based outside the UK and EEA, including in the United States. Where we transfer your personal data to a country that does not provide an equivalent level of data protection, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO or European Commission
• An adequacy decision by the UK Secretary of State or European Commission
• The vendor's own binding corporate rules or equivalent certification

The specific transfer mechanism for each sub-processor is set out in Section 10.

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

To exercise any of these rights, email info@wishory.com with the subject line 'Data Rights Request'. We will respond within one calendar month at no charge.

9.1 — Our Use of AI Tools

Wishory uses artificial intelligence tools — including large language models — to assist in the preparation of advisory reports, gap analyses, governance frameworks, digital products, website content, and other materials. The primary AI tool we use is Claude, developed by Anthropic.

We also use AI-powered features within Canva Pro (design) and Perplexity AI Pro (regulatory research). A full list is set out in Section 10.

9.2 — Human Oversight

Every AI-assisted output produced by Wishory — including all client deliverables — is reviewed, verified, and approved by our senior team before delivery. We do not deliver raw AI-generated content to clients without human review. Wishory remains solely responsible for all advisory outputs, regardless of whether AI tools were used in their preparation.

9.3 — Article 50 Disclosure Statement

In accordance with EU AI Act Article 50(1), all Wishory client deliverables produced with AI assistance will carry the following disclosure from 2 August 2026:

9.4 — Your Data in AI Tools

• We do not enter your name, contact details, or other personally identifiable information into AI tools as part of routine service delivery
• Where engagement-specific context is used, we anonymise or generalise the information — using sector descriptors rather than company names where the specific name is not required
• We do not enter commercially sensitive or confidential client information into any AI tool without your prior written consent
• We do not use free-tier AI tools for client work — free tiers typically train on user inputs
• All AI tool vendors used for service delivery operate under appropriate Data Processing Agreements or Standard Contractual Clauses

9.5 — Your Rights in Relation to AI Tools

• You can request that a specific deliverable be produced without the use of AI tools — contact us at info@wishory.com
• You can request a copy of our AI Inventory Register and Internal AI Acceptable Use Policy — available on request
• You can exercise any of the data rights set out in Section 8

We will notify you of any material change to our sub-processors within 30 days. This register was last updated: 27 June 2026.

Where you exercise your Right to Erasure and we have no overriding legal obligation to retain your data, we will delete it within 30 days and confirm deletion in writing.

Our website wishory.com uses cookies — small text files placed on your device when you visit.

• Strictly necessary cookies — required for the website to function (e.g. shopping cart, security). These cannot be disabled.
• Analytics cookies — Google Analytics 4, used to understand how visitors use our site. These are anonymised and can be declined via our cookie consent banner.
• Functional cookies — used to remember your preferences (e.g. cookie consent choices). These can be managed via our cookie settings.

When you first visit wishory.com, a cookie consent banner (managed by CookieYes) will ask for your consent to non-essential cookies. You can change your cookie preferences at any time via the cookie settings link in our website footer.

For a full list of specific cookies, see our Cookie Policy.

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a child, please contact us immediately at info@wishory.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will update the version number and effective date at the top of this policy, publish the updated policy at wishory.com/privacy-policy, and where the change materially affects how we use your data, notify you by email.

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK supervisory authority for data protection.

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would appreciate the opportunity to address any concern before you contact the ICO. Please contact us first at info@wishory.com and we will respond within 5 business days.