Privacy policy

1. Who is responsible for your data

AML Benchmark is a trading name of Net Werth Ltd, a company registered in England and Wales with company number 12718042. Our registered office is International House, 64 Nile Street, London, N1 7SR. We are the data controller for the personal data described here, except where a firm has invited you to take an assessment — in that case the firm is a controller for its own purposes and we process on its behalf as well as our own.

Write to hello@amlbenchmark.com about anything in this policy.

2. What we collect

If you sit a case without an account. The decisions you made, your marks, which documents you opened and in what order, how long you took, and the free text you wrote. This is not linked to a name or an email address.

If you create an account. Your email address, a display name, and a password stored only as a hash — or, if you sign in with Google, the email address and name Google gives us. Your runs are then linked to that account.

If a firm invited you. The name and email address your firm supplied in order to invite you, and the link between your run and that invitation — except on an anonymous cohort, where that link is never stored.

If you subscribe to the weekly briefing. Your email address and, if you give it, the kind of role you do.

If you use the contact form. Your name, email address, any firm name you give and your message. This becomes an email and is not stored in our systems.

Always. Ordinary technical data such as your IP address and browser, used to keep the service running and secure.

3. Free text and automated scoring

Some answers are written rather than chosen. Where that is the case, the text you wrote is sent to a third-party artificial intelligence provider to be scored against our published rubric, and the score comes back to us. Your name, email address and account are never sent with it — the provider receives the text and nothing that identifies you.

Do not put real customer data, real case details or anything confidential into a free-text answer. The cases are fictional and your answers should be too.

Scoring is partly automated, but no decision with legal or similarly significant effect is made about you by automated means. Your marks are a diagnostic, and our terms say plainly that they must not be used as the sole basis for any employment decision.

4. What your firm can see

Where a firm runs an assessment across a team, it chooses one of three disclosure modes for each cohort, and the mode is shown to you before you begin:

• Named — your firm sees your individual mark.
• Confidential — your firm sees that you completed, so it can chase the rest, but not your mark.
• Anonymous — your firm sees neither, and we never store a link between the run and you at all. That link cannot be recovered afterwards, by us or by anyone else.

If you ask us to email a result to yourself, the address is used to send the message and then discarded. It is not written to the run and not attached to your firm’s record of it. The one exception is if you tick the box offering the weekly briefing, which starts unticked: your address is then kept on the briefing list, and you can remove it at any time using the link in every email. Even then it is held only as a subscriber, with no link to your run, your mark or your cohort.

5. Why we process it, and on what basis

• To provide the service — running assessments, scoring them, keeping your results and issuing certificates. Performance of a contract with you, or our legitimate interest in providing a service you asked for where there is no contract.
• To give a firm its results — legitimate interests of that firm in assessing the capability of its team, within the disclosure mode it chose.
• To send the weekly briefing — your consent, which you can withdraw at any time using the link in every email.
• To improve the assessment and publish aggregate findings — legitimate interests. Aggregate figures never name a firm or a person.
• To keep the service secure and take payment — legitimate interests, and legal obligation for accounting records.

6. Who else is involved

We use a small number of providers, each processing only what they need: our hosting and database platform; an email delivery service for transactional and briefing email; Google, if you choose to sign in with it; and the artificial intelligence provider described in clause 3. We do not sell personal data and we do not use it for advertising.

Some of these providers are outside the UK. Where data is transferred, it is protected by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.

7. How long we keep it

• Account and results — while your account is open, and for 30 days after you close it, after which they are deleted.
• Runs with no account — kept as anonymous assessment records. They contain no identifier, so they cannot be connected to you.
• Cohort records — while the firm’s licence lasts, and then deleted at the firm’s request or within 12 months of it ending.
• Briefing subscription — until you unsubscribe. We keep a record that you unsubscribed so we do not email you again.
• Accounting records — six years, as UK law requires.

8. Cookies and local storage

We set a cookie to keep you signed in. We store, in your own browser, a note of which cases you have completed so that the free case is offered once, and a short-lived token that lets you attach a result to an account you create afterwards.

We do not use advertising cookies, tracking pixels or third-party analytics, which is why you are not asked to accept anything when you arrive.

9. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Where we rely on consent, you can withdraw it at any time. Write to hello@amlbenchmark.com and we will respond within one month.

If your firm invited you and your question is about what your firm sees or why it asked you to take part, ask your firm — it decides those things, not us. We will help where we can.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first.

10. Children

The service is for professionals and is not intended for anyone under 18. We do not knowingly collect data about children.

11. Changes

We will update this policy when what we do changes, and the date at the top will change with it. Our terms of use sit alongside this policy.