SP Optima AI Maturity Benchmark
How SP Optima collects, uses, and protects the information you submit through the AI Maturity Benchmark. This notice covers data handling only; the contractual terms of using the diagnostic are in the separate SP Optima Terms of Use. By submitting, you confirm you have read both and consent to the collection and processing described below.
SP Optima Pty Ltd (ABN 39 697 333 850) operates the AI Maturity Benchmark, a self-assessment tool that produces an organisation-level AI maturity read across six dimensions. We are based in Victoria, Australia.
For privacy queries: enquiries@spoptima.com
The AI Maturity Benchmark, its maturity framework, the level and band criteria, the readiness gates and the dimension definitions are the intellectual property of SP Optima Pty Ltd. All rights reserved.
You answer the diagnostic about your organisation, from your own vantage point. We do not ask for your name.
Required to submit
Automatically captured
org_code) carried in the link you arrive through, when present. This is described under Engagement code below.utm_source, utm_medium, utm_campaign). These are values we put into our own links, for example a link or QR code shared at an event, to measure which channels bring people to the diagnostic. We do not capture the full referrer URL, browser headers, or tracking data from third-party sites.We do not capture time-to-complete for this diagnostic. If we add it later, we will disclose it here first.
Computed automatically from your responses
When you submit, the system computes and stores several derived values alongside your raw responses. These are deterministic outputs of your answers; no external data is added. They include:
Aggregate cohort statistics
SP Optima periodically captures de-identified, point-in-time aggregates about the respondent population: the cohort size, the median overall and per-dimension maturity, the median overall and per-factor applicability, and the distribution of bands, positions, evidence-confidence levels and track choices. These snapshots contain no personal data, no individual responses, and no identifiers. They are a view of the cohort as a whole, used to track how AI maturity and applicability are evolving across the mid-market over time, and they inform SP Optima research outputs, industry insights, and board reporting.
Median comparison shown on your dashboard
Your dashboard shows a median marker alongside your own scores, so you can see where you sit relative to other organisations that have completed the benchmark. Two things follow from this, and we want to be direct about both.
Dashboard interactions
The dashboard does not currently offer share, save, or print actions, so we do not log any dashboard interactions. The median comparison described above is read-only and records nothing about you when it loads. If we add interactive actions later, we will disclose what is recorded here before activating them.
Cookies and local storage
We do not use tracking cookies of any kind. While you are actively answering,
your in-progress selections are saved in your browser's local storage (key
prefix vmd_) so they survive a page refresh on the same device.
The personal details you enter (work email, organisation, role, industry,
size, country) are not retained between sessions: once the
diagnostic is completed, abandoned, or left, a clean state is stored, so
nothing lingers on the device and nothing pre-fills for anyone who uses the
same browser afterwards. None of this is transmitted to SP Optima until you
submit. Site analytics use our web analytics service in cookieless mode, which
captures anonymous traffic patterns and cannot be linked to any individual.
We do not intentionally collect or store, in the diagnostic database
The submission endpoint also accepts a hidden anti-spam field (a “honeypot”). This field is invisible to real users; if it arrives populated, the submission is silently discarded and is not written to our records.
If your organisation has commissioned a paid engagement with SP Optima, you
may arrive at the diagnostic through a link that carries an
engagement code (org_code). When present, this
code is stored with your submission. It lets SP Optima associate your
submission with that engagement, so the diagnostic result can be triangulated
with your organisation's AI Capability Index™ data as part of the
organisation-level analysis we deliver to the commissioning organisation.
The code identifies an engagement, not you personally. If you reach the diagnostic without an engagement code (for example, a self-serve visit), none is collected and your submission is not linked to any engagement or shared with any organisation.
Your data is used for the following purposes only:
Email is used to deliver your results and to verify ownership only. The dashboard is gated behind email confirmation: we send a one-time link to the address you provide, and your result is shown and emailed only after you click it. We do not use your email address for marketing, newsletters, or other unsolicited messages. If we want to contact you about anything other than your results or a privacy request you have made, we will ask for separate consent.
We do not use your submissions to train AI models. Your responses are stored as data in a Google Sheet and analysed using standard aggregation methods. We do not pass them to any third-party model provider for training, fine-tuning, or other model-development purposes. Where we use third-party AI tools in our own work, we select providers whose terms preclude training on customer content where reasonably possible.
Small-cohort protection. We do not publish or share aggregate results for cohorts small enough to make an individual or a single organisation reasonably identifiable. Where a category contains too few submissions to safely report, we suppress, combine, or generalise it.
The tool relies on the following third-party processors:
These providers operate under their own privacy policies and security certifications, and process data on our behalf as our agents under data processing agreements. Your submission is stored in the European Union, as described above. The copies of the emails we send you, which include your result, and your contact record are held by our CRM provider. It and the services it relies on process them in the United Kingdom, the European Economic Area and the United States. This means some of your personal information is stored or processed outside Australia. Where any processing takes place outside its region of origin, including transient processing by our hosting provider, we rely on recognised transfer safeguards such as Standard Contractual Clauses or the EU-US Data Privacy Framework and its UK extension.
We take reasonable steps to protect personal information handled by these providers, including using reputable service providers, applying access controls, reviewing the privacy and security documentation they publish, and relying on contractual terms or platform settings where available.
Confirmation tokens are stored alongside your submission in the same Google Sheet infrastructure for up to 24 hours and then expire. Expired tokens are swept daily and retained in an audit log for a further 7 days before deletion. Unconfirmed submissions are not promoted to the main records and are discarded when their token expires.
When you submit the diagnostic, SP Optima sends two automated emails to the address you provided:
Both emails are transactional. They are direct responses to your submission, sent only to fulfil your request to receive your results. We do not add you to a mailing list. We do not send marketing email from this address. If you have not submitted, you will not receive these emails. If you do receive an unexpected confirmation email, you can safely ignore it; the link will expire unused after 24 hours and no further messages will be sent.
You may request that any pending confirmation token tied to your email address be deleted before it expires by writing to enquiries@spoptima.com.
We retain identifiable submissions for 24 months from the date of submission. After that, we either delete the record or de-identify it (removing the work email address, the organisation name, and the engagement code). We retain de-identified data for longitudinal research, and aggregate it so that no individual or single organisation is reasonably identifiable before we publish or share it.
You can request earlier deletion at any time (see Your rights, below).
Copies of the emails we send you are kept in our sending mailbox and our CRM until you ask us to delete them or we disconnect that mailbox from the CRM. If you ask us to delete your data, we delete your contact record and the copies in our mailbox, and block your address in our CRM so we can no longer access its copies. Where full deletion of those copies needs action by the CRM provider, we ask the provider to delete them on your behalf.
No system can guarantee absolute security. While we take reasonable steps to protect your data, you accept that any transmission of information over the internet carries inherent risk.
If we become aware of an unauthorised access to, or disclosure of, your personal information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), where applicable.
Under the Australian Privacy Principles (where applicable), you have the right to:
To exercise any of these, email enquiries@spoptima.com with the subject line “Privacy request”. To help us locate your record quickly, please include the work email address you used to submit and an approximate date of submission. We aim to respond within 30 days.
This notice is written primarily for Australia. If you are in the European Economic Area, the United Kingdom or Canada, the following also applies.
Lawful basis (EEA/UK). We process your data on these bases: to compute and deliver your result, performance of a contract or steps taken at your request; to send your confirmation and summary emails, the same; for de-identified research, our legitimate interest in understanding how AI maturity is evolving, balanced against your interests; and where we ask for it separately, your consent. You can withdraw consent at any time without affecting processing already carried out.
Your additional rights (EEA/UK). Alongside the rights listed above, you may request a copy of your data in a portable format, ask us to restrict processing, and object to processing based on legitimate interests. You may lodge a complaint with your local data protection authority as well as, or instead of, the OAIC.
Automated processing. Your maturity levels, bands, evidence confidence and gate status are produced by automated processing of your responses (profiling). They are indicative only and are not used to make decisions producing legal or similarly significant effects about you, and should not be used as the sole basis for employment, promotion or similar decisions.
International transfer. Your submission is stored and processed within the European Union. Copies of the emails we send you, and your contact record, are held by our CRM provider and processed in the United Kingdom, the European Economic Area and the United States, as described in Where your data is stored. Where any processing takes place outside the EEA or UK, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework and its UK extension.
Canada. We handle your data consistently with PIPEDA, and you may complain to the Office of the Privacy Commissioner of Canada. If you are in Quebec, additional requirements under Law 25 may apply to cross-border transfers; contact us for details.
The tool is intended for adult workplace use and is not designed for, marketed to, or intended to be used by people under 18. We do not knowingly collect submissions from minors. If we identify a submission from a person under 18, we will delete it. If you believe a minor has submitted, please contact us at enquiries@spoptima.com.
We may update this notice from time to time as the tool evolves or as legal requirements change. The “last updated” date at the bottom reflects the current version. We flag material changes via the SP Optima website. Where a change materially affects how we use personal data and we rely on your consent, we seek fresh consent before that change applies to you.
If you believe SP Optima has breached your privacy rights, please email enquiries@spoptima.com in the first instance. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992.