GDPR and data processor – what does it mean?

How it works

Personal data may come in during conversations: name, email address, phone number. The provider processes the data on your behalf, for the purpose and period set out in the agreement. This way the data processing can be demonstrated in writing.

The agreement sets out what data the provider stores, where and for how long, and what happens to it after the retention period ends. So you always know where customer data is.

An example at a company

The customer gives their phone number for the handoff. The data is stored for the period set out in the agreement, and then deleted.

The place and method of storage are set out in writing in the agreement, so the company can demonstrate them.

What this means for business leaders

Ask for the DPA, the list of sub-processors and the storage region in writing, before signing. Ask what happens if a customer requests the deletion of their data.

If the agreement is missing, you cannot demonstrate the data processing during an inspection by the authority. The risk of a fine is real, and your reputation may also suffer. The list of sub-processors shows who else has access to the data.

How we do it

Our data stays in the EU, including the model calls. The retention period is 90 days. The AI disclosure appears in the header and in the first message, in line with Article 50 of the EU AI Act, and cannot be switched off.

Details on the data security page.