The General Data Protection Regulation (GDPR) has applied since May 2018 to every organisation that processes personal data of EU citizens. The regulation places strict requirements on how data is collected, stored, processed and deleted. Non-compliance can result in fines of up to €20 million or 4% of global annual turnover.
ZelixAI is built with GDPR as its foundation. We apply the principles of privacy by design and privacy by default: security is not bolted on afterwards, it is embedded in every component of the platform. Personal data is only processed for the purposes for which it was collected and never retained longer than necessary. You can delete a customer's data yourself in the portal.
As the data controller, you retain authority over the data processed through our platform. ZelixAI acts as a processor under Article 28 GDPR. Every customer, including on the free package, gets a data processing agreement as soon as we process personal data for you. The text is currently under legal review.
For storage we only use servers in the EU. AI processing can take place outside the EU, for example in the United States, unless you switch on EU-only. We will tell you which AI providers we use on request.