Legal · data protection & AI Act
One page · DPA on requestData protection and the AI Act. One page
What your data-protection officer and your IT partner ask before the first call — answered here, and in the data-processing agreement you get before anything starts.
This page explains. The data-processing agreement binds. Not legal advice.
- 01
Where your data is
On our servers in Hungary, Germany or Finland — or on your own infrastructure, if your policy requires it. Encrypted in transit and at rest. Backups daily, kept for 30 days by default; frequency and retention are set in your contract. At the end of the contract your data is handed back and our copies deleted within the period set in the contract.
- 02
Which AI models see it
The language models come from Anthropic, Google and OpenAI, on API terms with no data retention on the model side: nothing you send is stored by the provider or used to train anything. Each step sends the model only what it needs — the invoice or e-mail in hand, the price-list rows for a quote, the figures for a report, the passages of your knowledge base that answer the question — never a copy of your database. Prefer your own model or provider? We connect to it. Need a model trained on your own data? Possible, scoped case by case.
- 03
Sub-processors
Every provider that touches your data is listed below by name, purpose and location, and as an annex to the data-processing agreement. Changes are announced before they happen, and you can object.
- 04
The data-processing agreement
Signed before the audit. Your right to audit, deletion at contract end, breach notification without undue delay — at the latest within 7 days — the sub-processor list as an annex, and the technical measures: who has admin access, MFA, how screen-automation credentials are stored.
- 05
The AI Act
The standard automations we build — document extraction, drafting, routing, reporting — fall into the minimal-risk category. Human oversight and the classification are documented with you and kept on file. Article 4 AI literacy for your staff is a separate programme.
AI training - 06
Licence and your data
Your data is yours: you are the controller, we are the processor, and you can export it in standard formats at any time. You get a licence to use it; the code stays with Zircon. Moving it to another company or provider is a paid hand-over — stated in the contract, not discovered later.
- 07
From Austria and Germany
Contracts in English under Hungarian law, with a liability cap set in writing before we start. By design, nothing that costs money leaves an automation without a human click.
Sub-processors
| Name | Purpose | Location | Agreement |
|---|---|---|---|
| [Hosting provider] | Hosting, backups | HU / DE / FI | DPA |
| Anthropic | AI models (API, no retention) | [Region] | API terms + DPA |
| AI models (API, no retention) | [Region] | API terms + DPA | |
| OpenAI | AI models (API, no retention) | [Region] | API terms + DPA |
| [Provider] | E-mail, monitoring | EU | DPA |
Bracketed entries are filled before launch; the list is copied verbatim into the DPA annex.
A copy of the DPA before the call — one e-mail to hello@zircon.hu.
Ask for the DPA