Data Processing Agreement
How we process and protect data under GDPR
📋 Data Processing Summary
This document outlines how Global AI Watch processes personal data under GDPR Article 28 (data processor relationship) and Article 6 (lawful processing).
Legal Basis for Processing
- Consent (Article 6.1(a)): Newsletter subscription — you explicitly agreed
- Contract (Article 6.1(b)): Providing intelligence content you requested
- Legitimate Interest (Article 6.1(f)): Analytics to improve our service (minimal, anonymized)
📊 Categories of Data Processed
1. Subscriber Information
Email address, name (optional), language preference, region preference
2. Usage Data
Pages visited, articles read, click events (anonymized, no IP logging)
3. Device Information
Browser type, device type (generic — not fingerprinting)
Data Retention & Deletion
- Subscriber data: Retained until you unsubscribe or request deletion
- Analytics logs: Aggregated, anonymized data only — retained for 90 days max
- Right to deletion: You can request permanent erasure anytime (contact privacy@global-ai-watch.com)
🌍 International Data Transfers
NO DATA IS TRANSFERRED OUTSIDE THE EU by default. Our infrastructure is hosted exclusively on European servers. If you request data export or deletion, it is processed locally without leaving EU jurisdiction.
We comply with GDPR Chapter 5 (international transfers) restrictions and do not rely on invalidated mechanisms like Privacy Shield or Standard Contractual Clauses for unnecessary transfers.
✅ European Data Sovereignty Badge
Global AI Watch infrastructure is hosted on SCHREMS II-compliant servers in the EU, ensuring that your data remains under European legal protection at all times.
🔒 Data Security
- ✓ Encryption in transit (TLS 1.3)
- ✓ Encryption at rest (AES-256)
- ✓ No third-party data processors without explicit contractual guarantees
- ✓ Regular security audits
- ✓ Incident response plan (notification within 72 hours of breach detection)
Questions?
Contact our Data Protection Officer: privacy@global-ai-watch.com
We will respond within 30 days, as required by GDPR Article 12.