Security & data

How we handle client data

This page describes how we handle data in client projects, in particular automation and knowledge assistants. The details of each project are set out in a written data processing agreement.

1. Data processing agreement

For every project that involves personal data, we sign a data processing agreement under Article 28 of the GDPR before work starts. It sets out what we process, for what purpose, for how long and on whose instructions.

2. Where data is processed

By default, client data is stored and processed in the European Union or the European Economic Area. A transfer outside the EU/EEA happens only when agreed in writing, and only with safeguards such as the European Commission’s Standard Contractual Clauses.

3. AI models and training

Client data is not used to train AI models. We use AI providers under terms that exclude training on the data we send, and we name the provider and the model in the project agreement.

4. Access and security

We protect client data with measures that fit the risk, including:

• Access on a need-to-know basis, limited to the people working on the project.
• Encryption in transit and at rest.
• Separate environments and credentials for each client.
• Logs of what automations and assistants do, without keeping more personal data than needed.

5. Sub-processors

The sub-processors involved in a project, such as hosting and AI providers, are listed in the agreement. We tell you before adding or replacing one, so you can object.

6. End of a project

When a project ends, we return or delete client data, as you choose, and confirm the deletion in writing, unless the law requires us to keep it.

7. Incidents

If a personal data breach affects your data, we tell you without undue delay, so you can meet your own obligations, including notifying the supervisory authority within 72 hours where required.

8. Questions

For questions about data processing or security, or to prepare a data processing agreement, email info@wishfy.ai.