Databox

GDPR overview

Databox claims GDPR compliance and documents it. A dedicated GDPR page describes product, terms and privacy updates, a designated data protection officer and vendor vetting; the security FAQ names the DPO, Andrej Zitnik, and compliance@databox.com is the privacy contact. A public Data Processing Agreement, effective 21/12/2023, incorporates the EU Standard Contractual Clauses (Decision 2021/914, module two, controller to processor), the UK Transfer Addendum and the Swiss FADP. The privacy policy, revised 06/04/2026 and effective 30/04/2026, spells out EEA and UK rights: access, copy, rectification, portability, restriction, erasure and withdrawal of consent. Transfers to the United States are acknowledged explicitly, with no adequacy decision and contractual safeguards instead; the competent supervisory authority is the customer's own, per SCC clause 13. One gap: no Article 27 EU representative is named anywhere on the site.

Who owns the data?

Databox states that customers keep full ownership of the data they connect. The security FAQ says that "Customers retain complete ownership of their data, with Databox serving as a data processor under GDPR", and the Data Processing Agreement sets the same split: the client is the controller, Databox the processor. The terms of service add that "The Company does not own any data, information or material that you or other users submit (User Content)", while making the customer responsible for its accuracy, legality and rights. Ownership is not safekeeping, though: on termination for breach access stops immediately with no duty to retain anything, and cancelling an account deletes all User Content at once, beyond recovery.

Reuse rights

Because customers keep ownership of their content, nothing in the terms requires Databox's permission to reuse it, and the product provides the means: CSV export, secure links, embeds, scheduled snapshots and read-only public sharing. On the personal-data side, the privacy policy covers professional identity details, correspondence, cookies and browsing data, states for newsletter data that "This personal data will not be passed on to third parties", and relies on third-party processors for experience and profiling. Appendix 3 of the DPA names 19 sub-processors, among them OpenAI for generative AI and Anthropic and LangChain for LLM services, alongside AWS, Amazon S3, Google Cloud, HubSpot, Intercom, SendGrid, Twilio, Stripe, Mixpanel, Segment and FusionAuth. Databox says data is validated and enriched before any model reads it: "The Data platform is where raw data becomes analysis-ready intelligence before the LLM ever sees it", with the calculation engine kept deterministic and outside the LLM. What no page states is whether customer data is ever used to train models, or whether an opt-out exists.

Data retention & training

Hosting summary

All Databox products run on Amazon Web Services data centers located in the United States, in the AWS East region: "All Databox products run on best-in-class servers in Amazon Web Services (AWS) data centers located in the United States of America (AWS East region)." No European region is offered, so EU customers should expect their data to leave the bloc, with the DPA covering that transfer through the Standard Contractual Clauses, the UK Addendum and the Swiss FADP. The privacy policy adds that data sits either on Databox's own servers or in databases hosted by a cloud provider, in a secured environment. Encryption is AES-256 at rest and 256-bit SSL/TLS (TLS 1.2 or above) in transit, behind a layered network of Amazon VPCs, security groups and system firewalls. Backups are full weekly and differential daily. AWS, Amazon S3 and Google Cloud are the hosting sub-processors named in the DPA.