Footprints AI

GDPR overview

GDPR treatment is documented in unusual detail. A dedicated compliance page sets out the Article 5 principles, privacy by design and by default, the lawful bases, and the controller, processor and joint-controller split. A data protection officer is named and reachable at dpo@footprints-ai.com. Being established in Romania, the company sits inside the EU, so no Article 27 representative is required and none is named. Requests are answered within one month, extendable by two for complex cases. Data processing agreements are offered to clients and signed with every subprocessor. Transfers outside the EEA rely on standard contractual clauses and transfer impact assessments, with the EU-US Data Privacy Framework covering Google and Meta. The Romanian supervisory authority, ANSPDCP, is cited with its address. Alignment with ISO 27001 and ISO 27701 is claimed throughout.

Who owns the data?

Footprints for Retail SRL splits its role in two. It is the data controller only for a narrow set of its own data: platform login credentials, recruitment files and website interactions such as contact forms and newsletter sign-ups. For shopper and campaign data it acts as a data processor, working under the instructions of the retailer or advertiser, who remains the controller; the GDPR page additionally claims a joint-controller role for its Ecosystem Analytics activity. Shopper records are pseudonymised, using hashed identifiers, loyalty numbers and POS transactions. The company states it does not sell, rent or share personal data beyond the scope of its services or its clients' instructions.

Reuse rights

The published documents grant an end user no reuse right over the data held in the platform. Rights flow the other way: for shopper and campaign data the retailer or advertiser is the controller and decides purposes, retention and access through a data processing agreement, while Footprints AI processes strictly on instruction. Subject access requests about that data must be addressed to the client, not to the vendor, which only assists. The company does reserve some use of data for itself, listing the testing of new AI models among its processing purposes, although the detailed section attaches that research to in-house Retail Analytics trials in its own offices rather than to client data. Because the documents neither confirm nor deny training on customer data, the vendor's stance is recorded here as unclear, and no opt-out mechanism is documented anywhere.

Data retention & training

Hosting summary

All processing and storage takes place inside the European Union, on Microsoft Azure West Europe in the Netherlands, a claim the privacy statement repeats five times. Each client sits in an isolated private cloud, with isolated virtual networks and private endpoints preventing public exposure and no cross-client access. Data is encrypted with AES-256 at rest and TLS 1.2 or above in transit, under role-based access control and multi-factor authentication. Penetration testing is carried out every six months and at each retailer onboarding by accredited third-party firms; audit logs are kept for at least twelve months and security incidents are reported to clients within eight hours. Employee laptops are encrypted with BitLocker or FileVault and hold no local client data. Where a provider processes data outside the EEA, standard contractual clauses and transfer impact assessments apply, with the EU-US Data Privacy Framework covering Google and Meta. Microsoft Azure is described as SOC 2 Type II and ISO 27001 certified, a certification held by the subprocessor rather than by the vendor, which claims alignment with ISO 27001 and ISO 27701.