Prismos

GDPR overview

GDPR implementation is documented rather than merely asserted. The controller is named as PRISMOS, Bekaflaan 54, 3200 Aarschot, company number 1013.252.201, reachable at privacy@prismos.ai or by post to its data protection manager at the same address. The policy states the legal bases relied on — performance of the contract, legitimate interests and consent, depending on the processing — and lists the data subject rights: access, rectification, erasure, restriction, objection, withdrawal of consent, objection to direct marketing and portability. Requests are answered within one month, extendable to three for complex cases. The supervisory authority is named: the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, +32 2 247 48 00. Transfers outside the EEA rely on standard contractual clauses or the EU-US Data Privacy Framework, with prior encryption. No Article 27 representative is designated, and none is required: the publisher is established in the EU.

Who owns the data?

The Master Services Agreement is explicit on ownership. The client retains all rights, title and interest in the Company Data, meaning the data collected or obtained by the vendor under the agreement. Prismos, for its part, keeps ownership of its Vendor Technology and its improvements, and grants the client a worldwide, non-exclusive, non-transferable licence limited to the term. The privacy policy splits the roles accordingly: for client employee data and for documents supplied by the client, the client is the controller and Prismos the processor; for everything else — website visitors, prospects, public figures in the record — Prismos is controller in its own right.

Reuse rights

Because the Company Data belongs to the client, the client may reuse the output it receives without asking Prismos for permission, subject to its licence to the platform itself remaining in force. The underlying material is public by nature: committee minutes, plenary debates, written questions, bills and consultations, supplemented by other publicly available sources such as broadcast media, party and organisation websites and the Belgian Crossroads Bank for Enterprises. In the other direction, Prismos states that customer data is never used to train its own models or third-party models, and that model providers process content only to return a result, under contractual data-protection terms. AI-generated content is labelled and linked back to its source, and the publisher frames the tool as surfacing and summarising while the client team decides what to do with it.

Data retention & training

Hosting summary

Prismos states that all data is stored within the European Union, and its product FAQ repeats that customer data is held in EU data centres. Beyond that, the hosting picture is thin: no specific country is named, and no hosting provider is identified anywhere on the site. Encryption is claimed on both sides, AES-256 at rest and TLS 1.3 in transit. The privacy policy contemplates transfers outside the European Economic Area and states that these rely on standard contractual clauses or the EU-US Data Privacy Framework, with the data encrypted beforehand. The jurisdiction is Belgian: the publisher is Prismos BV, established in Aarschot, the master agreement is governed by Belgian law, and the supervisory authority named in the privacy policy is the Belgian Data Protection Authority. Buyers with a strict data residency requirement will need to ask directly which countries and which providers are involved, because the published commitment stops at the level of the Union.