QualiSpec

GDPR overview

GDPR implementation is documented rather than merely claimed. The security page lists GDPR compliant as one of its headline commitments and describes a privacy-by-design approach, and the FAQ states that data is processed under the German Federal Data Protection Act and the GDPR. A data protection officer is formally appointed and named, Sascha Mueller, reachable at sascha.mueller@cerpro.io. The processing agreement is automatically concluded with the contract and names five subprocessors with their addresses. German law governs the terms. No Article 27 representative is designated, which is consistent: the publisher is established in Berlin, inside the Union. One caveat: the DPO's telephone number is still an unfilled template placeholder in the privacy policy.

Who owns the data?

The terms of business make the split explicit. Under clause 14.1 the customer is the controller within the meaning of Article 4(7) GDPR and Cerpro is only the processor under Article 4(8), so the drawings and the inspection data extracted from them stay the customer's. Clause 14.2 states that the data processing agreement in Annex 1 forms an integral part of the contract and is concluded automatically on signature, with no separate request. Ownership runs the other way for the technology: the AI model, its weights, the training data and the container images shipped with the optional on-premise module remain the property of Cerpro or its licensors, and clause 5.3.13 forbids the customer from distilling or reverse-engineering them.

Reuse rights

Because the customer stays the controller, it keeps the drawings it uploads and the characteristics extracted from them, and may reuse those outputs in its own inspection reports, quality records and downstream systems without asking the vendor. What the customer may not do is exploit the underlying technology: the licence is limited to the term of the contract, non-exclusive, non-transferable and non-sublicensable, and the terms expressly prohibit using the supplied AI model or its outputs to distil, reconstruct or rebuild a comparable model. Processing is not carried out by Cerpro alone. Annex IV names five subprocessors: Amazon Web Services EMEA SARL for hosting, Microsoft for Office 365 services, OpenAI for multimodal LLM services, and Hotjar and Mixpanel for analytics. The processing agreement grants general written authorisation for that list and requires at least fourteen days' notice before any subprocessor is added or replaced, leaving the customer room to object. Note that neither the terms nor the privacy policy say anything about whether customer data is used to train AI models.

Data retention & training

Hosting summary

Hosting runs on Amazon Web Services. Annex IV of the terms names Amazon Web Services EMEA SARL, or the relevant AWS group company, as the hosting subprocessor, and specifies the region as the one agreed or selected, defaulting to the European Union or European Economic Area unless otherwise agreed. No individual country is named contractually, so the jurisdiction is EU or EEA rather than a specific state. This deserves a note of caution. The public site is more assertive than the contract: it presents data security as made in Germany and describes AWS as a German provider, which the terms do not support. Where the two conflict, the contract is the safer reading. Four further subprocessors are disclosed, three of them outside the EU: Microsoft in Redmond for Office 365 services, OpenAI in San Francisco for multimodal LLM services, Mixpanel in San Francisco for analytics, and Hotjar in Malta for analytics. Drawings and attachments are backed up redundantly within the same data centre, and accidentally deleted data can be restored from backups for up to seven days. The advertised availability service level is 95 percent.