Umbiko

GDPR overview

GDPR compliance is documented rather than merely asserted. The privacy policy and the data protection agreement, both dated 1 May 2026, state that data is processed lawfully, fairly and transparently, and cite the legal bases relied on: Article 6(1)(b) for contract, 6(1)(f) for legitimate interest and 6(1)(a) for consent. Data subject rights are listed in full, including access, rectification, erasure, restriction, portability, objection and withdrawal of consent, with a response promised within one month through hello@umbiko.ai. The supervisory authority named is the Autoriteit Persoonsgegevens. The agreement follows Article 28, names its subprocessors and commits to notifying the customer of a personal data breach within 72 hours. No Article 27 representative is appointed, consistent with a publisher established in the EU, and no data protection officer is named anywhere on the site.

Who owns the data?

The terms are explicit: the customer retains all rights, title and interest in Customer Content, and Umbiko B.V. claims no ownership over uploaded documents, quotations or tender data. The publisher takes only a limited, non-exclusive licence, and solely to deliver the service. The data protection agreement follows Article 28 of the GDPR: the customer is the data controller for personal data uploaded into or generated within the platform, and Umbiko B.V. acts as processor. Subprocessors are named, and a countersigned DPA is available on request at no charge. Support staff from Soratus can obtain read access to customer data, but only through the documented support-mode flow, which is logged.

Reuse rights

Customer Content is used for one declared purpose only: running the service, which covers extraction, comparison, search, AI assistance and support. The publisher states that customer content is never used to train, fine-tune or evaluate AI models, and that inference runs on Azure OpenAI deployments inside the EU under a no-training clause rather than on the public OpenAI API. Prompts and completions are not kept beyond producing the answer and writing the audit log. Because ownership stays with the customer, the outputs of the platform, comparison documents, risk reports and Excel exports can be reused freely inside the organisation without asking permission. Internal access is deliberately narrow: Soratus support has read access only, through the documented and logged support-mode flow. On the public website, and only there, Microsoft Clarity analytics runs after consent.

Data retention & training

Hosting summary

All production workloads run on Microsoft Azure in the EU West region, and the security page states that no customer data leaves the European Union. No individual hosting country is named: West Europe is an Azure region, not a country. Data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest, backups included, and each tenant is isolated in its own Cosmos DB container, blob path and search index. Subprocessors are disclosed by name: Microsoft Azure for hosting and AI services, Microsoft Communication Services for transactional e-mail, and Microsoft Clarity for analytics on the public website only. Customers are notified 30 days before any new subprocessor is added and may object. Should a transfer outside the European Union ever become necessary, the publisher commits to relying on the EU standard contractual clauses. AI inference runs on Azure OpenAI deployments in the EU under a no-training clause rather than on the public OpenAI API.