GDPR Compliance & DPA

AI Vision Institute designs every AIVIO workflow for compliance with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2). Compliance is a default property of the platform, not an optional add-on.

For data of website visitors and prospective clients, we act as controller. For business data processed by workflows on behalf of a client (their invoices, their customers' contact details, their communications), the client is the controller and we act as processor under a signed Data Processing Agreement.

A DPA is a mandatory part of every AIVIO contract and includes: subject matter and duration of processing, nature and purpose, categories of data subjects and personal data, documented-instructions clause (Art. 28(3)(a)), confidentiality of authorised persons, security measures per Art. 32, sub-processor authorisation and list, assistance with data subject rights, breach notification within 48 hours of awareness, and deletion or return of data at contract end.

Request the current DPA template: saso@ai-vision.ai.

Measures include: EU-only hosting (Germany), encryption in transit (TLS 1.2+) and at rest, credential isolation via environment variables and encrypted secret stores, role-based access on a need-to-know basis, continuous workflow health monitoring, daily encrypted backups with 14-day retention, and audit logging of automated actions.

We engage a small set of infrastructure and AI sub-processors, each bound by GDPR-compliant terms. The current list (including hosting provider and AI model provider) is annexed to the DPA and updated with 14 days' prior notice, giving clients the right to object.

On becoming aware of a personal data breach, we notify affected clients without undue delay and no later than 48 hours, with the information required by Art. 33(3) GDPR, and assist the client in meeting their own 72-hour notification duty to the supervisory authority.