GDPR & Data Protection at intrastat.ai

1. Our Approach to Data Protection

intrastat.ai is an AI-supported B2B Intrastat preparation service. Data protection matters because customers may upload trade, invoice, ERP, import/export, and reporting data that can include personal data.

This page is a transparency and trust overview. It is not a certification and does not claim perfect compliance in every possible situation.

2. Roles Under GDPR

For customer-submitted datasets processed on customer instructions, the customer may act as controller and intrastat.ai may act as processor.

For intrastat.ai account, website, contact, billing, support, security, and business-administration data, intrastat.ai may act as controller. The Privacy Policy explains these roles in more detail.

3. Data Processing Agreements

A DPA may be required where intrastat.ai processes personal data for a customer as processor.

An implemented DPA workflow or published DPA terms have not been verified for this notice, so this page does not promise automatic DPA availability. Customers should confirm DPA arrangements before contracting.

DPA availability and the DPA contracting workflow are not yet published because they have not been verified for this notice.

4. EU-Based Core Infrastructure

Existing website content identifies the core application hosting infrastructure as AWS in the Europe (Frankfurt) Region.

This is not a blanket statement that every supplier, email process, metadata operation, support workflow, AI provider operation, or backup is restricted to Germany or the EEA.

5. AI Providers

AI capabilities may use OpenAI and Mistral AI where enabled. These providers may support extraction, structuring, classification assistance, matching, validation, and preparation of reporting information.

The exact provider used for a given workload can depend on the enabled feature, model, endpoint, account configuration, and customer agreement.

6. European AI Processing

Where supported by the applicable model, endpoint, provider, and account configuration, eligible AI workloads are routed through European regional processing controls.

The active OpenAI EU endpoint, Mistral European endpoint, and provider retention settings have not been confirmed for publication, so this page avoids claims of exclusively European AI processing or no provider-side retention.

OpenAI EU regional processing, Mistral European regional endpoint usage, and provider retention controls should be confirmed against the active provider configuration before stronger claims are published.

7. AI Model Training and Customer Data

Customer data should be processed for the purpose of providing the service and supporting the contracted Intrastat workflow.

Provider-specific model-training and use-of-data commitments depend on the applicable OpenAI and Mistral AI services, agreements, account settings, and endpoints. Stronger provider-specific claims should be published only after those settings are verified.

8. Subprocessor Management

intrastat.ai uses third-party service providers where needed to deliver, secure, and support the service. The Privacy Policy contains additional detail.

AWS

Core application hosting; existing site content identifies AWS Europe (Frankfurt).

OpenAI

AI processing where enabled; regional and retention controls require verification.

Mistral AI

AI processing where enabled; regional and retention controls require verification.

SMTP email infrastructure

Website contact email delivery through configured SMTP infrastructure.

9. International Transfers

Where processing takes place outside the EEA, appropriate safeguards should be used where required, such as provider DPAs, standard contractual clauses, adequacy decisions, and supplementary measures.

This page does not claim that no international transfers occur because the full provider chain and account configuration were not verified.

10. Data Minimisation and Purpose Limitation

Customer data should be processed only as necessary to provide, secure, support, and improve the service and to meet applicable contractual or legal obligations.

Customers should upload only the data needed for the Intrastat preparation workflow and avoid including unnecessary personal data in trade datasets.

11. Access Controls and Human Review

Where human review is provided, it is a quality-control component for uncertain classifications, exceptions, or review workflows.

Human review does not provide governmental approval, legal advice, tax advice, customs advice, or formal authorisation of a declaration. Access controls and confidentiality terms should be confirmed in the applicable agreement.

12. Retention and Deletion

Retention and deletion should follow the applicable customer agreement, DPA, legal obligations, backup practices, and operational retention schedule.

A verified retention schedule has not been confirmed for publication, so this page does not publish fixed retention periods.

Account, customer dataset, report, log, support, billing, backup, and deleted-account retention periods are not yet published because they have not been verified for this notice.

13. Data Subject Requests

Requests involving access, correction, deletion, restriction, portability, objection, or consent withdrawal may be sent to info@intrastat.ai.

Where intrastat.ai acts as processor, it will generally support the customer/controller in handling applicable requests according to the contractual and data-processing framework.

14. Security

The service is presented as using European hosting, controlled review, and traceable decisions for sensitive Intrastat data.

Security details are described at a high level to avoid exposing internal implementation details. This page does not claim that security incidents are impossible.

15. Incident and Breach Management

intrastat.ai should maintain procedures for assessing security incidents and personal-data breaches and for meeting applicable legal and contractual notification duties.

Specific notification timelines are not stated here beyond applicable law and contract because a verified incident-response policy has not been confirmed for publication.

16. AI Transparency and Human Oversight

intrastat.ai uses AI to support the reporting workflow. AI can help prepare, enrich, validate, and structure data, but AI output can require correction.

Customers should review outputs before use. Human review may be available as an additional quality-control step, but AI and human review do not autonomously authorise an Intrastat declaration.

17. Customer Control and Final Responsibility

intrastat.ai assists with processing, preparation, and quality control.

The customer remains responsible for determining its reporting obligations, validating the final information, approving the declaration, maintaining authorisations, and officially uploading or submitting the declaration to the competent authority unless a separate written agreement expressly says otherwise.

18. Contact and Privacy Questions

Questions about GDPR or data protection may be sent to info@intrastat.ai.