Borek Trust Center

Primarily within the EU. Borek’s core infrastructure partners, Microsoft Azure (including Azure OpenAI) and Google Cloud, are configured to process data in the EU region. Where a project uses a dedicated client environment, that configuration is documented and confirmed per engagement.

Not by default. Data is processed within the EU under standard project configurations. Any exception requires a documented Transfer Impact Assessment and Standard Contractual Clauses, per the DPA: not a silent default, but a deliberate, contractually governed exception.

No. Client personal data is never used to train, improve or develop foundation models, LLMs or other general-purpose AI models, unless the client explicitly instructs Borek to do so in writing. This applies regardless of which AI subprocessor is used.

Personal data is minimised to what the specified purpose requires and securely deleted or anonymised after the defined retention period. Instructions and processing records are retained for the agreement’s duration plus 3 years.

Borek processes personal data as a Processor under GDPR Art. 28, with clients acting as Controller. Concretely:

• Every engagement is covered by a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs) for any cross-border transfer.
• A legal opinion from our Legal Advisors confirms that the data protection law at our delivery site is aligned with the GDPR.
• Borek has a designated Data Protection Officer and documented technical and organisational measures across access control, encryption, breach notification and more (see Controls).
• Subprocessors are bound by equivalent data protection obligations, with advance notice before any change.

No, and we describe them side by side rather than equating them. Borek Solutions holds a TISAX® assessment (Scope SV4P7M, ENX), built on the ISO 27001-derived VDA ISA control set with added automotive and GDPR requirements. Borek IT Sourcing in India holds an ISO/IEC 27001:2022 certificate from TÜV SÜD. The group applies ISO 27001-aligned practice across entities.

Our Data Protection Officer can be reached at dpo@boreksolutions.de.

No. Whether Borek is embedded in your team or building a product independently, the same data protection, confidentiality and security commitments apply: DPA, TOMs and NDA. Internally, a Responsible Use of AI policy covers approved and prohibited AI use, information classification tiers, incident reporting and mandatory employee training.

Microsoft Azure (including Azure OpenAI Services) for cloud hosting, infrastructure and AI services, and Google Cloud Vision API for image recognition and OCR, both EU region only. Clients are notified in advance of any new or replaced subprocessor and have a 14-day objection window.

Documented incident detection, response and escalation procedures apply. You are notified without undue delay, including the nature of the incident, likely consequences and measures taken or proposed. Documented facts, effects and remediation are available on request.

Yes, information requests, documentation review and on-site inspections where necessary, with reasonable prior notice and during normal business hours, generally no more than once per year unless documented urgency applies.

An MSA governs the relationship, each project runs under its own SOW, a DPA implements GDPR Art. 28, and a mutual NDA applies from first contact. You own the paid deliverables developed for you; Borek retains background IP (reusable frameworks, methodologies and AI components developed independently) without restricting your use of what you paid for.

Certificates and the Legal Advisors’ GDPR statement are public under Resources. The DPA with TOMs annex, the SCCs and the NDA template are released to named contacts on request via dpo@boreksolutions.de.