GDPR ARTICLES 13 & 14 · DATA PROTECTION NOTICE
Privacy Policy & Data Protection Register
Transparent disclosure of how Locus Labs processes personal data, enforces zero-retention AI compilation, and maintains 100% European Economic Area (Frankfurt eu-central-1) data residency.
Identity of the Controller & Processor
LOCUS SRL ("Locus Labs", contact: office@getlocus.eu) acts as the Data Controller under GDPR Article 4(7) for visitor telemetry, billing records, and account administration on locuslabs.tech.
When a customer inputs software architecture metadata into the 12-question compliance studio or publishes a hosted Buyer Trust Center (/trust/[company]), LOCUS SRL acts as a Data Processor under GDPR Article 28 on behalf of the customer.
Client-Side .DOCX Compilation & Zero AI Model Training Guarantee
Locus Labs is engineered under GDPR Article 25 (Data Protection by Design and by Default):
- →Deterministic Rule Evaluation: Risk tiering across the EU AI Act, GDPR, EU Data Act, and DORA is computed deterministically via versioned TypeScript rule matrices.
- →Client-Side .DOCX Generation: Microsoft Word (.DOCX) files are compiled directly inside your browser memory using client-side JavaScript. Document binaries do not require server-side storage.
- →Strict Zero-Training Guarantee: Customer architecture descriptions, sub-processor lists, and contact details are NEVER used to train, fine-tune, or improve foundation AI models (pursuant to EDPB Opinion 28/2024).
Categories of Data Processed & GDPR Article 6 Lawful Basis
We process only the minimum data strictly necessary to deliver statutory compliance dossiers and maintain live Buyer Trust Centers:
- →Architecture Intake Inputs (Company name, product name, architecture parameters, contact email): Processed under GDPR Art. 6(1)(b) (performance of a contract / pre-contractual steps at your request).
- →Hosted Buyer Trust Center Records (/trust/[slug]): Stored in Frankfurt am Main (AWS eu-central-1) under GDPR Art. 6(1)(b) so your enterprise buyers can verify your regulatory posture.
- →Invoicing & VAT Records: Processed under GDPR Art. 6(1)(c) (statutory tax and accounting obligations under EU VAT directives — retained for the statutory fiscal period).
- →Edge Security Telemetry: Minimal HTTP request logs processed by Cloudflare Europe under GDPR Art. 6(1)(f) (legitimate interest in preventing DDoS attacks and abuse).
Authorized Sub-Processors & EEA Data Residency
Locus Labs maintains strict European infrastructure sovereignty. Our active sub-processors are:
- →Supabase Inc. (AWS Frankfurt, eu-central-1, Germany): Encrypted PostgreSQL database for persistent Buyer Trust Centers (AES-256 at rest, TLS 1.3 in transit).
- →Cloudflare Germany GmbH / Cloudflare Inc. (European Edge — Frankfurt / Vienna): Edge routing, DDoS protection, and static asset delivery under EU Standard Contractual Clauses (2021/914).
- →Google Cloud EMEA Ltd (EEA Zero-Retention Endpoint): Optional structured JSON clause assembly when invoked by the API router (zero data retention, zero model training).
Your Rights Under GDPR Articles 15–22
Under Regulation (EU) 2016/679, you have the right to request access (Art. 15), rectification (Art. 16), immediate erasure / Trust Center takedown (Art. 17), restriction of processing (Art. 18), data portability in machine-readable JSON/DOCX format (Art. 20), and to object to processing (Art. 21).
To exercise any right, email office@getlocus.eu. We respond to all verified requests within 72 hours (well within the statutory 30-day period). You also have the right to lodge a complaint with ANSPDCP (www.dataprotection.ro) or your local EU supervisory authority (such as the Austrian DSB at www.dsb.gv.at).