Enterprise-ready privacy and security.
Every brainylab solution is GDPR-compliant by design and runs on EU servers. Your legal and IT teams get the documents they need before the project starts.
Your data stays in the EU. Your users stay in control.
GDPR and AI Act compliant processes, technology and solutions. Mapped before kickoff, documented in writing, signed before any personal data is collected.
What we guarantee.
Four commitments on every project, before a single player signs up.
Compliance assessment before kickoff
Before contracting, we map the GDPR and EU AI Act obligations that apply to your project: lawful basis, consent flows and AI risk classification.
GDPR · EU AI ACTEU data residency
All personal data is hosted and processed in the EU under a Data Processing Agreement, with a documented register of sub-processors.
ART. 28 GDPRDocumented AI transparency
Every AI feature is documented in writing: its purpose, data sources, model provider and the disclosure shown to end users, in line with EU AI Act transparency obligations.
EU AI ACTData minimisation by design
We collect only the data required for the defined purpose and agree retention periods before launch.
ART. 5 · ART. 25 GDPRDocuments we provide.
Your legal and IT teams can review all of it before signing.
- Data Processing AgreementArt. 28 GDPR, signed before any personal data is collected
- Sub-processor listIncluding AI model providers and the safeguards that apply
- AI documentation per featurePurpose, data sources, model provider, user disclosure
- Security overviewFor your IT team, before contracting
Regular updates, uptime monitoring and maintenance are part of every solution. [tbc: uptime target, backup frequency, incident response time]
Privacy questions.
We answer privacy and security questions on the first call, so approvals do not slow the project down.
Where is our data hosted?
All personal data is hosted and processed in the EU. Any sub-processor, including AI model providers, is listed in our sub-processor register together with the safeguards that apply.
Who is the data controller?
You are. brainylab acts as data processor under a Data Processing Agreement (Art. 28 GDPR), signed before any personal data is collected.
How long do you keep player data?
As long as agreed before launch, and no longer. Retention periods are defined per project. At the end of the period, data is returned to you and deleted from our systems.
Can our legal and IT teams review your documentation before signing?
Yes. We provide the Data Processing Agreement, the sub-processor list, documentation for each AI feature and a security overview. We answer privacy and security questions on the first call so approvals do not slow the project down.
Do you have ISO 27001 certification?
[tbc: certification status and security practices]
Our practices are documented in our security overview, which your IT team can review before contracting.
Bring your legal team
to the call.
We answer privacy and security questions on the first call, so approvals do not slow the project down.
- 01 · DPASigned before any personal data is collected.
- 02 · REGISTEREvery sub-processor listed, with safeguards.
- 03 · AI DOCSPurpose, data and disclosure for each AI feature.