Security and data protection
GDPR in two sentences
The GDPR is the European regulation on the use of personal data: names, e-mails, phone numbers, customer or employee records.
As soon as an AI or a piece of software processes this kind of data, you need to know where it goes, why, how long it is kept and who can access it. This page explains it for our solutions.
Who is responsible for what
Your company remains responsible for the data it entrusts to the tool: it is the “controller”. ITechnologies acts on your behalf and on your instructions: it is the “processor”. This split of roles is written into the contract.
Where your data is
- Private LLM on your premises: documents, index and conversations stay on your infrastructure.
- Private LLM on our servers: in France by default, or in your country if your rules require it.
- AI via API (Claude, GPT): the texts sent go through the provider. What may be sent, and what must never be sent, is written down during scoping.
What the contract covers
- The data processed, the purpose of the processing and its duration
- The hosting location
- The people who have access to the data, bound by confidentiality
- The security measures chosen for the project
- Our help in answering requests from the people concerned: access, correction, erasure
- Prompt reporting of any incident affecting your data
- Return or deletion of the data at the end of the assignment
AI providers via API
Before sending anything to Claude, GPT or another market model, we check the provider’s terms with you: data retention, use for training, processing location.
If the provider processes data outside the European Union, that transfer must be covered: we check it with you during scoping. Sensitive data, such as health, legal or trade secrets, stays on a private LLM.
Our good practices
- Less data, less risk: only the data needed for the task is processed
- Access through accounts and roles: everyone sees only what concerns them
- Anonymisation of the examples used to adapt a model, when needed
- Answers that cite their sources, to keep human control
- Doubtful cases in an automation approved by a person
AI and transparency
The European AI Act requires people to be informed when they interact with an AI. For a voice agent, we recommend saying so in the call greeting.
Clients outside the European Union
For a client in the UK, the United States, China or elsewhere, the rules of their country apply on top: local hosting, framework for transfers. We take them into account from scoping.
Data collected by this website
The data collected by this website (form, booking) is described in our privacy policy.
A specific question?
Write to contact@itechnologies.fr: we answer for your case before any commitment.