Service Data Privacy Notice
Last updated: 16 July 2026
This notice describes how TRAX AI BV processes personal data when delivering client services. It is separate from our website privacy policy for visitors to traxb2b.com.
Read the website privacy policy
1. Scope
This notice describes how TRAX AI BV (RPR Antwerpen, company number BE 1039.054.397, registered office at Kwikstaartlaan 3, 2610 Antwerpen, Belgium) processes personal data in the course of delivering audits, custom AI or deterministic software and automation builds, and training services to clients ("Services"). This notice is separate from our website privacy policy, which covers visitors to traxb2b.com.
2. What kind of data this covers
The data TRAX processes in delivering Services is predominantly business/operational data belonging to the client (project data, business records, workflow content). In the course of this work, TRAX may also process limited categories of personal data, such as: • Names and contact details of client employees or contacts (e.g., in invoices, project communications, or operational records) • Names and contact details of the client's own customers or business contacts, where these appear in the data being processed (e.g., a CRM export, a lead list, an automation workflow) TRAX does not process special categories of personal data (Art. 9 GDPR, e.g., health, biometric, or similar data) or data relating to minors as part of its standard Services. Where a specific engagement would involve such data, it is handled separately and requires anonymization, pseudonymization, or API-only tooling (see Section 4).
3. Our role
For most engagements, TRAX acts as a processor, processing personal data only on the client's documented instructions, as set out in the Data Processing Agreement (DPA) accompanying the contract. In some engagements (for example, where TRAX determines which datasets to analyze during an audit, or shapes the scope of what's processed), TRAX may act as controller or joint controller for that specific activity. Where this applies, it is identified in the engagement's Annex/SOW.
4. How AI tools are used in delivering Services
Use of AI tools that does not involve client personal data (internal strategy, marketing copy, general research, and similar work) falls outside the scope of this notice. Where client personal data is involved, TRAX's current operating practice is that design, testing, validation, and ongoing troubleshooting/support of bespoke solutions are predominantly carried out using commercial AI tools (e.g., Claude, Cursor, ChatGPT) under their standard consumer-tier accounts. Because each solution is bespoke to a client's own systems and data, this testing is generally done with the client's actual data rather than synthetic data, to confirm solutions work correctly against real conditions. This means client personal data is, at this stage, processed under these providers' consumer terms, which do not include the retention limits, training exclusions, or Art. 28 data processing agreement available at the API/commercial tier. This practice is disclosed and specifically authorized in each engagement's contract. Once deployed, client solutions interact with AI providers in production via API access, governed by the provider's commercial/API terms (Section 6), under which client data is not used to train models and retention is limited to defined windows. This does not apply to special categories of personal data or data relating to minors (Section 2), which are anonymized, pseudonymized, or handled exclusively via API-tier tooling regardless of project phase.
5. Sub-processors
TRAX AI's default technology stack includes: • Anthropic (Claude, consumer and API tiers) — AI model provider; project files also stored within Claude (Projects) • Cursor — AI-assisted coding/IDE tool; routes code and data to underlying AI model providers (e.g., Anthropic, OpenAI, Google, Xai, and others) selected within the tool during development • n8n — Automation/workflow infrastructure • Notion — Project files and documentation storage The specific sub-processors for a given engagement are confirmed in that engagement's contract or Annex, since tooling varies by project. Project files stored in Claude and Notion are currently on personal accounts rather than business/workspace accounts. As with the AI tools described in Section 4, personal-tier accounts generally don't carry a business data processing agreement, so client personal data stored this way is not currently covered by a DPA or Art. 28 contract at the storage layer.
6. International data transfers
Where sub-processors are engaged via API/commercial-tier agreements (Section 4, production layer), international transfers outside the EU/EEA are covered by Standard Contractual Clauses incorporated into those providers' commercial terms. Where personal data is processed via consumer-tier accounts during the build/design phase (Section 4), no equivalent transfer mechanism currently exists: consumer-tier terms do not include a Data Processing Addendum or Standard Contractual Clauses. This is the same disclosed, known gap described in Section 4.
7. Data subject rights
The individuals whose data may appear in Section 2 are typically the client's own employees or contacts, not TRAX's direct customers. Requests to exercise data protection rights should be directed to the client (as controller); TRAX will assist the client in responding, per the DPA. Where TRAX acts as controller (Section 3), individuals may contact TRAX directly at contact@traxb2b.com.
8. Security measures
TRAX implements reasonable administrative, technical, and organizational measures appropriate to the scale of its operations, including access controls and confidentiality obligations on staff and contractors handling client data. No method of transmission or storage is 100% secure, and TRAX cannot guarantee absolute security.
9. Data Processing Agreement
Where a Data Processing Agreement (DPA) is in place for an engagement, it takes precedence over this notice in case of conflict. Where TRAX processes personal data on a client's behalf, a DPA is used.
10. Contact
contact@traxb2b.com
11. Language
This notice exists in English, French, and Dutch. The English version is the controlling text in the event of any conflict or inconsistency between the versions.