GDPR compliance
The short, plain-English version of how Undrhand CommV (the company behind undrsight) complies with the EU General Data Protection Regulation. For the legally precise version, see our Privacy policy and DPA.
01Our posture
We built undrsight in Belgium with GDPR baked in. We host primary production infrastructure in the EU, use LLM provider controls and contracts designed to prevent customer-content training use, and design for data minimisation — we only collect what the Service needs to function.
We are not required to appoint a statutory Data Protection Officer under Art 37 GDPR (our processing does not meet the triggering thresholds), but a senior team member owns privacy and can be reached at privacy@undrsight.com.
02Roles
- We are the controller for personal data we collect about visitors to our marketing site, people who email us, and account holders (name, email, login credentials, session data, usage analytics).
- We are a processor for the content that your organisation uploads to the platform (deal documents, analyses, comments). Your organisation is the controller of that data; we process it on your instructions under our DPA.
03Your rights as a data subject
Whether the data concerns your use of the platform, your interactions with our marketing, or personal information in a deal you were part of, you have the rights granted by Chapter III of the GDPR:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — correct inaccuracies.
- Erasure — ask us to delete personal data we don't have an overriding obligation to keep.
- Restriction — request we pause processing while a disagreement is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on our legitimate interests.
- Withdraw consent — where processing relies on consent.
- Not be subject to automated decision-making with legal or similarly significant effects (undrsight does not currently make such decisions).
04How to exercise a right
Send an email to privacy@undrsight.com describing what you want to do. Please include enough information for us to locate you in our systems — usually your email address and (if relevant) the organisation in whose workspace you were a user.
We respond within one month. Complex requests may be extended by up to two further months under Art 12(3). We may ask for additional information to verify your identity before acting — we will not act on a request that reasonably appears to come from someone other than the data subject.
05Where data about you ends up
Primary processing happens in EU data centres. A limited set of sub-processors operate in the United States — currently OpenAI and Anthropic for LLM inference, and Resend for email. Each is engaged under Standard Contractual Clauses, with supplementary measures such as data minimisation, transport encryption, and provider training opt-out controls where available.
Deal-document content is stored in the EU. Files, extracts, prompts, and generated outputs needed for a requested analysis may be processed by approved LLM providers under those transfer safeguards.
Full list in Annex III of the DPA.
06Security & breach handling
Our security measures are summarised on the Security page and set out in detail in Annex II of the DPA. If a personal-data breach affects your data, we will notify you without undue delay — within 72 hours of our confirming the breach for customer organisations, and at the same cadence for direct data subjects where GDPR requires it.
07Complaints
If you believe we have mishandled your personal data, we would appreciate hearing from you first at privacy@undrsight.com so we can try to resolve it. You always have the right to complain to a supervisory authority — our lead authority is the Belgian Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données
Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels, Belgium
dataprotectionauthority.be
If you reside in another EU Member State, you may alternatively complain to your local supervisory authority.
08More detail
This page is a summary. For exhaustive detail:
- Privacy policy — full Art 13/14 disclosure.
- Data processing agreement — Art 28 processor terms.
- Security page — technical measures in depth.