This Privacy Policy explains how personal data is processed when you visit eokit.com or use the eokit platform and related services ("eokit", "Services"). We wrote it to be clear about what we collect, why, where the data goes and what rights you have under the EU General Data Protection Regulation (GDPR) and Luxembourg data protection law.
La politique de confidentialité existe uniquement en anglais.
The controller responsible for the processing described in this policy is aigentcy S.A., 12, rue de Flaxweiler, L-6776 Grevenmacher, Luxembourg, registered with the Luxembourg Trade and Companies Register (RCS) under number B205054 ("aigentcy", "we", "us").
We have appointed an internal Data Protection Officer. You can contact our Data Protection Officer and our privacy team for any data protection question or request at privacy@aigentcy.lu.
We are the controller for personal data we process for our own purposes. This covers visitors to our website, account and login data, billing, support, communication with you and the security and operation of our platform.
When a customer uses eokit to process its own content, including files from connected services such as Microsoft SharePoint or Google Drive, we act as a processor on behalf of that customer. In that case the customer is the controller, and our processing is governed by the data processing agreement (DPA) concluded with the customer. If you are an employee or contact of one of our customers and have questions about how your data is processed in eokit, please contact that organisation first.
Website visitors: when you visit eokit.com, our servers automatically process technical data such as your IP address, date and time of access, the pages you visit, referrer URL, browser type and version, operating system and device information. We also use a privacy-friendly analytics tool to understand how our website is used in aggregated form. It is configured so that it does not track you across other websites and does not build individual user profiles.
Contact form: when you send us a message through the contact form on eokit.com, your browser transmits the form directly to Web3Forms (web3forms.com), the service we use to receive these messages, which forwards them to us by email. This covers your name, email address and message, the topic you selected and, where you provide them, your phone number, company and preferred appointment time. Web3Forms also receives technical data such as your IP address when the form is sent.
Fonts: eokit.com loads its fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open a page, your browser connects to Google's servers to load the fonts, which transmits your IP address and technical data such as browser and operating system information to Google.
Account data: when you create an account, we process your name, email address, company name (where applicable), role and permissions within your workspace, account settings and seat or subscription information. You can sign in via magic link (a one-time login link sent to your email address) or via single sign-on with Microsoft or Google. If you use single sign-on, we receive from Microsoft or Google the basic profile data needed to log you in, typically your name, email address and a unique account identifier. We do not receive your Microsoft or Google password.
Usage and log data: when you use the platform, we process IP address, device and browser information, login times, activity logs (for example which actions were performed in the workspace and when), error reports and security events.
Customer content: this includes everything you or your organisation upload to or process with eokit, as well as content from external services you choose to connect, such as Microsoft 365 and SharePoint, Google Workspace and other supported integrations. When you connect such a service, you authorise eokit to access it within the permissions you grant. We then access and process the files and data we find there to provide the Services. We store the access credentials (tokens) for connected services in encrypted form. You can disconnect a service at any time in your settings or by revoking access in the respective service, after which we no longer access it.
Chat messages: when you use the chat function, we process the messages, files and reactions you exchange with AI agents and with other users in your workspace, together with the time they were sent and the participants. Messages are visible to the participants of the conversation and, depending on your organisation's settings, to its workspace administrators. Where an AI agent takes part in a conversation, the messages are processed by the AI models described in this policy.
Search index: to answer requests faster, we index content from connected services such as SharePoint and email. This includes creating embeddings, which are machine-readable representations of the content. The index may contain personal data that appears in this content. It respects the access permissions of the source system, so each user can only find content they can access there. Changes and deletions in the source are reflected in the index continuously. The index is stored on our platform's infrastructure, and embeddings are created by the AI models hosted in Germany or Luxembourg described below.
Virtual desktop: each user has a virtual desktop in an isolated environment that AI agents can use to carry out tasks, including accessing websites on the internet. We process the files, application data and activity in this environment. When an agent accesses a website, that website receives the data the agent transmits to it, as well as technical data such as the IP address of our infrastructure. The website operator's own privacy practices apply to it.
Billing data: billing address, company and VAT details, invoices, payment method and payment status. Card payments are processed by our payment service provider Mollie. We do not store your full card details ourselves. Alternatively, you can pay by bank transfer, in which case we process the bank details shown on your transfer.
Communication and support data: when you contact us by email or through our support ticket system, we process your name, contact details, the content of your request and our correspondence with you.
Newsletter data: if you subscribe to our newsletter, we process your email address and, where provided, your name, as well as the date and proof of your consent.
eokit uses AI models to analyse and work with customer content. These models are hosted in Germany or Luxembourg by the following infrastructure providers: Mixvoip, Infercom, MeluXina and Gcore. Content sent to these models is processed only to deliver the requested result to you. External AI models are used only if the customer allows them. Unless the customer allows them, content is not sent to any other AI provider.
We never use customer content to train or fine-tune AI models, neither our own nor those of third parties.
eokit does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. AI outputs are suggestions and analyses that you review and act on.
We process personal data for the following purposes and on the following legal bases.
On eokit.com we only use cookies and similar technologies that are strictly necessary to operate the website and platform, such as session cookies that keep you logged in and security cookies. These do not require consent. Our analytics tool is used in a privacy-friendly configuration. If we ever introduce non-essential cookies, we will ask for your consent beforehand and update this policy.
We share personal data only to the extent necessary for the purposes described above, and only with recipients bound by appropriate contractual and confidentiality obligations. Our service providers act as processors on our behalf under data processing agreements in accordance with Article 28 GDPR.
Hosting: the eokit platform is hosted by hosting.de GmbH in Germany. The servers are currently rented through PEWEO SARL, Luxembourg, which provides them to us as a service provider. Business customers may alternatively operate eokit on-premise on their own infrastructure, in which case their data remains on systems they control.
AI infrastructure: Mixvoip, Infercom, MeluXina and Gcore, each hosting AI models in Germany or Luxembourg. Providers of external AI models only where the customer allows them.
Payments: Mollie B.V., Netherlands, for card payments. Mollie acts as an independent controller for certain processing required by financial regulations. Please also refer to Mollie's own privacy statement.
Single sign-on: Microsoft and Google, when you choose to sign in with them.
Email delivery: a service provider that sends our transactional emails (for example magic links, notifications and invoices) and our newsletter.
Email and office communication: Microsoft Ireland Operations Limited, Ireland, provides our business email and office tools (Microsoft 365). Emails you send us, including support and privacy requests, are processed on Microsoft's systems. Microsoft stores this data in data centres within the European Union.
Support: our support ticket system (osTicket) is hosted on infrastructure provided by Steffen Holzbau S.A.
IT service providers: external IT service providers that support us in software development, operations and customer support and may have access to personal data for these purposes. These providers are contractually bound to protect personal data to at least the same standard as described in this Privacy Policy. In particular, they may process personal data only on our documented instructions and only for the purposes set out here. They must keep the data confidential, apply technical and organisational security measures equivalent to our own, and support us in responding to your data protection requests. They may not use the data for their own purposes or pass it on to third parties without our prior approval.
Analytics: a privacy-friendly analytics provider.
Contact form: Web3Forms (web3forms.com), which receives messages sent through our contact form and forwards them to us by email.
Fonts: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which provides the fonts of eokit.com through Google Fonts and receives your IP address when they are loaded.
Professional advisers and authorities: lawyers, auditors and tax advisers, and public authorities where we are legally required to disclose data.
We do not sell your personal data.
We process personal data primarily within the European Union. AI processing takes place in Germany or Luxembourg (external AI models only where the customer allows them), and hosting takes place in Germany or on-premise with the customer.
Some of our IT service providers are located outside the European Economic Area, countries for which no adequacy decision of the European Commission exists. We safeguard these transfers with the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), under which these providers are bound to a level of data protection at least equivalent to the one described in this Privacy Policy and required by the GDPR. We also apply additional technical and organisational measures, such as limiting access to what is strictly necessary for each task, logging access and requiring confidentiality from all personnel involved. You can request a copy of these safeguards at privacy@aigentcy.lu.
Microsoft, our provider of business email and office tools, stores our data within the European Union. In limited cases, for example for technical support or security operations, data may be accessed from or transferred to the United States. Such transfers are covered by Microsoft's certification under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR), and additionally by the EU Standard Contractual Clauses.
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encryption in transit and at rest, encrypted storage of access tokens for connected services, role-based access controls, logging of access, and regular review of our security measures. No system is completely secure, but we work continuously to keep risks as low as possible.
Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have your data deleted, to restrict processing, to data portability, and to object to processing based on our legitimate interests. Where processing is based on your consent, you can withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, please contact us at privacy@aigentcy.lu. We may ask you to verify your identity before we respond. Where we process data as a processor on behalf of a business customer, we will forward your request to that customer and support them in responding.
You also have the right to lodge a complaint with a supervisory authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, https://www.cnpd.public.lu/. You may also contact the supervisory authority in your country of residence or place of work.
eokit is offered exclusively to businesses and is intended for use by persons acting on behalf of a business who are at least 18 years old. We do not knowingly process personal data of persons under 18. If you believe that a person under 18 has provided us with personal data, please contact us at privacy@aigentcy.lu and we will delete it.
You are not legally obliged to provide personal data. However, without certain data, such as your email address and billing details, we cannot create an account or provide the Services.
We may update this Privacy Policy when our Services, our service providers or legal requirements change. The current version is always available on eokit.com, with the date of the last update shown at the top. If we make material changes, we will inform registered users by email or within the platform.
Écrivez quelques lignes et nous revenons vers vous.
Bonjour, je suis eo
Je vis dans eokit et j'aide votre équipe à trouver, écrire et agir. Touchez-moi quand vous voulez pour vous orienter.
