Is an AI sales tool GDPR-compliant?
Short answer
You can use an AI assistant on your sales mailbox in line with the GDPR if you have a data processing agreement with the provider, know where the data is stored and who processes it, and the AI receives only the text needed for the task. BOTrento stores data on servers in the EU (Germany, with the app database in Ireland), calls the language model via a commercial provider's API that does not use the data for training, and sends nothing without a person's approval.
What the GDPR is concerned with when you use AI in sales
An enquiry contains personal data: a name, email address, phone number and sometimes details of the job. You may reply to it, because these are steps taken at the customer's request before entering into a contract. But once an external AI tool handles your enquiries, its provider becomes your processor, and you need to know who it is, where it stores the data and whom it passes it to.
Checklist before you start
- A data processing agreement with the tool's provider.
- Where data is stored and the list of sub-processors, including the language-model provider.
- Whether the model provider uses the data for training (commercial APIs usually don't, but check the terms).
- Minimisation: the language model receives only the text needed for the specific task.
- Human oversight: who approves what goes out to the customer.
- Export and deletion: how you get your data back and how it is deleted when the service ends.
- Records of processing and your privacy notice: add the new tool to both.
An EU server is not the whole story
A common mistake is “the data is in the EU, so we're covered”. A server in the EU calling an external AI API is not a closed computation. The text needed for a task is processed by the language-model provider. That is why you need to know which model provider the tool uses and on what terms.
How BOTrento handles it
We store data on servers in the EU (Germany, with the app database in Ireland). The language model processes only the text needed for the task, via a commercial API provider — by default through our account, optionally through your own API key; commercial API providers do not use this data for training.
We process the data you connect to the service as a processor, on your instructions and under a data processing agreement. Nothing is sent without your approval. On request we export or delete your data.
This page is a practical overview, not legal advice. For sensitive data or a specific industry, consult a data protection specialist.