GDPR and AI Sales Tools: 7 Questions to Ask a Vendor Before You Sign

BOTrento Team11 October 2026 · Updated 12 October 20269 min read

Why the vendor's answers matter to you

When an AI tool reads your enquiries, quotes and sales emails, it handles personal data. That includes names, email addresses and phone numbers, and sometimes details about a customer's event, budget or premises. Under GDPR you're usually the controller and the vendor is your processor. It's your responsibility to choose a processor that can protect the data properly, so you need to see how it does that.

AI tools add another layer. Most of them don't run the language model themselves. They send text to a model provider through an API. So there are two places you need to understand: where the data is stored and where the model processes it. We explain the difference in detail in Where is your data when you use AI?

The 7 questions to ask before you sign

1. Will you sign a data processing agreement, and can I read it now?

Ask for the DPA before the trial ends, not after you've paid. Check that it says what data is processed and for what purpose, which security measures are in place and what happens when the contract ends.

Good answer: a document you can read and send on to your lawyer. Red flag: "it's covered in our terms" and nothing more specific.

2. Where is my data stored, and where does the AI model process it?

"We're hosted in the EU" only answers half the question. Ask which country the servers are in, who the model provider is and how text gets to that provider.

Good answer: named storage locations, a named model provider and an honest statement that calling an external AI API isn't a closed system. Red flag: a blanket promise that everything stays in the EU, with no mention of the model provider.

3. Who are your sub-processors, and how will you tell me about changes?

Hosting, the database, email delivery and the model provider are all sub-processors. Ask for the current list and how you'll be told when it changes.

Good answer: a list showing each sub-processor's role, plus a clear process for notifying you. Red flag: no list, or "we use the usual providers".

4. Is my data used to train any AI model?

This covers the vendor's own models and the model provider's. Ask the question in exactly that form and get the answer in writing.

Good answer: "No, and here's the contractual basis on our side and the provider's." Red flag: vague wording about "improving our services".

5. How long do you keep my data, and what happens when I leave?

Ask how long data is kept while you're a customer, after a trial ends and after you cancel. Ask what you can export and in what format.

Good answer: clear time limits, an export option and an agreed date for deleting copies. Red flag: no export, or no answer about deletion.

6. What does the tool do on its own, and what needs a person to approve it?

This is as much a GDPR question as a sales one. A tool that sends emails, confirms bookings or changes records by itself creates risks that are hard to review. It also links to the transparency and human oversight duties covered in our article on the EU AI Act for small businesses.

Good answer: drafts only, with a person approving every outgoing message. Red flag: "fully autonomous" sold as the main feature.

7. Who can access my data, and how do you handle incidents?

Ask who at the vendor can see your inbox content, how API keys and credentials are stored, how quickly they respond to an incident and how they'll let you know.

Good answer: limited, logged access, encrypted credentials and a stated response time. Red flag: "our whole team can help you inside your account", with no explanation of controls.

Template: email to send to a vendor

Copy this, adjust the first line and send it to every vendor on your shortlist. It's much easier to compare written answers side by side than to compare sales calls.

Subject: GDPR questions before we sign

Hello,

We're considering your tool for handling sales enquiries, quotes and follow-ups. Before we decide, could you answer the following in writing?

1. Can you send us your data processing agreement to review?
2. In which countries is our data stored, and which AI model provider processes the text?
3. Can you share your current list of sub-processors and explain how you notify customers of changes?
4. Is any of our data used to train AI models, either yours or your model provider's?
5. How long do you keep our data during the contract, after a trial and after cancellation? What can we export?
6. Can the tool send messages or change records without a person approving them?
7. Who on your side can access our data, how are credentials stored and what is your incident response process?

Thank you. We'll share your answers with our data protection adviser.

Best regards,
[Name], [Company]

How to score the answers

You don't need a complicated matrix. A simple three-level score for each question is enough to show which vendors are ready for a careful buyer.

Questions 1, 2, 4 and 6 are usually the deal-breakers. A vendor that only partly answers question 7 may still be acceptable after a follow-up. For a borderline case or a sensitive sector, ask a lawyer or data protection adviser to review the DPA. This article is practical guidance, not legal advice.

How BOTrento answers these questions

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-ups. Here are its answers to the seven questions in plain terms:

• Storage: data is stored on servers in the EU (Germany), and the application database is in Ireland.
• Model processing: the language model only receives the text it needs for a task, through a commercial provider's API. By default this runs on our account. You can also use your own API key, currently for Anthropic (Claude) only. Commercial API providers don't use this data for training. An EU server that calls an external AI API isn't a closed system, and we say so openly.
• Less data going in: BOTrento works from the text of your emails and doesn't read the content of attachments.
• Human approval: nothing is sent unless a person approves it. BOTrento prepares draft replies, quotes and follow-ups, but it never sends anything itself and doesn't confirm dates or bookings.
• Credentials: API keys are encrypted, only the last four characters are visible and you can remove a key at any time.
• Incidents: monitoring runs 24/7, and we respond to incidents within 4 hours on working days.
• Leaving: you get an export of your data and outputs, a description of your processes and an agreed date for removing access and copies. When a trial ends without payment, access is blocked until you pay, but data export stays available and we keep your data for 30 days.

The process demo shows what the daily overview and drafts look like. You can also send your own vendor questionnaire to info@botrento.com, and we'll reply within 24 hours on working days. When you're ready to check the answers in practice, start a 14-day free trial on your own enquiries. You don't need a card or your own API key, and the 14 days only start once your first data is uploaded.

After you sign: your side of the deal

A good vendor covers half of GDPR compliance. The other half depends on how you use the tool. Before you connect a mailbox:

1. Add the tool to your record of processing activities.
2. Decide what should never go into it, such as health data or ID scans.
3. Update your privacy notice if you now use AI on enquiries.
4. Agree internally who approves drafts before they're sent.

Our GDPR checklist for enquiries, quotes and sales emails goes through each step. If you work in equipment rental, events or B2B services, the equipment rental page and the events and production page show what a typical set-up looks like. You can compare plans on the pricing page.