UK GDPR & AI Marketing FAQ — Michailidou Digital Services

Question 1

What does UK GDPR mean for AI marketing tools?

Accepted Answer

UK GDPR Art. 5–32 + the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). Specifically: processor agreements, data minimisation, storage limitation, right to access/delete, privacy-by-design. For AI tools additionally: transparency about training-data use and inference-model location.

Question 2

Where is my marketing data stored?

Accepted Answer

Concrete component listing: application via Vercel FRA1 (Frankfurt), database via Supabase EU (Frankfurt, eu-central-1), file storage via Hetzner FSN1/NBG1 (Falkenstein/Nuremberg), AI inference via Anthropic (EU region where available, US-east fallback with Standard Contractual Clauses / the UK IDTA). EU↔UK adequacy keeps this EU-hosted setup lawful for UK clients.

Question 3

Is my data used to train the AI?

Accepted Answer

No. The Anthropic Enterprise Terms (commercial tier) contractually guarantee that customer data is excluded from training pipelines.

Question 4

How does the DPA (Data Processing Agreement) work?

Accepted Answer

Standard DPA under Art. 28 UK GDPR with Michailidou Digital Services I.E. (registered office: Tbilisi, Georgia; legal form: Individual Entrepreneur) as Processor. As the Controller is established outside the EU/EEA, an EU Representative under Art. 27 GDPR has been appointed (Admir Xhoxha, Peristeri/Greece). Sub-processors are listed in Annex 3. Signature via email (PDF with qualified electronic signature accepted).

Question 5

Which sub-processors are involved?

Accepted Answer

Vercel Inc. (application hosting, Frankfurt/DE), Supabase Inc. (database + auth, Frankfurt/DE), Anthropic PBC (AI inference, EU+US with SCCs / UK IDTA), Hetzner Online GmbH (file storage, Falkenstein-Nuremberg/DE), Resend Inc. (transactional email, EU/Ireland), Fly.io (worker compute, EU-Frankfurt), Stripe Inc. (payment processing, EU+US with SCCs / UK IDTA), Google Ireland Ltd. (Calendar/Analytics, only with active consent).

Question 6

How long is my data stored?

Accepted Answer

Active customers: data is stored as long as the contractual relationship exists. After contract end: 30 days soft-delete for complaints/re-activation, then hard-delete with written deletion confirmation per DPA. Logs: 14 days. Invoices/accounting records: 6 years (UK Companies Act 2006 / HMRC record-keeping requirements).

Question 7

What tracking does this website itself use?

Accepted Answer

Google Tag Manager and Google Analytics 4 with Consent Mode v2 (see Privacy Policy section 7.2). Pre-consent: only server-side aggregated page views, no user identifier. Post-consent: standard GA4 with IP anonymisation. Cookie banner based on PECR Regulation 6 (UK) and UK GDPR Art. 6(1)(a).

Question 8

Can I export or delete my data?

Accepted Answer

Access (UK GDPR Art. 15): JSON export of all customer-side data via email request to info@michailidou-services.de, processing time max. 30 days (legal limit per Art. 12(3)). Deletion (Art. 17): soft-delete immediately, hard-delete within 30 days, written deletion confirmation thereafter.

Question 9

What happens in case of a data breach?

Accepted Answer

Five-stage incident-response process: (1) Detection via logging and Supabase audit logs. (2) Containment within 4 hours. (3) Notification to affected customers within 24 hours via email. (4) Notification to the competent supervisory authority within 72 hours — for UK data subjects to the ICO (Information Commissioner's Office) under UK GDPR Art. 33; for EU data subjects via the Art. 27 EU Representative at the Hellenic Data Protection Authority (HDPA); for national Georgian obligations at the Personal Data Protection Service of Georgia (PDPS). (5) Post-mortem report within 14 days.

Question 10

Why 'EU data residency' and not 'German servers'?

Accepted Answer

Three components have EU data residency (Vercel FRA, Supabase EU Frankfurt, Hetzner Germany), one has EU-preferred with US fallback (Anthropic AI inference). The phrasing 'EU data residency' is GDPR-precise — 'German servers' as a blanket claim would be misleading given the Anthropic component.

Question 11

How is the cookie consent banner structured (PECR Regulation 6)?

Accepted Answer

The banner shows three categories: strictly necessary (always active), analytics (opt-in), marketing (opt-in). Default is denied. Stored as JSON object in localStorage. Granularly revocable via footer link 'Cookie settings'. Implementation: Google Consent Mode v2 with `wait_for_update: 500ms`.

Question 12

Is a cookie banner required for marketing cookies?

Accepted Answer

Yes, per PECR Regulation 6 (UK) for all non-essential storage/access on the end-user device, with consent meeting the UK GDPR standard. Exception: technically required cookies (session, consent storage itself). Marketing cookies like GA4, Meta Pixel or LinkedIn Insights fall under the consent obligation.

Question 13

How does the tool relate to PECR and the upcoming UK reform?

Accepted Answer

PECR is the UK's cookie/e-marketing law (the UK pendant to the EU ePrivacy regime). It is being reformed by the Data (Use and Access) Act 2025 — key data-protection/PECR provisions came into force on 5 Feb 2026 (e.g. new low-risk exemptions and PECR fines raised to UK GDPR levels). The current PECR-compliant implementation stays aligned; update commitment: re-audit within 90 days of any further PECR/DUAA change.

Question 14

What RPO/RTO applies in a data incident?

Accepted Answer

RPO (Recovery Point Objective): max. 24 hours — daily Supabase backups with Point-in-Time Recovery for the last 7 days. RTO (Recovery Time Objective): max. 4 hours for application restore plus 8 hours for data restore from PITR. Disaster recovery test semi-annually.

Privacy, clearly documented.

EU Data Residency

DPA Contracts

Transparent AI Inference

Anti-Tracking by Default

Open-Source-First

Frequently Asked Questions

A. Fundamentals

B. Contracts & Processes

C. Tool Behaviour

D. Incidents & Locations

E. Advanced Topics

DPA + Sub-Processor List

MDS DPA template (template, DE)

Sub-processor list (DE)

Provider DPAs (external)