How we handle data, security and AI.
What we do with your data, where it is processed, the rules our team and our AI agents follow, and the public commitments we are making.
NoticeLists marked “before launch” are being completed and reviewed by a lawyer.
GDPR by default.
We collect only what we need to answer you and to deliver the work.
Minimal forms
The project brief asks only for what we need to reply. Requests go to kontakt@t-matrix.net.No tracking cookies
This website sets no advertising or tracking cookies. It keeps only two settings in your browser: the language you chose and whether you have seen the intro.Your rights
Access, correction, deletion and objection. Write to kontakt@t-matrix.net and we reply within one business day.Learn moreProcessing agreements
For client projects and our products we sign a data processing agreement (DPA / AVV) under GDPR Art. 28.
EU first.
We prefer services that process data in the EU. Where a service is outside the EU, we name it and the legal basis for the transfer.
| What | Where |
|---|---|
| HyperSale AI features | OpenAI API, EU data processing endpoint. Your own company name and website are masked before each AI call. |
| Website, e-mail, Stellwerk | Providers and regions are listed before launch. |
Rules for people and agents.
No secrets in AI tools
Passwords and keys never go into an AI tool, prompt or chat. Agents get scoped keys from the environment.Masking
Names, e-mails and IBANs become placeholders before data leaves for a cloud AI model (Stellwerk Mask).Human approval
Deploys, payments and outgoing mail by an agent wait for a person (Stellwerk Guard).Review before release
Code is reviewed by a second person, texts and media by the person responsible.
What may go into which AI model.
Our AI policy sets these data classes for everyone who works for T-Matrix, people and agents. The full policy is being finalised and will be published here.
| Data | Examples | Allowed AI use |
|---|---|---|
| Public | Published texts, public company information | Any approved AI service |
| Internal | Internal notes, non-sensitive code, plans | Approved services under business terms, EU processing preferred |
| Client and personal data | Client documents and code, names, e-mails, phone numbers | Only under a data processing agreement, or after masking |
| Special data | Health data, data under professional secrecy | Only with written approval for the case, EU-hosted, always masked |
| Secrets | Passwords, API keys, tokens | Never sent to any AI model |
Masked data is still personal data under the GDPR, and we treat it that way. The policy also covers AI literacy training for the whole team (AI Act, Art. 4) and how we label AI-generated media.
Subprocessors and DPA.
Subprocessors
before launchThe full list of services that process data for us, with purpose and location.DPA / AVV
before launchOur data processing agreement for client projects and products, to download.
In progress: EU AI Pact and the Code of Practice.
We are preparing to join the EU AI Pact and to sign Section 2 of the EU Code of Practice on transparency of AI-generated content. Both are voluntary.
EU AI Pact
in progressThree core pledges: an AI governance strategy, a map of our AI systems with their risk class, and AI training for our team. Plus labelling of deepfakes and human oversight.Code of Practice, Section 2
in progressVisible labels on deepfakes from the first view, EU icons for AI-generated content and a log of what was labelled and how.
Once we appear on the official lists, we will say so here with a link to the European Commission's page, so you can check it yourself.