Privacy Policy

INSTRAT360 provides governed AI software and services for enterprises. We are registered in Denmark (CVR 36912758) at Sønderbakken 8, 2820 Gentofte, Denmark, and operate within the European Union. This policy explains how we handle personal data across our website and, where applicable, our products.

For our products, the customer organization is typically the data controller and INSTRAT360 acts as a data processor under a written data processing agreement. For our website and direct marketing, INSTRAT360 acts as the controller.

Website: contact details you submit (such as name, email, and message), and standard technical data needed to operate and secure the site.

Products: the content and account data your organization chooses to process, governed by your agreement with us. AI interactions and approvals are logged with their author and rationale as part of the audit trail.

To respond to enquiries, provide and secure our services, meet legal obligations, and improve the product. We do not sell personal data.

AI-assisted outputs are identified as such and kept distinct from verified facts. Consequential actions require human approval; AI does not act autonomously on your behalf.

We rely on legitimate interest for operating and securing our website, consent where required for marketing, contract performance for delivering services, and legal obligation where the law requires retention.

We share personal data only with vetted subprocessors needed to run the service, under contract and appropriate safeguards. A current subprocessor list is available to customers on request through the Trust Center.

Where data leaves the EU/EEA, we apply recognised transfer mechanisms and additional safeguards.

Personal data is held in the EU with tenant isolation and role-scoped access. Retention for chats, files, memory, and outputs is explicit and, for products, configurable by the customer.

You can request export, correction, or deletion of personal data, and customers can delete a workspace with confirmation.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. You also have the right to lodge a complaint with your supervisory authority (in Denmark, Datatilsynet).

To exercise any of these rights, contact us through the channel below and we will respond within the timeframes required by law.

We apply a NIS2-aligned security baseline: encryption in transit and at rest, strong authentication, dependency and vulnerability management, protected audit logs, and tested backup, restore, and incident-response processes, including a tested 72-hour breach-notification process.

For any privacy question or data subject request, use the contact option below and mark it for the attention of our data protection function. We will route it to the right team.