AI agents and GDPR in Belgium: what to check before signing
When a Belgian company deploys an AI agent that processes personal data, it remains the controller, and the provider acts as processor. Three documents are then mandatory: a processing agreement under Article 28 GDPR, the list of sub-processors the provider relies on, and a legal basis for transfers outside the European Union, usually standard contractual clauses. At Flows Studio, storage of conversations and knowledge bases is entirely European, 14 sub-processors are published in an up-to-date register, and any change is published there and notified to clients under contract. The competent authority in Belgium is the Data Protection Authority.
Who is responsible for what
This is the question that governs all the others, and it is settled in one sentence: whoever decides why and how data is processed is the controller. For an agent deployed on your website, that is you.
- You are the controller. You decide to put an agent online, what it collects and how long it is kept. Data subjects address you, and you answer to the authority.
- The provider is the processor. It processes data on your behalf, only on your instructions, within the written scope of the contract. It cannot reuse it for its own purposes.
- The provider’s own vendors are sub-processors. Hosting, model provider, delivery service: each must be covered by an equivalent contract and disclosed to you.
A provider refusing to sign a processing agreement, or unable to name its own vendors, puts you in breach without you doing anything. That is the first checkpoint, before any technical discussion.
What data an agent processes, and where it goes
A conversational agent processes less data than people fear, but it is sensitive by nature: these are messages written spontaneously by people, who sometimes put more into them than needed.
- The content of the messages exchanged, including whatever the visitor volunteers without being asked.
- Contact details deliberately provided in an enquiry or a quote request.
- Technical data used to operate the service and limit abuse, unrelated to the visitor’s civil identity.
With us, storage of all of this is European. The public sub-processor register, in force as of 03/09/2026, sets out the exact list, provider by provider.
| Sub-processor | Role | Location |
|---|---|---|
| Samuel Baudon (SQWR Studio) | Design, technical hosting and operation of the agents on behalf of the Processor | Belgium (Uccle) |
| Anthropic PBC | Language model: classification, drafting, replies | United States |
| Supabase | Database and storage of content and metadata | Paris and Ireland, European Union |
| Vercel | Application runtime for the agents | European Union (Paris) since the regional pinning of 12 August 2026, provider global network for page delivery |
| Composio | Authorised connector to the Controller’s mailbox (email agents only) | United States (Northern Virginia) |
| Resend | Delivery of service notifications | United States |
| PostHog | Product analytics. No message content | European Union (PostHog Cloud EU) |
| OVH | Outbound campaign mail server (B2B prospecting agents only) | France |
| Hetzner | Execution of the scheduled tasks of outbound campaigns (B2B prospecting agents only) | Germany (Gunzenhausen) |
| Apify Technologies s.r.o. | Extraction of public business contact details feeding the campaigns (B2B prospecting agents only). No conversation content | Czechia, European Union |
| Apollo.io (Apollo Data Inc.) | B2B business data provider, source of the contact details imported into the campaigns (B2B prospecting agents only). Controller of its own database, not selected by the Controller | United States |
| GitHub | Code repository and scheduling of planned tasks. No message content | United States |
| Google Ireland Limited, Meta Platforms Ireland Limited | Advertising platforms: campaign delivery, conversion measurement and audience building (paid media agents only). Joint controllers with the Controller within the meaning of Article 26 | Ireland, European Union |
| Google Workspace, Meta | Hosting of the Controller’s mailbox or social account, depending on the agent channel | Per the Controller’s own contract |
Table generated from the Flows Studio public sub-processor register, the same source Annex 3 of our processing agreements refers to. Not every line concerns every agent: those marked “email agents” or “B2B prospecting” do not apply to a conversational agent. Version in force as of 03/09/2026.
The sensitive point: transfers to the United States
This deserves to be stated plainly rather than buried. Storage of conversations and knowledge bases is European, but generating the answers involves a model provider established in the United States. There is therefore a transfer, and it has to be covered.
- The transfer relies on the European Commission standard contractual clauses, together with a transfer impact assessment provided on request.
- Content sent to the model provider is not reused to train a model, and its logs are deleted within seven days.
- No data is durably stored outside the European Union: what leaves does so for the duration of the computation, not to be kept.
Six checks before signing
- Is a written processing agreement offered, with the Article 28 clauses, or do you have to ask for it?
- Is the list of sub-processors public and dated, or disclosed case by case on request?
- Are sub-processor additions published and notified, and can you object to them?
- Where are conversations stored, and where are they computed? The two answers can differ.
- How long is data kept, and what happens to all of it at the end of the contract?
- How is an access or erasure request handled technically, and within what timeframe?
Our own answers are public: the register is online, dated and versioned, any addition is published there and notified to clients under contract, who may object on legitimate grounds. The agreements signed with each provider and the detail of the security measures are provided to any client who asks.
What you must display to visitors
Two distinct obligations add up here, and they do not come from the same text.
- The GDPR requires informing people about the processing: its purpose, its duration, the recipients, and how to exercise their rights. A privacy policy reachable from the chat window is enough, provided it actually mentions the agent.
- The European AI Act requires, since 2 August 2026, that a person knows they are dealing with an AI system, unless it is obvious. An agent introducing itself as an automated assistant in its first message meets that obligation without adding any friction.
Both points are cheap to respect and expensive to ignore. Above all they assume an agent never passes itself off as a human, which matches a rule we apply anyway.
Is a data protection impact assessment required to deploy a chatbot?
Rarely for a standard information agent, but the question deserves to be asked rather than waved away. An impact assessment becomes necessary when the processing presents a high risk to individuals: systematic profiling, sensitive data such as health, large-scale monitoring. An agent answering about opening hours and prices falls into none of those. An agent deployed by a medical practice, a social service or a debt collection service may well qualify, because the messages received will contain sensitive data even without asking for it. Our position is simple: we flag the doubt when it exists, and the final judgement belongs to your counsel or your data protection officer.
Are conversations used to train an artificial intelligence model?
No, and that is contractual at two levels. Our processing agreement forbids us from using client data for our own purposes, and training a model is one of them. The agreement signed with the model provider forbids, on its side, reusing transmitted content for training, and provides for its logs to be deleted within seven days. This is an important difference with using a consumer assistant in a browser, where the default terms may well allow that reuse. If you deploy an agent in a business context, this clause belongs to the three or four points to verify explicitly in the contract before signing anything at all.
What happens if a visitor asks for their data to be erased?
The request is addressed to you as the controller, and we carry it out on your behalf as the processor. In practice, the conversation and the contact details attached to it are deleted from the database, including from backups as their rotation cycle allows. The practical difficulty is identification: the exchanges of that person have to be found without deleting anyone else’s, which assumes the request contains something linking it to a conversation. The same mechanism serves an access request. These operations are part of the service and are not billed separately, they are an obligation rather than an option.
Can everything be hosted in Belgium or in Europe only?
Storage, yes, and that is already the case: conversations and knowledge bases sit inside the European Union. Computation is another matter. The best performing language models today are operated by providers established in the United States, and a strictly European execution means switching to a European or self-hosted model, with lower answer quality and a higher cost. That trade-off exists and we look at it case by case, in particular for a regulated sector that demands it. For most deployments, European storage combined with a transfer covered by standard contractual clauses remains the right balance.
Agents covered on this page
Each page details the deployment, the pricing and a live demonstration.