Skip to content

Data protection & security

The AI sees answers. No master data.

Standard models are powerful – but not built for sensitive data. Kolloqo is set up for surveys involving sensitive data.

  • Azure OpenAI.
    Sweden Central, EU.

    Processing takes place in the EU.

  • No training
    with your data.

    Answers are not used to train the models.

  • DPA under Art. 28 GDPR.
    TOMs on request.

    EU standard contractual clauses

Standard AI or Kolloqo

A standard chat sees everything. Kolloqo only sees answers.

In every area of use, Kolloqo processes data that requires special protection. That is exactly what the architecture was built for.

Kolloqo

Master data kept separate

Only the answer text

↓ Azure OpenAI · Sweden Central (EU)

Illustrative example

Data flow

Your master data stays. Only the answer text travels.

This is how an answer moves through the system – from the conversation to the report.

  1. Step 1 of 4

    Name and contact details stay behind.

    Master data (name, age, contact details) is never sent to the language model. The AI only processes the answer texts.

  2. Step 2 of 4

    The answer text goes to Sweden – within the EU.

    Processing takes place in the EU (Microsoft Azure, Sweden Central region).

  3. Step 3 of 4

    What comes back: a score and its reasoning.

    Every score comes with documented reasoning, citing specific passages.

  4. Step 4 of 4

    This becomes the report.

    The AI prepares. People interpret.

Safeguards

Seven safeguards apply to every interview.

Technical and contractual – from the first word to the finished report.

  • Separation of personal data

    Master data never sent to the language model

  • No link to the individual

    The AI only sees answer texts

  • EU hosting (Azure Sweden Central)

    Processing in the EU

  • No training on your data

    Not used for training

  • Fully auditable

    Every score with reasoning

  • DPA (data processing agreement)

    Under Art. 28 GDPR, on request

  • Transparency under the EU AI Act

    No emotion recognition, no biometric analysis

  • Separation of personal data. Master data (name, age, contact details) is never sent to the language model. The AI only processes the answer texts.
  • No link to the individual. The AI receives only the answer texts – without names or master data.
  • EU hosting (Azure Sweden Central). Processing takes place in the EU (Microsoft Azure, Sweden Central region).
  • No training on your data. Answers are not used to train the models.
  • Fully auditable. Every score comes with documented reasoning, citing specific passages.
  • DPA (data processing agreement). DPA (data processing agreement) under Art. 28 GDPR, EU Standard Contractual Clauses and technical and organisational measures (TOMs) on request.
  • Transparency under the EU AI Act. No emotion recognition, no biometric analysis. The AI does not make personnel decisions. The legal assessment of the specific use lies with the controller.

For specialists

Every detail is documented.

Technology, contracts and the EU AI Act – complete, for your specialists.

Master data (name, age, contact details) is never sent to the language model. The AI only processes the answer texts. Master data is kept in a separate data layer; the separation takes place before any processing – not afterwards.

Provider: Microsoft Azure OpenAI Service. Server location: Sweden Central (Sweden, EU). Azure OpenAI is an EU Data Boundary service – customer data is stored and processed within the EU/EFTA.

Every score in the report comes with documented reasoning, citing specific passages from the interview. The system records which statements led to which score, the confidence of the scoring and the complete course of the conversation. Who has access to it is agreed per project.

DPA (data processing agreement) under Art. 28 GDPR on request. Microsoft Data Protection Addendum (DPA). EU Standard Contractual Clauses (SCCs, Module 3 processor-to-processor). EU-U.S. Data Privacy Framework certification. TOMs in accordance with ISO 27001, 27002 and 27018.

No emotion recognition, no biometric analysis. The AI does not make personnel decisions. AI-generated content is labelled as such. Customer data is encrypted at rest and in transit. The controller within the meaning of the GDPR is the respective customer; IR&C acts as processor. The legal assessment of the specific use lies with the controller.

  • Insider risks & compliance. Participants report security breaches, suspicious behaviour and compliance risks. This data is operationally sensitive – a data leak would be a security incident.
  • Psychological strain. Employees describe overload, conflicts and health limitations. This is health data requiring special protection under Art. 9 GDPR.
  • Criticism of leadership & team dynamics. Open feedback on managers and colleagues. Without a guarantee of confidentiality, nobody tells the truth – without protection, nobody names names.
  • Aptitude & potential assessments. Candidates share personal strengths, weaknesses and motivations. This data influences career decisions – and must be protected accordingly.

Questions about data protection & security?

We’ll provide the DPA (data processing agreement) under Art. 28 GDPR, technical and organisational measures (TOMs) and all relevant documentation. Get in touch.

Book a call