GDPR & EU AI Act
Compliance

Part I — GDPR Compliance

Controller & Processor Roles

Pentabeam d.o.o. acts as a data processor when processing your company's project data on your behalf. You, the contracting company, act as the data controller for personal data contained within your project documents, invoices, and email threads.

Pentabeam d.o.o. acts as a data controller for account registration data and usage analytics of the platform itself.

Lawful Basis

All processing activities are grounded in one of the six GDPR lawful bases (Art. 6). Processing of special category data (Art. 9) is not performed by default. Our full Records of Processing Activities (RoPA) is available upon request.

Data Minimisation

We ingest only the project documents necessary to deliver the contracted services. We do not require or process health, biometric, or criminal record data. Access to ingested data is restricted to the relevant customer account and to Pentabeam staff with a need-to-know basis.

Subprocessors

Current subprocessors operating within the EEA:

• Cloud hosting — EU-based infrastructure provider (contract includes Art. 28 clauses).
• Email integration — IMAP/OAuth connector, data processed transiently and not stored by the subprocessor.

Customers are notified of any new subprocessor at least 14 days before engagement. A full subprocessor list is provided in the Data Processing Addendum.

Data Subject Rights

As processor, Pentabeam will assist you (the controller) in fulfilling data subject rights requests within 5 business days. Requests under Art. 15–22 should be directed to tej.huc@pentabeam.com.

Data Breach Notification

In the event of a personal data breach, Pentabeam will notify the affected customer without undue delay and within 72 hours of becoming aware, as required by Art. 33 GDPR. Notification will include: nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken.

Data Protection Officer

Given our current size, appointment of a formal DPO is not mandatory under Art. 37 GDPR. All data protection inquiries are handled directly by our founding team at tej.huc@pentabeam.com.

Part II — EU AI Act Compliance

Risk Classification

Pentabeam AI is classified as a Limited Risk AI system under the EU AI Act (Regulation (EU) 2024/1689), as it does not fall within the high-risk categories defined in Annex III. Specifically:

• We do not make autonomous decisions that produce legal effects on natural persons.
• Construction cost analysis and invoice checking are business process tools operated under human oversight.
• No biometric identification, critical infrastructure control, or employment screening is performed.

Transparency Obligations

Consistent with Art. 50 of the EU AI Act, Pentabeam informs users when they are interacting with AI-generated outputs. All AI summaries, gap detections, and dispute packs are clearly labelled as AI-assisted and require human review before action is taken.

Human Oversight

Every Pentabeam AI output is presented as a recommendation or flag, not an autonomous decision. The Construction Director or relevant team member is always the decision-maker. No invoice is disputed, no BoQ gap is escalated, and no change order is formalised without explicit human approval.

Data Governance for AI

• Each customer receives a dedicated AI model trained solely on their own project data.
• Cross-customer training is contractually prohibited and technically enforced.
• Training data lineage is logged and auditable.
• Models are retrained only with customer consent and on customer-provided data.

EU AI Act Compliance Pack

Enterprise customers receive a full EU AI Act Compliance Pack including: system card, training data documentation, performance metrics, and instructions for use. Contact tej.huc@pentabeam.com to request the pack.