Legal
Privacy Policy
Cerebrum B.V. ("Cerebrum", "we", "us") sells private AI workstations and related services. This policy explains what personal data we collect through ai-cerebrum.com, why we collect it, and the choices you have. As a Dutch company we follow the EU General Data Protection Regulation ("GDPR"). For customers in Thailand we also follow Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Who is responsible for your data
Cerebrum B.V. is the data controller for personal data collected on this website.
- Company: Cerebrum B.V.
- KvK number: 78601010
- Address: Windjammerdijk 34, 1086 VC Amsterdam, The Netherlands
- Privacy contact: design@studiocerebrum.com
2. What we collect
- Pilot and contact requests: your name, work email, company, team size, the answers you choose in "Build My AI Workflow", and any message you write.
- Newsletter: your email address, if you sign up.
- Orders: when you buy through Stripe checkout, Stripe collects your payment details. We receive your name, email, phone number, delivery address, optional business name, and the order details. We never see or store your full card number.
- Technical data: our hosting provider automatically records basic information such as IP address, browser type and pages requested, to deliver and secure the website.
- On your device: your shopping cart, language, currency and a few display settings are kept in your browser's local storage. This stays on your device and is not sent to us.
We do not use advertising or tracking cookies, and we do not sell personal data.
3. Why we use it, and our legal basis
- To reply to your request, prepare a proposal and run a pilot: steps you asked for before a contract (GDPR Article 6(1)(b); PDPA section 24(3)).
- To process, deliver, install and support your order: performance of a contract (GDPR Article 6(1)(b); PDPA section 24(3)).
- To send product and model updates: your consent (GDPR Article 6(1)(a); PDPA section 19), which you can withdraw at any time.
- To keep the website secure and prevent fraud: our legitimate interests (GDPR Article 6(1)(f); PDPA section 24(5)).
- To keep invoices and tax records: legal obligations (GDPR Article 6(1)(c); PDPA section 24(6)).
4. Who we share it with
We share personal data only with service providers that help us run the business, and only as needed:
- Netlify, which hosts this website and receives form submissions.
- Stripe, which processes payments.
- Google Fonts, which serves the website's typefaces and receives your IP address when a page loads.
- Delivery, installation and accounting partners, when needed to fulfil your order.
- Authorities, when the law requires it.
5. International transfers
Some of these providers store data outside the European Economic Area, including in the United States, and our team and partners in Thailand may handle orders delivered there. Where data leaves the EEA, we rely on the safeguards the GDPR requires, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, and on the equivalent protections required by the PDPA.
6. How long we keep it
- Enquiries that do not lead to an order: up to 2 years after our last contact.
- Customer, order and support records: for the life of our relationship, plus the period required by tax and accounting law (in the Netherlands, 7 years).
- Newsletter: until you unsubscribe.
7. Your rights
You can ask us to give you access to or a copy of your data, correct it, delete it, restrict or object to its use, move it to another provider, and withdraw consent at any time. Email design@studiocerebrum.com and we will reply within one month. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live; in Thailand, that is the Personal Data Protection Committee (PDPC).
8. How we protect it
We use encrypted connections (HTTPS), reputable providers and limited access to personal data. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and will tell you and the authorities about a breach where the law requires.
9. Data on your Cerebrum workstation
This policy covers ai-cerebrum.com. Company data you process on your own Cerebrum workstation stays under your control, as set out in your proposal and service agreement. Where our team accesses a workstation for setup or support, we do so only as you authorise.
10. Children
Our website and products are for businesses. We do not knowingly collect data from children under 16 (or under 20 in Thailand) without parental consent.
11. Changes
We may update this policy. The latest version is always on this page, with its effective date at the top.