Legal · Legitimate-interest disclosure

Why we contacted you.

You're seeing this page because CloakAPI sent you an outreach email under Article 6(1)(f) of the EU GDPR — our legitimate interest in informing organisations that publicly demonstrate they use Large Language Models on regulated data, and have a corresponding compliance obligation.

GDPR Art. 6(1)(f) · Controller: CloakAPI AS, Org no. 933 720 411 (Norway)

Our balancing test, in plain English

We restrict outreach to organisations whose public statements (job adverts, regulator registers, statutory filings) indicate they run LLMs in production and fall under at least one of: GDPR Art. 32, DORA Art. 28, EU MDR Art. 14, NIS2 Art. 21, or the EU AI Act Art. 10. We do not contact private individuals and we do not enrich behavioural data.

Your rights

You can opt out with a single click via the link in the email you received, or by emailing dpo@cloakapi.io. We honour suppression across email and onboarding. If you object to processing, we erase your personal data within 30 days and confirm by email.

What data we hold about you

Until you reply, the data we hold is limited to: your work email address, your organisation's name and jurisdiction, the public evidence of LLM use (cited by source), and a campaign-target slug for tracking which message you received. We do not hold IP-tracked browsing history, behavioural data, or social profiles.

Data protection officer

Our DPO is reachable at dpo@cloakapi.io and answers data-protection enquiries within five working days.

DPIA

The data-protection impact assessment for this campaign is filed at docs/dpia/wave1-campaign.md in our repository and is provided on request to any data subject or competent supervisory authority.

Related documents