.svg)
Trust Center
pacemaker Solutions GmbH processes customer data as a data processor under Article 28 of the GDPR. Data processing takes place exclusively within the EU/EEA. Customer data is not used to train AI models. We provide additional documentation, such as our data processing agreement or audit reports, upon request.
01 // Certifications
What's behind our platform
Our certifications are independently audited and internationally recognized.
Sustainability
SFC MBM Framework
Normec independently reviewed the pacemaker.ai Book & Claim module and confirmed its conformity with the requirements of the Smart Freight Centre Market-Based Measure Framework.
What this means for you:
The calculation methodology has been externally approved, and the conformity of the calculation basis has already been confirmed. You don't need to review the methodology yourself or have it verified. The reported results still need to be audited.
Sustainability
ISO 14067
ISO 14067 defines how to calculate the carbon footprint of a product across its entire life cycle. From raw material to disposal, following the same methodology and therefore comparable worldwide.
What this means for you:
You get emissions data at the product and material level that holds up under audit and makes targeted decarbonization possible.
Sustainability
ISO 14083:2023
ISO 14083:2023 is the first internationally harmonized standard for calculating greenhouse gas emissions across transport and logistics chains. The standard establishes a common methodology that makes figures from different sources comparable.
What this means for you:
You receive audit-ready CO₂ data based on recognized standards, for CSRD disclosures, ESG reporting, and customer requests.
Automotive Security
TISAX
TISAX stands for Trusted Information Security Assessment Exchange and is the established information security standard of the automotive industry. The aim is to conduct information security assessments once and have them recognized across the ENX network in a standardized way.
What this means for you:
You do not need a separate security assessment during OEM onboarding. Security requirements can be reviewed faster and approval processes shortened considerably.
Information Security
ISO 27001
ISO 27001 is the leading international standard for information security management. The standard describes how companies systematically identify risks, protect data, and have their security measures reviewed on a regular basis.
What this means for you:
Your supply chain and business data is protected according to the highest international standards.
Quality Management
ISO 9001
ISO 9001 is the leading international standard for quality management systems and defines binding requirements for processes, documentation, and continuous improvement.
What this means for you:
You work with a partner whose processes and quality standards are regularly externally audited and certified.
02 // Privacy Policy
Privacy Policy
We process personal data as a data processor under Article 28 of the GDPR.
Legal role
When providing our services, pacemaker Solutions GmbH acts as a data processor under Article 28 of the GDPR. The customer remains the controller responsible for the processing. For its own business purposes (e.g., managing the contractual relationship), pacemaker Solutions GmbH acts as the controller itself.
Data protection officer
Joshua Veeh · Hafenweg 46-48, 48155 Münster, Germany
datenschutz@pacemaker.ai
datenschutz@pacemaker.ai
Data subject requests
Data subject requests (Articles 15 to 22 GDPR) are directed to the controller. If we receive requests directly, we forward them without delay and support the controller in fulfilling them (Article 28(3)(e) GDPR).
Data deletion policy
Once the service agreement ends, personal data is either deleted or returned, as the controller chooses (Article 28(3)(g) GDPR). Deletion follows statutory requirements as soon as consent is withdrawn or the purpose of processing no longer applies. Otherwise, processing is restricted accordingly. Retention and deletion periods for each data category are specified in the data processing agreement.
Third-country data transfers
Data processing takes place in the EU/EEA. Where individual sub-processors are located in third countries, data transfers are based on the EU Standard Contractual Clauses (SCCs). Transfers to the United Kingdom are covered by the European Commission's adequacy decision.
Data breach notification
We notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2) GDPR) and support the controller in meeting the 72-hour deadline for notifying the supervisory authority.
03 // AI-Governance
AI-Governance
No cross-customer model training, tenant isolation, inference within the EU/EEA, and human oversight.
No training on customer data
No cross-customer model training takes place. Training data from multiple customers is never pooled.
Tenant isolation
Customer data is logically separated and processed on a per-tenant basis.
Model providers and inference
Language model inference runs on the Microsoft Azure OpenAI Service within the EU/EEA (EU Data Boundary). Use of data for model training is contractually excluded. Abuse monitoring with data storage and human review is disabled.
Einordnung nach der KI-Verordnung
noch zu bestätigen
Die Einstufung unserer KI-gestützten Module nach Verordnung (EU) 2024/1689 wird derzeit fachlich abgestimmt und hier nach Abschluss veröffentlicht.
Human oversight and usage limits
Forecasts and order recommendations are decision support. Approval and expert review remain with the customer. Intended use requires human oversight.
AI literacy of staff
Employees who develop or operate AI systems receive training in accordance with Article 4 of the EU AI Act.
04 // Data Security
Your data. Our responsibility.
We process sensitive supply chain and business data every day. Information security has been an integral part of our work from the outset.
Annual external audits by accredited auditors
Strict access controls and continuous monitoring
Clear incident response processes
Q
Can competitors see my data?
No. Customer data is logically separated, stored, and processed on a per-tenant basis. No cross-tenant training of AI models takes place. Data from multiple customers is never pooled. Access is strictly role-based and follows the need-to-know principle, with multi-factor authentication for administrative access.
05 // Documents & Verification
Documents & Verification
Contractual documents and audit materials for working with pacemaker.ai.
Data protection
Data Processing Agreement
Data processing agreement under Article 28 GDPR, including the annex on technical and organizational measures (TOMs). For review by your legal or data protection team.
Contract
Master Services Agreement
Our standard framework agreement for commercial collaboration. Provided during our first call.
Security documentation
TOM Catalog
The complete catalog of technical and organizational measures under Article 32 GDPR, available independently of the DPA. For your security or IT team.
Questions about compliance or data security?
In our first call, we will walk through which standards are relevant to your industry. If needed, we can also discuss which documents we can provide for your due diligence process.
Proud partner of:
