Platform Data Ownership Clauses for Vendor-Hosted AI Devices
Controller Status Must Be Contractual, Not Assumed
Under the EU GDPR and UK Data Protection Act 2018, controller status is not inherent to device ownership — it is assigned by contract. When WingPhoenix hosts the platform, your brand retains controller status only if the agreement names you as controller and limits WingPhoenix to processor functions: storage, transmission and basic analytics strictly per your documented instructions. This clause must override any default terms in WingPhoenix’s standard service agreement. It applies equally to devices across the AI Robots line, the AI Learning & Robotics line, and the health smartwatch. Without this clause, regulatory liability defaults to the hosting party — not your brand.The Export Clause: Format, Timeliness and Verification
Data export is not a courtesy — it is a legal obligation tied to the controller’s right to portability and erasure. A valid export clause specifies: (i) machine-readable formats (JSON, CSV, or Parquet, never PDF or image), (ii) completion within 30 calendar days of written termination notice, and (iii) verification via checksum or signed manifest. It must also cover metadata — timestamps, device IDs, firmware versions — not just payload. This requirement applies to all platforms supporting the K1 AI companion robot, the E1 learning robot, and the AI wearables line. WingPhoenix books export testing per hardware revision with an accredited lab — but only when the clause is activated in the contract.Subprocessor Transparency Is Non-Negotiable
WingPhoenix engages subprocessors for infrastructure (e.g., AWS EU regions), logging, and CDN services. The contract must require: (i) prior written notice of any new subprocessor, (ii) your right to object within 15 days, and (iii) live access to current certification reports for each listed subprocessor. Claims like “we use trusted cloud providers” are insufficient. You must be able to verify conformance against how we build and test — including evidence that subprocessors meet the same security scope as WingPhoenix’s own QA gates.Term Limits and Automatic Sunset Triggers
The platform agreement must define a fixed term — not “indefinite” or “until terminated” — and include automatic sunset triggers: data deletion begins 30 days after final export confirmation, and all backups must be purged within 90 days. No retention extensions are permitted unless separately agreed in writing and justified per Article 6(4) GDPR. This protects your brand from residual liability long after the commercial relationship ends.What This Process Cannot Do
This process does not validate or certify your brand’s internal data handling practices — only the contractual boundaries between your brand and WingPhoenix. WingPhoenix does not assess your DPO appointment, your record of processing activities, or your DPIA for downstream use cases. Those remain your sole responsibility under national law. Nor does WingPhoenix hold or issue ISO 27001 certification for its platform operations; certification is scoped per hardware revision and booked with an accredited laboratory — not claimed generically. If a supplier presents a blanket ISO certificate without revision linkage or lab documentation, reject it. Refer to how to vet a supplier for red-flag criteria.| Clause | Must Specify | Enforceable Evidence | Applies To |
|---|---|---|---|
| Controller Assignment | Named controller (your brand); processor limitations defined | Executed contract section, not T&Cs | All hosted platforms, including OEM/ODM services |
| Export Scope | Formats, timelines, metadata coverage, verification method | Test report from accredited lab per revision | AI Robots line, Learning Robotics |
| Subprocessor List | Live URLs to current certifications, approval rights | Documented change log, updated quarterly | All cloud-connected devices in product catalogue |
| Term & Sunset | Fixed duration, auto-delete start date, backup purge deadline | Written confirmation timestamped at each stage | Service robots, companion models, wearables |
| Liability Carve-Out | Explicit exclusion of fines arising from your non-compliance | Contract annex with jurisdiction-specific carve-outs | EU/UK imports only — see buyer resources |
| Audit Right | Annual on-site or remote review of subprocessor controls | Pre-approved auditor list, NDA template provided | Orders ≥2,000 units (firmware white-label threshold) |
- Review your draft agreement against the Journal of WingPhoenix AI for clause-by-clause annotations
- Require subprocessor reports before signing — do not accept “available on request”
- Confirm export testing is booked with the same lab used for CE RED and FCC Part 15 compliance
- Verify that the controller clause references your brand’s registered legal entity — not a trading name
- Check that the term aligns with your product lifecycle forecast, not just order volume
Questions buyers ask
Who is the data controller when WingPhoenix hosts the cloud platform?
Your brand remains the data controller under EU and UK law, provided the contract explicitly assigns controller status and restricts WingPhoenix to processor duties only.
What happens to our data if we end the partnership?
A binding exit clause must require full, machine-readable data export within 30 days of written notice — no manual reformatting, no proprietary schema locks.
Our distributor failed a GDPR audit because the supplier claimed “data is anonymised by default”. Is that sufficient?
No. Anonymisation claims without documented methodology, irreversible techniques and third-party validation are not legally defensible. WingPhoenix does not make such claims.
What’s the one thing most suppliers won’t show in writing?
A list of all active subprocessors with live links to their current ISO 27001 or SOC 2 reports — and a contractual right to approve new ones before onboarding.
Related: more on ai memory platform · buyer guides · customisation tiers