GDPR and data protection

• Data is hosted in the European Union and kept separate for each client.
• The agent says up front that it is an automated assistant and hands over to a person when needed.
• We process callers' data only on behalf of the client and only on its instructions.
• During onboarding we analyse the client's call archive only to configure that client's own agent; we don't train general models on client data.
• The agent only verifies identification data — it never reads it out — and sensitive data is masked in transcripts and logs.
• Each client decides how long recordings, transcripts and logs are kept.

For the second situation, see the Privacy policy.

You spoke with an automated assistant working on behalf of the organisation that called you or that you called. That organisation decides which data is used and why; we provide the technology.

• At the start of the conversation, the agent says it is an automated assistant and who it works for.
• You can ask to speak to a person at any time; the agent transfers you or books a call-back, according to the organisation's rules.
• To verify your identity, the agent may ask for a code (for example a PIN typed on your keypad) or details only you know. It checks them — it never reads them out — and after two wrong attempts it transfers you to an operator.
• If the organisation has turned on call recording, it tells you at the start of the call.
• You can ask at any time to stop informational SMS; the request is recorded immediately.

For access, erasure or other rights, contact that organisation. If you write to us at [email protected], we forward your request to the organisation without delay and help it respond.

• the caller's phone number and name, and preferred language;
• conversation content: the transcript, summary, outcome (for example "confirmed", "rescheduled") and, if the client turns it on, the audio recording;
• call data: date, time, duration, contact attempts, SMS sent;
• the data from the client's systems the agent needs for that call — for example an appointment, a parcel, an order or a notarial deed;
• the result of an identity check (verified / not verified), not the codes entered;
• preferences expressed, including opting out of SMS.

In fields such as healthcare, some data may be special-category data (Art. 9 GDPR). We process it only when the client's service requires it, on the legal basis set by the client, limited to what the conversation needs. The agent does not diagnose or give medical advice; specialist questions are passed to the client's staff.

So that the agent starts from the client's real flows rather than a generic script, the Resonalia team may, at the client's request, analyse the client's call-centre archive: call recordings and transcripts, emails, messages and the operators' scripts.

• The client decides what to send us and makes sure it has a legal basis and that the people concerned have been informed; we process the archive as a processor, on the client's instructions.
• The archive is transferred securely, processed in the EU and accessed only by the team members working on the onboarding.
• During transcription, identifying data (names, numbers, codes, medical details) is anonymised or pseudonymised before analysis, as far as the purpose allows.
• The result — frequent questions, answers, vocabulary and transfer rules — is used only to configure that client's agent and is signed off by the client before launch.
• We don't use the archive to train general models or for other clients. We delete it when onboarding is complete, at the latest 90 days after receipt.

• We process data only on the client's documented instructions — the configuration of the agent, flows and integrations constitutes those instructions.
• Everyone with access to the data is bound by confidentiality.
• We apply the technical and organisational measures described below (Art. 32 GDPR).
• We use sub-processors only under contracts with equivalent obligations; we give clients at least 30 days' notice before adding or replacing one, and they may object.
• We help the client answer data-subject requests, carry out data protection impact assessments (DPIAs) and consult the authority where needed.
• We notify the client without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting it, with the information available.
• When the contract ends, we return the data on request and delete it within 30 days, except where the law requires us to keep it.
• We make available the information needed to demonstrate compliance with these obligations and allow reasonable audits with prior notice.

This list is kept up to date on this page. Clients may ask for the current version and copies of the contractual safeguards.

Client data is stored in the European Union. Where a sub-processor processes data outside the EEA, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework, the provider's binding corporate rules or the European Commission's standard contractual clauses, together with additional measures (encryption, minimisation).

• encryption in transit (TLS) and at rest;
• data isolated per client, with separate secret keys per client held in a key vault;
• role-based access limited to those who need it, with an activity log;
• sensitive data masked in transcripts and logs;
• logged identity checks, with transfer to a person after two wrong attempts;
• an event log that is never rewritten — every call, message and outcome stays traceable;
• encrypted backups and continuous infrastructure monitoring.

• Transparency — the agent introduces itself as an automated assistant at the start of every conversation, in line with the transparency obligations of Regulation (EU) 2024/1689 (the AI Act).
• No solely automated decisions with significant effects — the agent answers, books, confirms and passes things on according to the client's rules; it doesn't make decisions with legal or similar effects on people (Art. 22 GDPR).
• No general models trained on your data — a client's data is used only to configure that client's agent (knowledge base, scripts, rules); we don't train general models, don't use it for other clients and, where possible, configure our providers not to use it for that purpose.
• Human control — the client sets the scripts, limits and transfer rules and can review any conversation in the dashboard.

Calls and SMS about a service the person has already asked for — confirming an appointment, announcing a delivery or an order that has arrived — are service communications. For marketing communications, the client must have the person's consent under Romanian Law 506/2004 (ePrivacy). The platform honours every opt-out immediately and records it.

This page, together with the Terms and conditions, forms the data processing agreement under Art. 28 GDPR. If your organisation needs a signed agreement or its own annexes, write to [email protected].

Data protection questions: [email protected].

The Romanian supervisory authority is ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), 28–30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro. You may also complain to the authority in your EU country of residence.