Data processing agreement

1. Subject and duration

The processor processes personal data on behalf of the controller to provide the Voicetask service. This agreement runs for as long as the customer has an account.

2. Which data

• Data subjects: visitors to the customer’s website(s) who use the widget, and users of the customer’s dashboard.
• Data: visitors’ questions and messages, contact details they provide themselves (name, email address, phone number), technical data (IP address, briefly, to limit abuse) and the data in the customer’s knowledge base.
• Purpose: answering questions with the AI assistant, passing messages on as tasks, categorising tasks and keeping the customer informed by email.

The customer does not send the processor special categories of personal data and does not set up the assistant to collect them.

3. Instructions

The processor only processes the data on the customer’s instructions, as set out in this agreement and the dashboard settings, unless the law requires otherwise. The processor does not use the data for its own purposes or to train AI models.

4. Confidentiality and security

Everyone at the processor with access to the data is bound to confidentiality. The processor takes appropriate technical and organisational measures, including:

• encrypted connections (HTTPS/TLS);
• hosting in the EU with strict separation of data per customer;
• passwordless sign-in (passkeys and one-time codes) and mandatory passkeys for Voicetask’s own administrators;
• minimal storage: chat conversations are not kept, only messages that are passed on;
• automatic clean-up of tasks according to the retention periods the customer sets.

5. Sub-processors

The customer authorises the sub-processors on the sub-processors page. The processor imposes the same obligations on them as in this agreement. We announce new sub-processors at least 30 days ahead; the customer can object by cancelling.

6. Transfers outside the EU

Visitor data is stored and processed within the EU. Transfers outside the EU only happen with an appropriate safeguard, such as an adequacy decision or standard contractual clauses.

7. Data subject rights

The customer can view, edit and delete tasks and contact details in the dashboard. Where needed the processor helps the customer with data subject requests. If the processor receives such a request directly, it forwards it to the customer.

8. Data breaches

The processor notifies the customer of a personal data breach without undue delay, and at the latest within 48 hours of discovery. The notification contains what is known about its nature, consequences and the measures taken. The customer decides on notifying the supervisory authority and data subjects.

9. Audit

On request the processor gives the customer the information needed to demonstrate compliance with this agreement. An audit by an independent expert is possible after reasonable notice, at the customer’s expense.

10. End

After the account ends, the processor deletes the personal data within 60 days, unless the law requires retention. The customer can export tasks before the end.

11. Liability

The liability provisions of the terms and conditions apply.