GDPR Compliance

When you visit our website, use the chat assistant, or fill out the contact form, we act as the controller of your data. A full description of this processing — what data we collect, through which sub-processors, for what purpose, for how long, and what your rights are — is set out in detail in our Privacy Policy.

When a business uses the Voxia platform to handle its phone calls, Voxia processes data belonging to that business's callers/customers on behalf of, and under the instructions of, the customer business, which remains the controller of its own customer data. The terms of this processor-controller relationship are set out in a separate Data Processing Agreement (DPA) between Voxia and each customer.

The Voxia platform supports the following technical features, which help our customers with their own GDPR compliance. Items marked "configurable per service" are enabled during a customer's implementation and are not necessarily active by default: • Ability to encrypt sensitive data fields at the application layer (configurable per deployment) • Ability to automatically redact items such as phone numbers, email addresses, tax IDs, card numbers, and IBANs before they are stored or forwarded to third parties (configurable per service) • Export and erasure of voice call data on data subject request (DSAR) • Configurable data retention policy, with duration set per data category • Audit trail of access actions within the platform • Choice of cloud or on-premise/private cloud deployment, based on the customer's data residency needs • Role-based access control and mandatory two-factor authentication (2FA) in the administration environment • Automated voice-processing audio notice before every call, independent of whether recording is enabled

Export and erasure on data subject request (DSAR) currently covers voice call data. For requests concerning data collected through a service's web chat channel, we or our customer handle these upon manual request.

The complete, named list of sub-processors used by the Voxia platform (speech-recognition/synthesis providers, language models, email/SMS, AADE, calendar, etc.) is set out in our Privacy Policy, under "Sub-Processors and Third-Party Service Providers".

Use of the technical features above does not replace the legal and organizational obligations of any business using the platform. Executing a Data Processing Agreement (DPA), informing its own customers through its own privacy policy, maintaining a Record of Processing Activities (ROPA), choosing whether and which of the above configurable features to enable, and any other legal/organizational obligation remain the sole responsibility of each customer business, as controller of its own data.

For questions about GDPR compliance — whether as a website visitor or as a platform customer — contact us at hello@voxia.gr.