Data processing information

For personal data contained in calls to a customer's business, the customer is the controller and Flowfinds Solutions Kft. is the processor. We process it only to provide the service and on the customer's documented instructions, which are expressed through the settings in the product.

For a customer's own account data, we are the controller. See the privacy policy.

Subject matter: answering, transcribing and summarising inbound telephone calls, and producing structured enquiry records from them.

Duration: for as long as the customer maintains an account, subject to the retention periods in the privacy policy.

Data subjects: members of the public who telephone the customer's business.

Categories: name, telephone number, email address where volunteered, property postcode, the nature of the enquiry, stated urgency, preferred appointment times, and the call transcript.

We instruct the receptionist not to collect special category data, payment details or credentials. A caller may nonetheless volunteer information unprompted; the customer should account for this in its own assessment.

Application-layer AES-256-GCM encryption of caller identifiers, encryption in transit, per-purpose key derivation, redaction of personal data before logging, authenticated and workspace-scoped access, signature verification and replay protection on inbound webhooks, and rate limiting on every endpoint that can incur cost or contact a person.

The current subprocessor list is published and is intended to be kept current. A customer requiring notice of changes should raise it with us so it can be recorded in a signed agreement.

Some subprocessors operate outside the customer's own country. Any transfer mechanism must be confirmed in a signed data processing agreement — this page does not itself constitute one.