GDPR

Who is responsible for what when a bot talks to your customers. This page explains the roles and the practical steps to take.

How it works

A customer writes to your chatbot and leaves their name and phone number to be called back. That is personal data: the law requires it to be clear who processes it and why.

• You are the data controller: the customers are yours, the data is yours, you decide why to collect it.
• glacom® is the data processor: we process the data on your behalf, only to make the service work, according to the agreement signed in the contract.

Data stays on servers in Europe and is not used to train models: see Zero retention.

What you need to do

1. Updated privacy policy. Your privacy policy must state that there is an automatic assistant on the site (or the number) and what happens to the collected data. Upon request, we provide the base text for your consultant to verify.
2. Call recording. If you activate recording, the caller must know: the initial message says so. If you do not want recording, you can disable it.
3. Voice messages. Voice notes received on WhatsApp or Telegram are transcribed to provide a response: this must also be mentioned in the privacy policy.
4. Data subject requests. If a customer asks to delete their data, open a ticket and we will handle it.

What glacom® does

• We store conversations for the agreed time and delete them upon your request.
• We sign the data processing agreement (art. 28 GDPR) as part of the contract.
• Technical documentation on security measures is available upon request.

Limits

• We are not your legal consultant: we provide the tools and base texts, your consultant validates the compliance of your privacy policy.

From the app

There are no dedicated privacy functions in the app: requests are managed via a ticket.