We process your callers' data on your instructions

1. This agreement

This agreement is between DeskCaller Ltd, company number 15482207 (“we”), and the business that uses DeskCaller (“you”). It forms part of our terms of service and applies from the moment you accept them, for as long as we process personal data for you. It meets article 28 of the UK GDPR. Where it and the terms differ about personal data, this agreement wins. If you need a signed copy, write to contact@deskcaller.com.

2. What we process, and why

• Whose data: the people who ring your number or speak to your receptionist, and anyone they give details of.
• What: the caller’s number; what they said, as a transcript; the audio, only if you switch recording on; the details they give, such as their name, email, address and what they want; the summary, the lead and any booking made from the call. Callers sometimes say more than is asked, including about their health; we process whatever they say only as part of the call.
• Why: to answer your calls, take down what you ask for, book into the calendar you connect, write each call up, and send it where you tell us to.
• For how long: while you use DeskCaller, and until it is deleted as section 9 says.

3. Your instructions

We process this data only on your documented instructions: these terms, and what you set up in your account (what your receptionist says and asks, what it collects, whether calls are recorded and for how long, the calendar, and where details are sent), except where the law requires otherwise, as article 28 of the UK GDPR sets out.

4. What you are responsible for

As controller you decide what is collected and why, need a lawful basis for it, and answer to your callers. Your receptionist tells every caller it is an AI, and that the call is recorded while you have recording on: it will not publish a greeting that leaves either out. Do not instruct us to collect more than you need.

5. Confidentiality

Everyone at DeskCaller who can reach your data is bound to keep it confidential. Every time our staff open a business’s conversations, recordings or account, it is recorded in an audit log.

6. Security

• Each business’s data is kept apart in the database, so one account cannot read another’s.
• Data is encrypted in transit. Tokens for your calendar and other connections, and two-factor secrets, are encrypted with keys of their own and opened only when used.
• Call audio, transcript text and card details are never written to our logs.
• Every person in your account has a role, and every act that matters is recorded in an audit log.
• A recording is kept only for the days you set, and deleted on its date.

7. Sub-processors

You authorise us to use sub-processors of these kinds: hosting in the UK for our servers, database and stored files; the voice AI service that holds each conversation and writes it up; the telephone carrier that provides and routes your number; and the email and notification services that deliver what you ask us to send. Each works under a written contract, and changes to them are handled, as article 28 of the UK GDPR requires. The calendar you connect, and the webhooks and automations you set up, are your choices, not our sub-processors.

8. Where it is processed

DeskCaller is hosted in the UK, and your data is stored there. Some sub-processors process it outside the UK, including in the United States, to provide their part of the service. Each such transfer is protected as UK data protection law requires: by UK adequacy regulations, or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

9. Deleting it

• One caller: you can delete a caller’s details from any call or lead at any time. It is deleted from our storage and from our sub-processors, and checked.
• Recordings: deleted on the date set by the days you chose, 7 to 365 depending on your plan.
• Everything: you can export all of it at any time. When you close your business, it is all erased at the end of what you have paid for, and never sooner than 14 days after you ask, so you can take an export first. We keep only what the law requires us to: invoices and payments, the record of who did what in the account, and the agreement accepted for your number.

10. Helping you

The product lets you answer your callers’ requests yourself: find a caller by their number, see what was taken down, correct it, export it and delete it. Beyond that, we assist you as article 28 of the UK GDPR requires.

11. A personal data breach

If a personal data breach affects your callers’ data, we notify you without undue delay, as article 33 of the UK GDPR requires.

12. Showing we comply

We make available the information needed to show we meet article 28 of the UK GDPR, and allow for audits, as it requires.

13. Liability and law

Each side’s liability under this agreement is as set out in our terms. This agreement is governed by the law of England and Wales, and the courts of England and Wales decide any dispute about it. What we do with personal data for ourselves, such as your own account and billing details, is in our privacy notice.