Data processing (GDPR)

Who is responsible for what

The client business that uses Kalyo to answer its calls is the controller of its callers' data: it determines the purposes and means of processing. Human Echo Connect, which publishes Kalyo, acts as a processor within the meaning of Article 28 GDPR: we process this data only on the client's documented instructions and on its behalf.

For data collected on this website (contact forms, demo call requests), Human Echo Connect is the controller: this is described in our privacy policy.

Data processed during a call

The agent is configured to collect only the information needed for the request (data minimisation principle, Article 5 GDPR):

• Identification: the caller's phone number and, where needed, their name;
• Call content: audio recording for the duration of processing, and a written transcript;
• Information relevant to the request: preferred time slot, job address, reason for calling, urgency level;
• Technical data: date, time and duration of the call.

The agent does not ask for sensitive data (health, opinions, bank details). If a caller volunteers such data, it is used only to handle their request.

Purposes and legal bases

Purposes are set by the client business. As a guide, the expected processing is as follows:

• Answering the call and handling the request (booking, appointment, job request, information): pre-contractual steps or performance of a contract with the caller (Article 6(1)(b));
• Sending a call record to the business by text, email or CRM: same legal basis, or the business's legitimate interest in following up its calls (Article 6(1)(f));
• Filtering spam and cold calls: the business's legitimate interest in protecting its line (Article 6(1)(f));
• Improving the service: only from anonymised data, or with the client business's agreement.

Callers' data is never sold, never used for advertising and never reused on behalf of another client.

Informing callers

At the start of the call, a greeting message approved with the client business tells callers that they are speaking with an AI assistant, that the call is recorded and transcribed to handle their request, and whom to contact to exercise their rights (Article 13 GDPR and Article 50 of the AI Act).

Retention periods

• Audio recordings and transcripts: 90 days maximum by default, which the client business can shorten;
• Call records sent to the business's tools (email, CRM): kept in line with the client business's own policy;
• End of contract: deletion or return of all data, at the client's choice, followed by deletion of any copies (Article 28(3)(g)).

Hosting and sub-processors

Data is hosted and processed within the European Union. We use sub-processors strictly necessary for the service (hosting, telephony, voice engine), bound by data protection obligations equivalent to ours. They are listed in the data processing agreement; the client business is informed of any change and may object to it (Article 28(2)).

Should a transfer outside the EU become necessary, it would be covered by the European Commission's standard contractual clauses or an equivalent mechanism.

Security and confidentiality

In line with Article 32 GDPR, we implement technical and organisational measures appropriate to the risk:

• encrypted exchanges;
• access restricted to authorised people bound by confidentiality;
• European hosting;
• measures reviewed and strengthened as the product develops.

Personal data breaches

In the event of a personal data breach, we inform the client business without undue delay after becoming aware of it, with the relevant details, so that it can notify the supervisory authority within 72 hours and, where necessary, the people affected (Articles 33 and 34 GDPR).

Callers' rights

Callers have the rights of access, rectification, erasure, restriction, objection and portability. They exercise them with the business they called; we help it respond within one month (Article 28(3)(e)). Any request we receive directly is forwarded to it without delay. Callers may also lodge a complaint with a supervisory authority, such as the French CNIL (www.cnil.fr).

Data processing agreement (DPA)

Each client business signs a data processing agreement with Human Echo Connect in line with Article 28 GDPR, setting out the instructions, security measures and list of sub-processors. We also help you keep your record of processing activities (Article 30) and, where your business requires it, carry out a data protection impact assessment (DPIA, Article 35). To obtain the agreement or ask a question: contact@kalyo.ai.