Data processing agreement (Art. 28 GDPR)
Preview: the sub-processor list describes the planned service and is confirmed before launch.
When you use Stemvo, we process your callers' data on your behalf under a data processing agreement (Art. 28 GDPR). It forms part of the terms of service and is concluded at registration; we send a signed copy on request via hello@stemvo.eu.
What it covers
- Subject and duration: running the AI phone assistant for the term of the contract.
- Data: phone numbers, time and length of calls, transcripts, summaries, details given during calls and optional recordings.
- Data subjects: callers, customers and prospects of the customer, and its staff using the service.
- Instructions: we process only on the customer's documented instructions.
- Confidentiality: everyone with access is bound to confidentiality; on request we sign an additional undertaking for professionals bound by secrecy.
- Assistance: with data subject rights, DPIAs and personal data breaches (notified to the customer without undue delay, at the latest within 48 hours of becoming aware).
- Deletion: after the retention period set by the customer and at the end of the contract; export is possible beforehand.
- Audits: evidence and audits under Art. 28(3)(h) GDPR.
Technical and organisational measures (selection)
- Encryption in transit (TLS) and at rest
- Storage and processing in data centres in the European Union
- Role-based access, two-factor authentication for accounts and administrators
- Separation of data between customers
- Automatic deletion after the set retention period
- Logging of administrative access, regular backups and restore tests
Sub-processors
| Service | Provider | Location |
|---|---|---|
| Telephony (calls, numbers) | [telephony provider] | EU |
| Speech recognition | [speech recognition provider] | EU |
| Language model | [language model provider] | EU region |
| Voice output | [voice provider] | EU |
| Hosting, database, storage | [Hosting-Anbieter, Sitz, Serverstandort] | EU |
We announce new or changed sub-processors at least 30 days in advance. You may object on reasonable data protection grounds.