Privacy policy and GDPR FAQ

The General Data Protection Regulation (GDPR) is a sweeping new European Union (EU) privacy law that comes into effect on May 25, 2018. Here you can find answers to lots of frequently asked questions regarding GDPR.

1. What is personal data?
   Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which when collected together can lead to the identification of a particular person, also constitute personal data. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as – name, email address or location, and also online identifiers like IP address, various types of website cookies and other device identifiers.
   
   Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.
   
   For example: Call recording containing personal data like name, SSN, location, social identity etc.
2. Is CloudTalk’s call center solution GDPR compliant?
   Yes, CloudTalk is currently GDPR compliant.
3. Can CloudTalk assist my company with responding to an Individual Rights Request (Subject Access Request)?
   As a processor of personal data for many of our customers, we will assist you with responding to individual rights requests that you receive under the GDPR. But in many cases, you can resolve these types of requests by logging into CloudTalk and process any action you need. Where this is not possible, please contact us.
4. Where does CloudTalk store our data?
   Our goal is to provide our customers with secure, fast, and reliable services. As a provider of global services, we run our services under multiple jurisdictions around the world. Data is stored in the data center closest to the location of our customers. For more information about services we use, please check our page about CloudTalk subprocessors. We will hold any subprocessors that handle personal data, including our data center partners, to the same data management, security, and privacy practices and standards to which we hold ourselves.
5. How does CloudTalk secure my data?
   We have implemented organizational and technical safeguards to secure all of your data. For more information on security please take a look at our GDPR or Security pages.
6. Does CloudTalk use subprocessors to further process customer data?
   A list of our subprocessors can be found on CloudTalk Subprocessors page.
7. For how long do you store customer data?
   We store customers’ data only for the time of using our services or until they delete the app.
8. If I use CloudTalk as my call center solution, does my business comply with GDPR?
   Not automatically. While CloudTalk is GDPR-compliant and provides tools to help you comply with GDPR, it is your responsibility to ensure that your business itself complies with GDPR. Using CloudTalk itself does not guarantee that the company complies with GDPR, but it will certainly make it easier for you. Also, check whether other third party services you use also comply with GDPR.
9. What is the advantage of a cloud service in terms of GDPR compliance?
   Being GDPR compliant means large investments in time, expertise and costs. Services that are part of the cloud ecosystem use the most advanced security procedures and make changes at the global level a lot easier, at the same time and for everyone without exception. This creates a safe environment for managing and processing your data and also accommodating efforts required to keep pace with changing policies.
10. What does Brexit mean for GDPR?
    Brexit has no implications on GDPR. You have to comply with GDPR. The UK will not have completed their withdrawal from the EU when the GDPR goes into effect. In addition, if companies based in the UK process data of EU residents, they will always fall under the GDPR, no matter if the UK is a member of the EU or not.

Find more information about CloudTalk’s call center system and GDPR here.

Privacy Policy

Data Collection

CloudTalk Cares about your privacy, so we follow The Platform for Privacy Preferences Project, or P3P practices. P3P was designed to give web users more precise control of the kind of information that they want to allow to be released.

CloudTalk reserves the right to access any or all Your accounts in order to respond to Your requests for technical support. We shall maintain appropriate administrative, physical and technical safeguards for protection of the security, confidentiality and integrity of Your data. We will not disclose Your data except if compelled by law or if permitted by You.

P3P policies declare the data they collect in groups (also referred to as “statements”.) Our policy contains 4 data groups. The data practices of each group will be outlined separately as follows:

Group “Access Log Information”

CloudTalk is collecting anonymous data about user behavior when using our software solutions. We are monitoring these data to improve our product and prevent bugs & unplanned outages.

We collect the following information:

• Click-stream data
• Account usage data
• HTTP protocol elements
• Call statistics and quality data

This data will be used for the following purposes:

• Completion and support of the current activity
• Web site and system administration
• Research and development
• Improvement of our products & services

This data will be used solely by CloudTalk, and its agents. The following explains why this data is collected. Our Web server collects access logs containing this information.

Group “Cookies”

We collect the following information:

• HTTP cookies
• Flash Cookies

This data will be used for the following purposes:

• Research and development.
• One-time tailoring.

This data will be used solely by CloudTalk, and its agents. The following explanation is provided for why this data is collected: Cookies are used to track visitors to our site, so we can better understand what portions of our site best serve you. We also use cookies to allow our server to maintain information about the contents of your shopping cart.

Group “Transaction Information” (required)

We collect the following information:

• Physical contact information
• Online contact information
• Demographic data
• Purchase information

This data will be used for the following purposes:

• Completion and support of the current activity
• Research and development

This data will be used solely by CloudTalk and its agents. In addition, the following types of entities will receive this information:

• Contacting visitors for marketing of services or products.

This data will be used solely by CloudTalk and its agents. In addition, the following types of entities will receive this information:

• Delivery services

The following explanation is provided for why this data is collected:

• Information we collect in order to process your purchase.

Cookies

Cookies are a technology which can be used to provide you with tailored information from a Web site. A cookie is an element of data that a Web site can send to your browser, which may then store it on your system. You can set your browser to notify you when you receive a cookie, giving you the chance to decide whether to accept it.

Flash Cookies (local shared objects) are a technology offered by Macromedia Flash Player. You can set your operating system permissions so, that browser will not be able to write any information on your disk to protect your privacy. Next option how to avoid Flash Cookies is to uninstall Macromedia Flash Player from your computer.

Our site makes use of cookies. Cookies are used for the following purposes:

• User targeting
• Research and development

Compact Policy Summary

The compact policy which corresponds to this policy is:

CP=NOI CURa ADMa DEVa TAIa CONa OUR DELa BUS IND PHY ONL UNI PUR COM NAV DEM STA

The following table explains the meaning of each field in the compact policy.

The compact policy is sent by the Web server along with the cookies it describes. For more information, see the P3P deployment guide at https://www.w3.org/TR/p3pdeployment.

Policy Evaluation

Microsoft Internet Explorer 6 will evaluate this policy’s compact policy whenever it is used with a cookie. The actions IE will take depend on what privacy level the user has selected in their browser (Low, Medium, Medium High, or High; the default is Medium. In addition, IE will examine whether the cookie’s policy is considered satisfactory or unsatisfactory, whether the cookie is a session cookie or a persistent cookie, and whether the cookie is used in a first-party or third-party context. This section will attempt to evaluate this policy’s compact policy against Microsoft’s stated behavior for IE6.

Note: this evaluation is currently experimental and should not be considered a substitute for testing with a real Web browser.

Unsatisfactory policy: this compact policy is considered unsatisfactory according to the rules defined by Internet Explorer 6. The behavior of Internet Explorer 6 regarding cookies set under this compact policy is as follows:

A policy which is considered unsatisfactory by Internet Explorer 6 contains certain categories of data which are used or shared in a particular manner. This policy is placed in the unsatisfactory category, because the following categories of data are associated with this policy’s cookies:

• Physical contact information is collected.
• Online contact information is collected.

In addition, the data is used in the following manner, marking the policy as unsatisfactory:

• The data is used for contacting the user.

Note that allowing an opt-out will make this policy acceptable under the Low and Medium settings, and under Medium High for first-party cookie usage. At the High setting, and at the Medium High setting for third-party cookies, all of these data uses must be opt-in for the policy to be considered satisfactory.