Clear roles, documented obligations

Customers control their data; NaviCS AI processes it on documented instructions.

• For customer data, the customer acts as the data controller and NaviCS AI as the processor or service provider.
• Personal data is processed only as needed to provide the services and on the customer's documented instructions.
• Roles for specific processing activities are set out in the Data Processing Agreement.

Assistance with access, correction, deletion and other individual rights requests.

• Depending on applicable law, individuals may have rights of access, correction, deletion, restriction, objection and portability.
• NaviCS AI provides reasonable assistance to customers responding to these requests.
• Requests are submitted through the privacy contact channel.

Consent, opt-out, calling-hours and caller-identification requirements are built into campaign setup.

• Automated calls and messages must meet the consent and telemarketing rules of the jurisdictions you contact.
• Requirements cover consent, opt-outs, do-not-call lists, calling hours and jurisdiction-specific disclosures.
• Customers are responsible for their calling activity; campaigns are configured with these rules in view.

Infrastructure, telephony and AI providers are engaged under contractual terms.

• Supporting providers include cloud infrastructure, telecommunications, AI processing, messaging and monitoring.
• Subprocessor engagement is subject to contractual and legal requirements.
• The subprocessors relevant to your services are identified in your contract documentation.

Where data moves across borders, the transfer mechanism is agreed in the contract.

• Processing locations depend on infrastructure and provider configuration for your services.
• Where international transfers apply, the required transfer mechanism is implemented by agreement.
• Processing locations for your deployment are confirmed during contracting.

Data is kept only as long as the service, the contract and the law require.

• Information is retained to provide the services, maintain security and audit records, and meet legal obligations.
• At the end of a service, personal data is handled according to the agreement and the customer's documented instructions.
• Retention periods for your engagement are set out in your agreement.