1.Where we stand
For customer workspace data we are a processor, and the customer is the controller. Our DPA incorporates the EU Standard Contractual Clauses (and the UK Addendum and Swiss adjustments where they apply) so that transfers to India, where the service is hosted, have a valid mechanism. India does not have an EU adequacy decision.
For US subprocessors, we rely on the EU-US Data Privacy Framework only where the provider is certified under it; otherwise on Standard Contractual Clauses plus a transfer assessment. The General Court upheld the framework in September 2025 and an appeal is pending, so we do not depend on it alone.
2.Data protection
| Law | What it requires | How it is handled |
|---|---|---|
| GDPR (Regulation 2016/679) | Lawful basis, transparency, data minimisation, security, processor contracts (Article 28), records, breach notice within 72 hours, data subject rights, and transfer safeguards. | Our DPA contains Article 28 terms, a 72-hour breach commitment where possible, subprocessor notice, and audit information rights. Customers answer data subject requests with our help. |
| Swiss Federal Act on Data Protection (FADP) | Similar to GDPR; applies to processing with an effect in Switzerland. | Covered by the same DPA terms and transfer clauses. |
| ePrivacy Directive and national laws | Rules for cookies, confidentiality of communications, and electronic marketing. | The website uses no advertising cookies. See the Cookie notice. |
| NIS2 Directive and Data Act | Cyber-security duties for essential and important entities, and cloud-switching rights. | We answer security questionnaires and support data export when you leave. |
3.Call recording
Recording is processing of personal data and also touches the confidentiality of communications. In most member states you need a lawful basis (for example consent, contract, or a legal duty), a clear notice at the start of the call, a defined purpose, and a short retention period. Some countries, such as Germany, treat unannounced recording as a criminal offence, and works councils may have a say over employee call monitoring.
4.Messaging and calling
Electronic marketing generally needs prior opt-in consent, with a limited exception for your own similar products sold to existing customers who were given an easy way to opt out. Rules for marketing phone calls differ by country: some use an opt-in model and others an opt-out register. The European Electronic Communications Code also regulates number-based communication services and emergency access (112), which applies to carriers and may apply to some providers.
5.AI agents
Article 50 of the EU AI Act has applied since 2 August 2026. A person who interacts directly with an AI system must be told so, at the latest at the first interaction, unless it is obvious. For a phone agent this means a clear spoken disclosure at the start of the call. A short extension to 2 December 2026 applies only to machine-readable marking of synthetic content by providers whose systems were already on the market. Article 4 (AI literacy) has applied since February 2025. Automated decisions with legal or similarly significant effects fall under GDPR Article 22.
Our AI agents terms require customers to enable the AI disclosure greeting for calls that may reach people in the EEA and to keep a path to a human.
6.Your responsibilities
- Decide your lawful basis and tell callers about recording and AI at the start of the call.
- Keep records of processing, and run a data protection impact assessment for high-risk uses such as large-scale monitoring.
- Honour data subject requests with our help, and tell us if you appoint an EU representative.
- Check national telemarketing and recording laws for each country you contact.
This page is a general summary of how Callfora approaches the law in this region. It is not legal advice, laws change, and your obligations depend on your own facts. Ask your counsel before relying on it.
Need help with this document?
Choose the route that matches your question. These links do not replace the terms above.