1. Parties and subject matter
The Customer is the controller (“Controller”), and the operator of Piketto named above is the processor (“Processor”). The subject matter is the processing of personal data of callers whose calls the Controller has answered through Piketto.
2. Duration
This agreement applies for the duration of the main contract and thereafter for as long as the Processor processes the Controller’s personal data.
3. Nature and purpose of processing
The Processor processes the data solely to answer calls on behalf of the Controller: recognising and responding to speech in real time, transcribing the conversation, capturing and summarising callers’ requests, transferring urgent calls, notifying the Controller by email and SMS, displaying calls in the dashboard and billing for call time. No processing takes place for the Processor’s own purposes, such as advertising or training its own AI models.
4. Categories of personal data and data subjects
Data subjects are callers to the Controller and the Controller’s employees to whom calls are transferred. The following data is processed:
- caller number, time and duration of the call;
- callers’ voices, exclusively in real time and without storing audio recordings;
- the transcript of the call;
- captured information such as name, callback number, reason for calling, urgency, appointment request and summary;
- employees’ call transfer and notification numbers.
The processing of sensitive personal data or data subject to professional secrecy is not envisaged and requires a separate written agreement. The Controller configures its phone assistant so that such data is not requested.
5. Instructions
The Processor processes the data only on documented instructions from the Controller. This agreement, the dashboard configuration (in particular the retention period, call transfer and notification settings) and individual written instructions constitute instructions. If the Processor considers an instruction unlawful, it informs the Controller without delay.
6. Confidentiality
The Processor grants access to the data only to persons who need it to perform the contract and who are bound by confidentiality obligations. This obligation continues after the contract ends.
7. Technical and organisational measures
The Processor ensures a level of data security appropriate to the risk in accordance with Art. 8 FADP and Art. 1–6 of the Data Protection Ordinance (DPO), in particular:
- encryption of data transmission (TLS) and protection of stored login credentials through hashing;
- logical separation of each Controller’s data; dashboard access restricted to that Controller’s users;
- role-based access for the Processor’s employees on a need-to-know basis;
- data minimisation: no audio recordings, automatic deletion after the selected retention period;
- careful selection of subprocessors and imposition of contractual obligations on them;
- logging of security-relevant events and regular review and adaptation of the measures.
8. Subprocessors
The Controller authorises the engagement of the subprocessors listed in the Privacy policy: ElevenLabs for voice AI, including its language-model subprocessors (Google Gemini), netcup GmbH for the application and database in Vienna, Austria, Cloudflare for CDN, TLS and DDoS protection, Google Workspace for email, Twilio for telephony and SMS, and Stripe for payments. The applicable processing countries and safeguards are stated there. An encrypted database backup is held on the operator’s own infrastructure in Switzerland. The Processor contractually requires each subprocessor to provide at least an equivalent level of data protection.
The Processor informs the Controller by email at least 30 days before engaging or replacing a subprocessor. The Controller may object on serious data protection grounds; if the parties cannot find a solution, the Controller may terminate the contract with effect from the date of the change.
9. Disclosure abroad
Personal data is disclosed abroad only in accordance with Art. 16 and 17 FADP: to countries with adequate data protection according to the Federal Council, to recipients in the USA certified under the Swiss-U.S. Data Privacy Framework for the processing concerned or, otherwise and for other countries without adequate protection, on the basis of standard contractual clauses recognised by the FDPIC and adapted for Switzerland, with supplementary safeguards where necessary. The Processor maintains the up-to-date list of recipients and countries set out in the Privacy policy.
10. Assistance with data subject rights
The Processor assists the Controller by appropriate means in responding to data subject requests (access, rectification, erasure and delivery of data). The Controller can view and permanently delete individual calls in the dashboard. If the Processor receives a request directly, it forwards it to the Controller without delay. The Processor also assists the Controller with data protection impact assessments to the extent of the information available to it.
11. Data security breaches
The Processor notifies the Controller of a data security breach affecting the Controller’s data as soon as possible after becoming aware of it (Art. 24 para. 3 FADP). To the extent known, the notification includes the nature and extent of the breach, the categories of data affected, the possible consequences and the measures taken or proposed. The Processor assists the Controller with any notification to the FDPIC and with informing data subjects.
12. Deletion and return
During the contract, transcripts and caller information are automatically deleted after the period selected by the Controller (7 to 365 days, default 90 days); no audio recordings are stored. The Controller can delete its account at any time in Settings; the Processor then immediately deletes the business profile, call records and transcripts, removes the phone assistant from the subprocessor ElevenLabs, releases the Swiss number and cancels any subscription immediately. When the subscription ends (cancelled or expired), the Processor deletes all of the Controller’s personal data 30 days after the end of the last billing period; if a subscription was never started, 60 days after sign-up. Call data held by ElevenLabs is deleted within 30 days at the latest. Statutory retention obligations remain reserved: information required for billing, without call content, is retained to the extent required by law.
13. Evidence and audits
On request, the Processor provides the Controller with the information needed to demonstrate compliance with this agreement. The Controller, or an auditor appointed by it and bound by confidentiality, may conduct an audit with sufficient prior notice, during business hours and no more than once a year, except where there are reasonable grounds to suspect a breach. The Controller bears the costs.
14. Final provisions
The liability provisions of the Terms of service apply. In the event of a conflict, this agreement takes precedence over the Terms of service in matters of data protection. Swiss law applies; the courts at the Processor’s registered office have jurisdiction.