This is a summary of the data processing terms that apply when Remute processes personal data on behalf of a customer, as required by Article 28 GDPR. A signable full version will be available on request at {{CONTACT_EMAIL}}.
1. Parties and roles
The customer is the controller. Remute, operated by {{LEGAL_NAME}} (tax ID {{TAX_ID}}, {{ADDRESS}}), is the processor.
2. Subject matter, duration and nature
Remute answers, records where enabled, transcribes and summarises calls to the customer's numbers, stores call records and notifies the customer. Processing lasts for the term of the service and until deletion under section 9.
3. Categories of data and data subjects
Data subjects: the customer's callers and contacts, and the customer's users. Data: phone numbers, voice recordings, transcripts, names, contact details, appointment details and any information callers volunteer. The customer must not use the service to collect special categories of data (such as health data) unless agreed in writing.
4. Processor obligations
Process data only on the customer's documented instructions (the service configuration and these terms), unless the law requires otherwise, in which case we inform the customer where permitted.
Ensure that people authorised to process data are bound by confidentiality.
Apply appropriate technical and organisational measures (Art. 32): encryption in transit and at rest, access control, row-level security, logging and backups.
Assist the customer, by appropriate measures, with data subject requests, security, breach notification, impact assessments and consultations with authorities.
Notify the customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach.
5. Sub-processors
The customer gives general authorisation for sub-processors: Supabase, Vercel, Vapi, Twilio and/or Telnyx, Resend, and the speech and language model providers used by the voice agent. We bind each by a contract with equivalent obligations and remain responsible for them.
We will give at least 15 days' notice of changes so the customer can object. If the objection is reasonable and cannot be resolved, the customer may terminate the affected service.
6. International transfers
Transfers outside the EEA rely on an adequacy decision or the Standard Contractual Clauses, with supplementary measures as needed.
7. Customer obligations
The customer must have a legal basis for the processing, must inform callers about recording and processing (Remute announces that the caller is speaking with a virtual assistant), and must obtain any consent required for call recording in the relevant jurisdictions.
8. Audits
We will provide the information needed to show compliance and allow reasonable audits, with notice, during business hours and subject to confidentiality. We may satisfy this through up-to-date certifications or reports of our providers where available.
9. Return and deletion
At the end of the service, or on request, we delete or return call data within 30 days, except where the law requires retention. Default retention while the service is active is described in the Privacy policy.
10. Liability and law
Liability follows the Terms of service. Governing law and jurisdiction: {{JURISDICTION}}, without prejudice to GDPR rules on competent authorities.