Roles of the parties
For call and prospect data imported or captured by an organization, the customer acts as controller and CloseLynx as processor within the meaning of Article 28 of the GDPR. CloseLynx remains controller of the processing required to manage its own accounts, security and obligations.
Subject matter and duration
Processing covers user-triggered audio capture, transcription, analysis of explicit statements, suggestions, summaries, scores, follow-ups, storage, export, support and deletion. It lasts for the provision of the service and then according to the applicable retention periods and obligations.
Documented instructions
The features enabled, the calls started, the authorized members and the retention settings constitute the customer’s documented instructions. CloseLynx informs the customer when an instruction appears to infringe the law, unless legally prohibited from doing so.
Confidentiality and access
Authorized people and services access data only for the needs of the product, support, security or maintenance. Access is limited, logged and subject to appropriate confidentiality obligations.
Sub-processors
CloseLynx may use hosting, storage, transcription, generation, email and monitoring providers offering appropriate safeguards. Significant changes are communicated according to the contractual terms so that the customer can exercise its rights.
Technical and organizational measures
Measures include encryption in transit, private storage, logical separation per organization, role controls, minimization, short-lived tokens, audit logs, rate limits, backups, restore tests, monitoring and deletion procedures.
Incidents
CloseLynx analyzes incidents affecting data and provides the customer with useful information when a breach is likely to concern its processing, to help it meet its own notification obligations.
Rights and assistance
The product provides export and deletion features. CloseLynx provides reasonable assistance with requests for access, rectification, erasure, restriction, portability and objection, and with impact assessments related to the use of the service.
Return and deletion
Data can be exported before deletion. Deleting an account or organization removes the associated objects, processing and data after checking rights and that no operation is active. Backups follow their secure expiry cycle.
Location and transfers
The architecture favors European hosting. When a provider involves a transfer outside the European Economic Area, recognized safeguards such as standard contractual clauses and appropriate supplementary measures are used.