Privacy Policy

1. Who we are

Controller for the processing described in this Privacy Policy (where the Company determines purposes and means) is SmartestVoice, Athens, Greece, support@smartestvoice.com, +30 2100140919.

For personal data processed by the Customer through the Service for the Customer's own purposes (including call content and caller data), the Customer is the Controller and the Company acts as Processor under the DPA.

2. Key transparency notice for AI calls

The Service is designed for the Customer's phone interactions with its own clients. At the start of every call, the Service announces that the caller is speaking with an artificial intelligence system (Article 50(1) of Regulation (EU) 2024/1689).

Where the Customer has enabled call recording, callers are also informed that the call is recorded and are directed to the relevant privacy information (Article 4(3) of Greek Law 3471/2006). The Company provides technical means for such disclosures (e.g., pre-answer messages) where available. The Customer remains responsible for the content and legal adequacy of disclosures relating to its own processing.

3. Personal data we process as Controller

The Company may process:

• account and administrator details (name, email, phone, company details),
• billing and invoicing data (address, tax identification data, invoices, payment history),
• security data and logs (IP address, device/browser data, access logs, security events),
• support communications (tickets, emails, chat messages).

4. How we process personal data when Customers use the Service

When a Customer uses the Service, Customer Data may be processed, including Call Content. In those cases, the Company typically acts as Processor and the DPA applies, including its sub-processor and transfer provisions (e.g., ElevenLabs).

5. Purposes and legal bases (Company as Controller)

The Company processes the data in Section 3 for:

• providing and administering accounts and customer support (performance of contract, Article 6(1)(b) GDPR),
• billing, accounting, and tax compliance (legal obligation, Article 6(1)(c) GDPR),
• security, fraud prevention, abuse detection, and service integrity (legitimate interest, Article 6(1)(f) GDPR),
• compliance with legal obligations and responses to lawful requests from authorities (legal obligation),
• service improvement and analytics, typically in aggregated or non-identifiable form (legitimate interest).

6. Sharing of data – categories of recipients

The Company may disclose data to:

• infrastructure providers (hosting, email, monitoring, security),
• payment and invoicing providers,
• legal, professional, and audit advisors under confidentiality,
• competent authorities, where required by law.

For Customer Data processed in the Service, recipients may include the sub-processors listed in the DPA, including ElevenLabs where enabled.

7. International transfers (United States – ElevenLabs)

The Service may involve transfers to the United States when voice AI functions are enabled and used through ElevenLabs.

Such transfers are performed under the DPA with appropriate safeguards, which may include reliance on the European Commission adequacy decision 2023/1795, where applicable, and/or Standard Contractual Clauses (SCC), as appropriate for the relevant data flow and party roles.

8. Retention

The Company retains personal data processed as Controller for as long as needed for the purposes above, for compliance with legal obligations, and for the establishment, exercise, or defense of legal claims.

Retention of Customer Data is governed by the DPA and Service settings (where available).

9. Data subject rights

Where applicable, individuals may request access, rectification, erasure, restriction, portability, or object to processing.

For personal data processed by a Customer as Controller through the Service, requests should be directed primarily to the Customer. The Company will assist the Customer under the DPA.

Every individual has the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

10. Security

The Company implements appropriate technical and organisational measures to protect personal data, as described in the DPA.

11. Cookies

Use of cookies on the Company website/platform is described in the Cookie Policy.

12. Contact

• Email: support@smartestvoice.com
• Address: Athens, Greece
• Phone: +30 2100140919