GDPR and data protection at Debesis

What companies want to know before rolling out Debesis: who is responsible for what, where data is stored and how it is protected.

Roles: controller and processor

For the personal data you process in Debesis — customer requests, call recordings, transcripts — you are the controller under the GDPR. Debesis processes this data on your behalf as a processor.

This is governed by a data processing agreement under Art. 28(3) GDPR, covering scope and purpose, our obligations, the use of sub-processors and the deletion or return of data at the end of the contract. It is signed before we process any data.

Where data is stored

• Platform hosting, databases and backups are located in Poland, within the European Economic Area.
• AI features — the AI voice assistant with speech recognition, speech synthesis and language understanding, as well as classification, summaries and reply suggestions — use models from external providers, including OpenAI and Google, processed in data centres in the EU.
• The list of sub-processors is available on request.

Technical and organisational measures

• Access: least privilege, unique user IDs, role-based permissions, regular account reviews and multi-factor authentication for administrative access. In the Extended and Complete plans users can sign in with Microsoft Entra ID — with MFA under your IT team’s policies — and password sign-in can be switched off.
• Encryption: data is encrypted in transit and at rest; connections over public networks use TLS or VPN.
• Logging and monitoring: events are collected and analysed centrally, audit logs are archived, security alerts are handled under a defined procedure.
• Availability: backups in separate locations, business continuity policies and regular recovery tests; the committed availability is 99% per month.

Retention and deletion

You set retention periods, the scope of data collected and access to recordings and transcripts for your account. At the end of the contract data is deleted or returned in line with the data processing agreement.

Call recording and the AI voice assistant

As the controller, you decide whether and which calls are recorded. You can add an announcement informing callers in the IVR.

The AI voice assistant introduces itself as an automated assistant at the start of every call, as the EU AI Act requires for systems that interact with people. Decisions that need a human are handed over to your team.

Certification

We do not currently hold ISO 27001 certification. We set out our technical and organisational measures in the data processing agreement and are happy to complete your security questionnaire.

Contact

Data protection officer: iod@debesis.pl. The lead supervisory authority is the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw. How we process data on this website is described in the privacy policy. This page is for information only and is not legal advice.

ImprintPrivacy policyGDPRCookie policyCookie settings