Data processing agreement

Who decides what

What the agreement covers

The agreement applies for as long as your company uses Robocaller. It covers the people whose data you put in it: your users, and the leads, contacts and other people you message, call or send agreements to.

It follows Article 28 of the GDPR. In it, Gibox Oy agrees to:

• process your data only on your documented instructions: our terms, your settings and what you tell us in writing, including on transfers outside the EU and EEA, unless the law requires otherwise
• tell you if we think an instruction breaks data protection law
• make sure everyone who handles it is bound to confidentiality
• protect it with appropriate technical and organisational measures, summarised on our Security page
• use subprocessors only as described below, pass the same data protection duties on to them, and remain responsible to you for them
• help you answer people who ask to see, correct or delete their data, and forward any such request that reaches us
• tell you without undue delay about a personal data breach that affects your data
• help with your security, impact assessments and any prior consultation with the authority when our information is needed
• return or delete your data, including existing copies, when the service ends, as you choose
• give you the information you need to check that we keep these promises, and allow audits

Your part

• You need a lawful basis for the data you bring into Robocaller and for your outreach.
• You tell the people you contact how you use their data. Messages sent through Robocaller don’t do this for you.
• Don’t add sensitive data, such as health information, to Robocaller. It isn’t built for it.

Subprocessor categories

We use service providers in the categories below to run Robocaller. The full list, with each provider’s name, purpose, the personal data it receives, its location and its transfer safeguard, is an annex to this agreement. Signed-in workspace admins also find it in Robocaller’s settings, and you can ask us for it before you sign up.

Signed-in admins: open the full subprocessor list.

Who isn’t a subprocessor

Some parties receive personal data but don’t process your workspace data on our behalf. They act under their own terms:

• Google, Microsoft and LinkedIn, when you connect your own account. Robocaller reads and sends data through it on your instruction, and the provider handles that data under your own agreement with it.
• Telephone network operators that carry your calls and text messages, and our telephony provider for call and message traffic data. They are independent controllers of that traffic data.
• Our payment and e-invoicing providers, which handle our billing with your company and don’t receive your workspace data.
• Public registers such as the Finnish trade register (PRH and YTJ) and Statistics Finland, which only receive search terms from us.

Changes to subprocessors

At least 30 days before a new subprocessor starts processing your data, we email your workspace admins its name, what it will do and where, and update the list. If you object on data protection grounds, tell us within that time and we’ll look for a solution. If we can’t agree, you can end the affected service before the change takes effect.

Transfers outside the EU and EEA

Some subprocessors, or their own subprocessors, process personal data outside the EU and EEA, mainly in the United States and in some cases Singapore or Israel. Those transfers rely on the EU–US Data Privacy Framework, the European Commission’s adequacy decision for Israel, its standard contractual clauses or binding corporate rules, as set out in each provider’s data processing terms. The full list names the safeguard for each provider, and you can ask us for a copy.

Getting the agreement

Email support@robocaller.io with your company name and business ID, and we’ll send you the agreement to sign, with its annexes, including the full subprocessor list.