GDPR & data protection.
Built for compliant calling.

Controller and processor roles

Data processing terms

Where AMDY processes personal data on your behalf, our data processing terms form part of the Terms of service and meet the requirements of Article 28 GDPR. They cover processing only on documented instructions, confidentiality of personnel, security measures, use of sub-processors, assistance with data subject requests and impact assessments, deletion or return of data at the end of the service, and audit information. To receive a countersigned copy, email hello@amdy.ai.

Sub-processors

We use carefully selected sub-processors for cloud hosting, payment processing, email delivery and customer support. Each is bound by written data protection terms at least as protective as ours. A current list is available on request, and we will notify customers before adding or replacing a sub-processor so they can object on reasonable grounds.

International transfers

If personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by transfer risk assessments and supplementary measures such as encryption in transit.

Technical and organisational measures

• Encryption of data in transit with TLS.
• Authentication by API key and registered IP allow-lists.
• Logical separation of customer accounts and data.
• Role-based access, least privilege and access logging for staff.
• Customer-controlled recording, retention periods and deletion.
• Monitoring, alerting and a documented incident response process.
• Fail-safe integrations that hand calls back to native AMD before any audio is used if the service is unavailable.

Data subject requests

Requests from people your organisation has called should be handled by you as controller. If we receive one, we will promptly forward it to you and not respond ourselves unless you instruct us to. We provide tools and assistance so you can locate, export and delete the relevant records.

Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we will notify the affected customer without undue delay and provide the information needed to meet their own notification duties. Where we are controller, we will notify the competent supervisory authority within 72 hours where required.

Retention and deletion

You decide whether recordings are kept and for how long, and you can delete them at any time. When your subscription ends, we delete Customer Data after a 30-day export window, unless the law requires us to keep it.

Your responsibilities as controller

As the business placing calls, you are responsible for:

• having a lawful basis to call each person and to process their call audio;
• providing any required notices, including call-recording notices;
• complying with direct-marketing rules such as PECR and screening against do-not-call registers such as the TPS where applicable;
• configuring retention and recording settings appropriate to your purposes.

Contact our privacy team

For GDPR questions, data processing terms or our sub-processor list: hello@amdy.ai.