Privacy policy

1. Who we are

Elevox Systems OÜ is a private limited company registered in Estonia under registry code 17640821, with its registered address at Harju maakond, Tallinn, Kesklinna linnaosa, Järvevana tee 9, 11314. You can reach us about privacy at hello@elevoxcx.com.

We are the controller of the personal data you give us through this website and its enquiry form, and of the data we keep to run and protect the website.

When a customer uses Elevox CX to analyse its calls, emails and other contacts, that customer is the controller of the personal data in them and we are its processor (see section 10).

Our representative in the United Kingdom under Article 27 of the UK GDPR: [UK representative: to be confirmed].

2. What we collect through the enquiry form

When you request access or a demo, we keep:

• your name, work email address, company and job title;
• your phone number and your message, if you give them (both are optional);
• the size of your contact centre and the platform you use, as you choose them;
• your agreement to be contacted and the time you gave it;
• when the form was sent, the page it was sent from and your browser's user agent (the text a browser sends to say what it is);
• a one-way keyed hash of your IP address, so that we can recognise repeated abuse of the form. We never store the address itself in the enquiry: it is replaced by an HMAC computed with a key held in AWS Key Management Service, which cannot be turned back into the address.

The form also uses a hidden field and a minimum time to send to stop automated spam. Those checks are made when you send the form and are not stored.

3. Logs and error monitoring

The service that receives the enquiry form records each request in an access log (including your IP address, the time and the result) to keep it secure and working. Our firewalls record requests they block or flag, with the IP address. These logs are kept for 30 days. The firewall in front of the website itself keeps its logs in AWS's US East (N. Virginia) region, because AWS requires that for this kind of firewall; the others are kept in the AWS region that serves this website.

When it is switched on for a build, the website and app report errors and performance measurements (page load times, the paths of the pages visited and the timing of requests the page makes) to Amazon CloudWatch RUM, an AWS monitoring service, so that we can find and fix problems. It sets no cookies. To send this data, your browser keeps an anonymous identifier and short-lived AWS credentials in its local storage. We do not use this data to identify you or for marketing. AWS keeps it for 30 days.

4. Cookies and local storage

The public website sets no cookies, and we use no advertising, analytics or tracking services from third parties.

The website and app store a few items in your browser's local or session storage so that they work as you expect:

• your language (elevox.lang) and your light or dark theme (elevox.theme), if you choose them;
• the CloudWatch RUM identifier and credentials described in section 3, when monitoring is on;
• after you sign in to Elevox CX: your sign-in tokens, your email address if you ask the sign-in page to remember it, the progress of an upload so that it can resume, and short-lived markers used when the app reloads or asks you to confirm your identity again;
• after you sign in, the app also sets one cookie, sidebar_state, which remembers for seven days whether the navigation sidebar is open.

All of these are needed for the features you use or remember choices you made, so we do not ask for consent to them. You can clear them at any time in your browser's settings; you will then be signed out and your choices forgotten.

5. Why we use your data and our legal bases

• To reply to your enquiry, arrange a demo and discuss access: your consent, given on the form, and the steps you ask us to take before entering into a contract. You can withdraw your consent at any time by writing to us; this does not affect what we did before.
• To keep the form, the website and the app secure, prevent abuse and fix errors: our legitimate interest in running a secure and reliable service.
• To keep records we need for legal claims or to meet legal obligations: our legal obligations, or our legitimate interest in defending our rights.

We do not sell your data, use it for advertising, or make decisions about you by automated means alone.

6. Who receives your data

We share personal data only with the service providers we need to run Elevox, under contracts that require them to protect it and use it only on our instructions:

• Amazon Web Services EMEA SARL and Amazon Web Services, Inc., as applicable (AWS), our hosting and processing subprocessor: hosting and storage (Amazon DynamoDB, Amazon S3, Amazon CloudFront), the enquiry notification (Amazon SNS) and other email (Amazon SES), sign-in (Amazon Cognito), security (AWS WAF, AWS Key Management Service) and monitoring (Amazon CloudWatch, including CloudWatch RUM).
• AWS also provides the environment in which AI processing of customers' calls is performed (section 10). Enquiry data is never sent for AI processing.
• Our team's email provider, which receives the enquiry notification.

We may also disclose data to our professional advisers, to a buyer of our business, or to authorities when the law requires it.

7. Where your data is held, and international transfers

Enquiries are stored in the AWS region that serves this website; customer data is stored in the AWS region chosen for the customer's workspace. We are established in Estonia, in the European Union: where data is held in the United Kingdom, transfers from the EU to the UK rely on the European Commission's adequacy decision for the United Kingdom, and transfers from the UK to the EU on the UK's adequacy regulations for the European Economic Area. Where the chosen region is outside the United Kingdom and the European Economic Area, the transfer terms are set out in the customer's data processing agreement.

The website firewall's logs are held in the United States (section 3). AWS may also access data from other countries to provide support and keep its services secure. Where data leaves the UK or the EEA in these ways, we rely on AWS's data processing terms, which include the European Commission's standard contractual clauses and the UK's international data transfer addendum.

8. How long we keep it

• Enquiries are deleted automatically 24 months after they arrive, or sooner if you ask us.
• Access and firewall logs are deleted after 30 days.
• CloudWatch RUM data is deleted by AWS after 30 days.
• If you become a customer, our correspondence and contract records are kept for as long as the contract lasts and then for the period the law requires for accounting and legal claims.

9. Your rights and how to use them

Under the UK GDPR and the GDPR you have the right to:

• ask for a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it, or object to our use of it based on legitimate interests;
• receive data you gave us in a portable format;
• withdraw your consent at any time.

To use any of these rights, write to hello@elevoxcx.com. We may ask you to confirm your identity. We will answer within one month, free of charge, and explain if we need longer or cannot do what you ask.

If you are unhappy with how we handle your data, please tell us first so that we can try to put it right. You also have the right to complain to a data protection authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); in the United Kingdom, the Information Commissioner's Office (ico.org.uk); or the authority where you live or work in the EU or EEA.

10. Data we process for our customers

Our customers use Elevox CX to analyse recordings and other records of their contacts, such as call audio, transcripts, emails, the names of their agents and customers, and the evaluations and coaching built from them. For that data the customer is the controller and decides why and how it is processed; we act only on its instructions, under a data processing agreement with it.

We store that data in the AWS region chosen for the customer's workspace. AI processing is performed within our AWS environment, in that region or, where the AI service requires it, in other AWS regions in the same geography; nothing sent for processing elsewhere is stored there. A UK-only processing mode is available for workspaces in the United Kingdom. We do not use customer data to train AI models. Card numbers and other sensitive details can be redacted from transcripts and audio by the customer's settings.

If you called or wrote to one of our customers and want to use your rights over that data, please contact that organisation. If you contact us, we will pass your request on to it.

11. Children

This website and Elevox CX are for businesses and are not directed at children. We do not knowingly collect children's data through the website.

12. Changes to this policy

We will update this policy when what we do changes, and show the date of the latest version at the top of the page. If a change is significant, we will say so on this page and, where we have your contact details for an open enquiry, tell you.