GDPR Statement

1. Roles

• You (our customer) are the data controller of the end-customer data you collect through Ravoqen (your callers, leads, patients, guests).
• Ravoqen is the data processor acting on your documented instructions.
• Ravoqen is the controller for its own website analytics, demo requests and billing data.

2. Lawful basis

We process data on the legal bases of contract, legitimate interest, consent and legal obligation, as described in the Privacy Policy.

3. Data subject rights

End customers (your callers) and our own customers have the right to:

• Access the personal data we hold about them.
• Request rectification of inaccurate data.
• Request erasure (the "right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Lodge a complaint with their national supervisory authority.

End-customer requests should normally be sent to you (the controller). We will support you on every request. Send our internal queries to contact@ravoqen.com.

4. Sub-processors

To operate Ravoqen we use a short list of vetted sub-processors covering hosting, telephony, conversational AI, messaging, payment, email delivery, monitoring and analytics. All sub-processors are bound by GDPR-compliant data-processing agreements. The current list is provided to every paying customer as part of the Data Processing Agreement and is available on written request at contact@ravoqen.com.

5. International transfers

Data is stored primarily in the European Union. Where a sub-processor is outside the EU/EEA, we rely on Standard Contractual Clauses (SCC) and supplementary measures.

6. Security

• TLS 1.2+ in transit, AES-256 at rest.
• Role-based access, least-privilege, audit logging.
• Daily encrypted backups with retention.
• Vulnerability scanning, dependency monitoring, patch management.
• Incident response plan with notification within 72 hours where required.

7. Data Processing Agreement

A Data Processing Agreement (DPA) is available to every paying customer on request. The DPA covers Art. 28 GDPR obligations, sub-processor list, security measures and transfer mechanisms.

8. Retention & deletion

Conversation transcripts and audio are retained for up to 12 months by default and can be reduced per customer. On termination, customer data is deleted within 30 days unless legal retention applies.

9. Healthcare and special-category data

Ravoqen is designed as a general-purpose business assistant and is configured, by default, to avoid the processing of special-category data under Art. 9 GDPR. For healthcare-adjacent customers (clinics, dental practices, wellness centres), the assistant collects only the caller’s name and contact details, appointment date and time, and a short general reason for the visit. It does not record, transcribe or store diagnoses, test results, prescriptions or other detailed medical information. Any deeper processing of health data requires a signed Data Processing Agreement and appropriate safeguards under Art. 9(2) GDPR.

10. Data Protection Officer

For data protection matters, contact: contact@ravoqen.com.