Privacy.
AI Phone Assistant

1) Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described below in connection with the AI telephone assistant is:

2) Scope of these privacy notices

These privacy notices apply exclusively to the processing of personal data within the scope of our AI telephone assistant, which can be reached on the number +49 2421 6973021 is reachable.

The separate information under the following applies to the processing of personal data when you visit our website: datenschutz.html.

3) Description of the AI phone assistant

We use an AI-powered telephone assistant that takes incoming calls, answers simple questions, records callback requests and, on request, suggests appointments. The assistant is made up of several specialised services: telephony, real-time speech recognition, a language model for generating responses, speech synthesis and hosting. We are responsible for its selection, configuration and operation; the individual technical service providers are listed under section 6.

At the start of every call, callers are automatically told that their conversation partner is an AI voice assistant and not a human. Callers can end the call at any time or ask to be transferred to a human contact.

4) Processed data

The following data is processed as part of your call:

• Your phone number (transmitted via caller ID, unless you have suppressed it)
• Your voice recording during the call (for live transcription, not stored permanently)
• The transcript of what you say and of the AI's replies
• A textual summary of your request
• If you provide them: your name, preferred callback time, other contact details
• Connection metadata: call time, call duration

Processing further personal data, in particular special categories under Art. 9 GDPR (e.g. health data), is not intended. We ask you not to share such information through the AI phone assistant, but to contact us directly.

5) Processing purposes and legal basis

Purposes: Receiving and recording your request, answering general questions, arranging a callback, and initiating and carrying out pre-contractual measures.

Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary to take pre-contractual steps at your request, and otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in handling incoming inquiries efficiently and keeping them reachable. You will be informed at the start of the conversation that AI is being used, you can ask for processing by a human, and you can end the conversation at any time. Simply continuing the conversation is not presented as consent under data protection law.

6) Service providers used (processors under Art. 28 GDPR)

For the technical implementation of the telephone assistant, we use the following specialised service providers. With all the providers named, data processing agreements in accordance with Art. 28 GDPR are in place.

6.1 Telephony and call routing — Twilio

Provider: Twilio Ireland Limited, 25-28 North Wall Quay, Dublin 1, D01 H104, Ireland.
Data processed: Caller number, connection data (date, time, duration), audio signal of the call during the active connection.
Seat and third-country transfers: The contract partner and the primary processing location are in the EU (Ireland). A recording function is disabled in our configuration.
Privacy notice: twilio.com/legal/privacy

6.2 Speech recognition — Deepgram

Provider: Deepgram, Inc., 1719 California St, Denver, CO 80202, USA.
Data processed: Audio stream of your call for real-time transcription (speech-to-text).
Third-country transfer: USA. We use the EU endpoint. api.eu.deepgram.com; transfers to the USA are safeguarded by standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
Privacy notice: deepgram.com/privacy

6.3 Language model — Anthropic

Provider: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA.
Data processed: Transcribed call content used to generate the assistant's replies (AI model “Claude”).
Zero Data Retention (ZDR): Processing at Anthropic takes place with Zero Data Retention mode enabled. This means Anthropic does not store the submitted content beyond the immediate response to the request, and does not use it to train its AI models.
Third-country transfer: USA. Anthropic is self-certified under the EU-US Data Privacy Framework; the transfer is therefore based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. Standard contractual clauses additionally apply as a fallback pursuant to Art. 46(2)(c) GDPR.
Privacy notice: anthropic.com/legal/privacy

6.4 Speech synthesis — ElevenLabs

Provider: ElevenLabs, Inc., 169 Madison Avenue, Suite 2438, New York, NY 10016, USA.
Data processed: Generated response texts for conversion into synthetic speech (text-to-speech) that you hear on the phone.
Third-country transfer: USA. ElevenLabs has joined the EU-US Data Privacy Framework; the European Commission has determined an adequate level of data protection for certified US companies (Art. 45 GDPR). In addition, the Standard Contractual Clauses from the data processing agreement apply.
No use for AI training: In our ElevenLabs account, we have objected to the use of data from our workspace for training AI models.
Privacy notice: elevenlabs.io/privacy

6.5 Application hosting — Hetzner

Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
Data processed: Orchestration of call processing, temporary storage of transcripts and summaries.
Seat and third-country transfers: Processing takes place exclusively on servers in Germany (data centre in Nuremberg). No transfer to third countries takes place.
Privacy notice: hetzner.com/legal/privacy-policy

7) Transfers to third countries

As outlined under point 6, processing by Deepgram, Anthropic and ElevenLabs partially a transfer to the USA.

Data transfers to the USA are safeguarded by (i) the EU Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework pursuant to Art. 45 GDPR, provided the respective provider is self-certified under this framework, and (ii) the Standard contractual clauses (SCCs) of the European Commission pursuant to Art. 46 (2)(c) GDPR as a supplementary safeguard. You can check the current certification status at dataprivacyframework.gov Look it up.

8) Retention period and AI training

We store the data processed during your call only for as long as necessary to handle your matter and as statutory retention periods require:

• Audio recordings: are not stored permanently. The audio signal is processed exclusively in real time (streaming) and is not retained after the call ends.
• Transcripts and summaries: are used for a maximum of six (6) months stored so that questions about your request can be processed. They are deleted automatically afterwards.
• Connection data (phone number, date, time, duration): will be stored for a maximum of three (3) months stored for billing and security purposes.
• Matters that lead to business correspondence or an order: are subject to the commercial and tax retention periods (usually 6 or 10 years under § 257 HGB / § 147 AO).

No AI training with your data: Data collected via the telephone assistant is not used to train AI models. The service providers named under point 6 are contractually obliged to use transmitted content solely to provide the processing service you have commissioned, and not for their own training or model improvement purposes (cf. data processing agreements pursuant to Art. 28 GDPR).

9) Labelling as an AI system

At the start of every conversation, you will be automatically informed that your conversation partner is an AI voice assistant and not a human. This fulfils the transparency obligation under Art. 50(1) of Regulation (EU) 2024/1689 (AI Act). You can end the call at any time or ask to be passed on to a human contact.

10) No automated decision-making

The AI phone assistant is used solely to record and structure your request and to answer general questions. No automated decision in the individual case with legal effect for you, or with a similarly significant effect within the meaning of Art. 22 GDPR, takes place. We personally handle the final processing of your request.

11) Your rights as a data subject

Under the applicable data protection law, you have the following data subject rights with respect to us regarding the processing of your personal data:

• right of access under Art. 15 GDPR;
• Right to rectification under Art. 16 GDPR;
• Right to erasure under Art. 17 GDPR;
• Right to restriction of processing under Art. 18 GDPR;
• Right to information under Art. 19 GDPR;
• Right to data portability under Art. 20 GDPR;
• Right to withdraw consent given, pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint under Art. 77 GDPR.

To exercise your rights, an informal notice to the contact details listed under point 1 is sufficient.

12) Right of objection and right to lodge a complaint

Objection: Insofar as processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You can end the call, request human handling during the conversation, or contact us afterwards by email at [email protected] or contact us in writing at the address given under point 1.

Right to complain: If you believe that the processing of your personal data infringes the GDPR, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority of your choice. The supervisory authority responsible for us is:

13) Voluntary use — alternative contact options

Using the AI phone assistant is optional. You can alternatively reach us through the classic channels: by email at [email protected], via the contact form on kontakt.html or by phone at 0173 4018320.