Roles, subject matter and duration
The shop is the controller for its customers’ data, and the PhoneDesk operator is a processor for hosting, storage, consultation, technical administration and export activities performed through the service. Processing lasts for the service relationship and agreed return or deletion activities. Categories include customers, suppliers and staff, with identity details, contact details and information about the shop’s operations.
Instructions and confidentiality
PhoneDesk processes this data only on the shop’s documented instructions, including instructions given through authorised CRM functions, unless required by law. Authorised people must be bound by confidentiality and access only what is necessary. The operator informs the shop if it considers that an instruction infringes data protection law.
Measures and providers
Measures include HTTPS transport encryption, separate access by shop, staff permissions, credential protection, event logging and backups with integrity checks. OVHcloud provides the infrastructure and email service. Additional subprocessors handling shop data require advance information and the opportunity to raise a reasoned objection; any transfers outside the European Economic Area require the applicable safeguards.
Rights and incidents
Within the limits of available information and tools, PhoneDesk assists the shop with data subject requests, security, assessments required by law and breach handling. A personal data breach must be reported to the shop without undue delay after the operator becomes aware of it, with the information available and subsequent updates.
Return, deletion and audits
At the end of the service, the shop chooses return or deletion of the data, unless the law requires retention. Backup arrangements and timeframes must be considered when carrying out the instruction. The operator provides the information needed to demonstrate compliance with processor obligations and allows agreed, proportionate audits that respect security and other shops’ data.