Privacy is not just a legal formality to be checked off afterward, but a guiding principle in the design, implementation, and management of our solutions
Good customer service starts with trust. People share personal information because they expect it to be handled with care—whether it’s a customer inquiry, a conversation with a healthcare provider, or contact with the government.
Pegamento builds and manages the platforms that enable organizations to facilitate that contact. Privacy isn’t just a legal formality to check off afterward—it’s a fundamental principle in the design, implementation, and management of our solutions.
We help you maintain control over data without losing sight of the human side of customer interaction.
In most cases, as a customer, you are the data controller under the General Data Protection Regulation (GDPR), and Pegamento acts as the data processor. We process personal data exclusively on your behalf and in accordance with your documented instructions. We do not use the data we process on your behalf for our own purposes.
We set out these responsibilities in a data processing agreement, including provisions regarding security, subprocessors, retention periods, and the termination of services.
When designing your contact platform, we consider privacy from the very beginning. Specifically, this means:
Data minimization
We process only the data necessary for the intended purpose and configure our systems so that unnecessary information is not recorded.
Retention periods
Call recordings, chat logs, and customer data are automatically deleted after the retention period you specify, taking into account applicable legal obligations.
Access Restrictions
Only authorized employees have access to personal data. Access is logged.
Pseudonymization and Masking
Whenever possible, we mask sensitive data—such as payment information or social security numbers—in recordings and transcripts.
For the services in question, we process and store personal data within the European Economic Area (EEA). In doing so, we establish agreements regarding data location, access, and the use of vendors.
The fact that a vendor has an office outside the EEA does not automatically mean that data is processed outside the EEA. When data is transferred to a third country, we use an appropriate legal transfer mechanism, such as an applicable adequacy decision or standard contractual clauses, and we assess whether additional measures are necessary. In this way, we ensure transparency regarding data protection even when working with international suppliers.
AI can help employees answer customer questions more quickly, analyze conversations, or find relevant information. At the same time, applications such as speech analysis and AI-driven customer service can pose privacy risks.
That is why, when using AI, we take into account the GDPR and the applicable requirements of the EU AI Act, including transparency and human oversight where relevant. We assess not only what is technically possible, but also what is responsible.
Support with DPIAs
When an application may pose a high privacy risk, we support you in conducting a Data Protection Impact Assessment (DPIA). We provide the technical information you need for this. Responsibility for the DPIA lies with the data controller.
Does someone wish to access, correct, or have their personal data deleted? If so, we will help your organization process such a request carefully and within the statutory timeframes, to the extent that our services are involved.
If we discover a potential data breach that affects your data, we will notify you without undue delay and no later than 48 hours. We will share available information about the impact, the measures taken, and the next steps.
This will allow you to assess whether a report to the Dutch Data Protection Authority is necessary. In the event of a reportable data breach, the data controller generally has 72 hours from the time of becoming aware of the breach to report it; the data processor’s reporting obligation applies without undue delay.
Would you like to know how we protect personal data or what policies apply to your situation? Please review our privacy policy or contact us.
We’d be happy to help.
Schedule a 15-minute introductory meeting at
or call +31 (0)88 00 67 180
Deepen your knowledge with Pegamento’s white papers.