--- title: "Privacy" url: "https://pegamento.nl/en/trust-center/privacy/" lang: "en" type: "page" description: "Privacy as a Foundation Privacy is not just a legal formality to be checked off afterward, but a guiding principle in the design, implementation, and management of our solutions Questions About Privacy Careful with data. Trustworthy in every interaction. Good" last_modified: "2026-10-20T07:42:48+00:00" translations: nl: "https://pegamento.nl/trust-center/privacy/" --- # Privacy # Privacy as a Foundation Privacy is not just a legal formality to be checked off afterward, but a guiding principle in the design, implementation, and management of our solutions [ Questions About Privacy ](#privacy) ## Careful with data. Trustworthy in every interaction. Good customer service starts with trust. People share personal information because they expect it to be handled with care—whether it’s a customer inquiry, a conversation with a healthcare provider, or contact with the government. Pegamento builds and manages the platforms that enable organizations to facilitate that contact. Privacy isn’t just a legal formality to check off afterward—it’s a fundamental principle in the design, implementation, and management of our solutions. We help you maintain control over data without losing sight of the human side of customer interaction. ### Clear Responsibilities In most cases, as a customer, you are the data controller under the General Data Protection Regulation (GDPR), and Pegamento acts as the data processor. We process personal data exclusively on your behalf and in accordance with your documented instructions. We do not use the data we process on your behalf for our own purposes. We set out these responsibilities in a data processing agreement, including provisions regarding security, subprocessors, retention periods, and the termination of services. ### Privacy by design and by default When designing your contact platform, we consider privacy from the very beginning. Specifically, this means: **Data minimization** We process only the data necessary for the intended purpose and configure our systems so that unnecessary information is not recorded. **Retention periods** Call recordings, chat logs, and customer data are automatically deleted after the retention period you specify, taking into account applicable legal obligations. **Access Restrictions** Only authorized employees have access to personal data. Access is logged. **Pseudonymization and Masking** Whenever possible, we mask sensitive data—such as payment information or social security numbers—in recordings and transcripts. ### Control over the location of your data For the services in question, we process and store personal data within the [European Economic Area (EEA)](https://pegamento.nl/en/digital-sovereignty/). In doing so, we establish agreements regarding data location, access, and the use of vendors. The fact that a vendor has an office outside the EEA does not automatically mean that data is processed outside the EEA. When data is transferred to a third country, we use an appropriate legal transfer mechanism, such as an applicable adequacy decision or standard contractual clauses, and we assess whether additional measures are necessary. In this way, we ensure transparency regarding data protection even when working with international suppliers. ### Privacy and the responsible use of AI AI can help employees answer customer questions more quickly, analyze conversations, or find relevant information. At the same time, applications such as speech analysis and AI-driven customer service can pose privacy risks. That is why, when using AI, we take into account the GDPR and the applicable requirements of the EU AI Act, including transparency and human oversight where relevant. We assess not only what is technically possible, but also what is responsible. **Support with DPIAs** When an application may pose a high privacy risk, we support you in conducting a Data Protection Impact Assessment (DPIA). We provide the technical information you need for this. Responsibility for the DPIA lies with the data controller. ### Rights of data subjects Does someone wish to access, correct, or have their personal data deleted? If so, we will help your organization process such a request carefully and within the statutory timeframes, to the extent that our services are involved. ### Data breaches: act quickly and carefully If we discover a potential data breach that affects your data, we will notify you without undue delay and no later than 48 hours. We will share available information about the impact, the measures taken, and the next steps. This will allow you to assess whether a report to the Dutch Data Protection Authority is necessary. In the event of a reportable data breach, the data controller generally has 72 hours from the time of becoming aware of the breach to report it; the data processor’s reporting obligation applies without undue delay. In most cases, as a customer, you are the data controller under the General Data Protection Regulation (GDPR), and Pegamento acts as the data processor. We process personal data exclusively on your behalf and in accordance with your documented instructions. We do not use the data we process on your behalf for our own purposes. We set out these responsibilities in a data processing agreement, including provisions regarding security, subprocessors, retention periods, and the termination of services. When designing your contact platform, we consider privacy from the very beginning. Specifically, this means: **Data minimization** We process only the data necessary for the intended purpose and configure our systems so that unnecessary information is not recorded. **Retention periods** Call recordings, chat logs, and customer data are automatically deleted after the retention period you specify, taking into account applicable legal obligations. **Access Restrictions** Only authorized employees have access to personal data. Access is logged. **Pseudonymization and Masking** Whenever possible, we mask sensitive data—such as payment information or social security numbers—in recordings and transcripts. For the services in question, we process and store personal data within the [European Economic Area (EEA)](https://pegamento.nl/en/digital-sovereignty/). In doing so, we establish agreements regarding data location, access, and the use of vendors. The fact that a vendor has an office outside the EEA does not automatically mean that data is processed outside the EEA. When data is transferred to a third country, we use an appropriate legal transfer mechanism, such as an applicable adequacy decision or standard contractual clauses, and we assess whether additional measures are necessary. In this way, we ensure transparency regarding data protection even when working with international suppliers. AI can help employees answer customer questions more quickly, analyze conversations, or find relevant information. At the same time, applications such as speech analysis and AI-driven customer service can pose privacy risks. That is why, when using AI, we take into account the GDPR and the applicable requirements of the EU AI Act, including transparency and human oversight where relevant. We assess not only what is technically possible, but also what is responsible. **Support with DPIAs** When an application may pose a high privacy risk, we support you in conducting a Data Protection Impact Assessment (DPIA). We provide the technical information you need for this. Responsibility for the DPIA lies with the data controller. Does someone wish to access, correct, or have their personal data deleted? If so, we will help your organization process such a request carefully and within the statutory timeframes, to the extent that our services are involved. If we discover a potential data breach that affects your data, we will notify you without undue delay and no later than 48 hours. We will share available information about the impact, the measures taken, and the next steps. This will allow you to assess whether a report to the Dutch Data Protection Authority is necessary. In the event of a reportable data breach, the data controller generally has 72 hours from the time of becoming aware of the breach to report it; the data processor’s reporting obligation applies without undue delay. [ Read our full privacy statement ](https://pegamento.nl/en/privacy-policy-2/) ## What does this mean for you? - Clear responsibilities, set forth in a data processing agreement. - Privacy by design, data minimization, and retention periods tailored to your processes. - Control over access, processing, and storage of personal data. - Transparent agreements regarding data processing within the EEA and with international suppliers. - Support with DPIA’s, data subject rights, and data breaches. - Responsible use of AI, with a focus on privacy and human oversight. ## Want to learn more about our privacy policy? Would you like to know how we protect personal data or what policies apply to your situation? Please review our [privacy policy](https://pegamento.nl/en/privacy-policy-2/) or contact us. ## Partnerships ![KVK-Sprinklr-referentie](https://pegamento.nl/wp-content/uploads/2025/04/KVK-Sprinklr-Referentie.png) ![Logo OOZ als referentie voor Pegamento](https://pegamento.nl/wp-content/uploads/2026/08/Beeldmerk-OOZ-samenmeerkracht-01-300x249-1.png) ![Luisterlijn-referentie](https://pegamento.nl/wp-content/uploads/2025/04/Luisterlijn-referentie.png) ![113: bereikbaarheid van zelfmoordpreventie](https://pegamento.nl/wp-content/uploads/2025/04/113-zelfmoordpreventie-bereikbaarheid.png)