Privacy Policy

1. Controller

Telvia Comunicaciones S.L., Spanish tax ID B22615314, Calle Rosselló 42, 08328 Alella, Barcelona, Spain, operates Atendy. Contact info@atendy.es for privacy or rights requests, with “Atendy Privacy” in the subject.

2. Controller and processor roles

Telvia is controller for website, signup, security, billing, support, its own marketing and request-management data. When a customer configures agents for its contacts, patients, leads, customers or end users, that customer is controller and Telvia is processor under its instructions and the applicable agreement.

3. Data we may process

Account: email, user identifiers, authentication data, company, preferences and settings. Business enquiries: name, company, email, phone, sector, call volume and submitted messages. Communications with Atendy: contact details, enquiries, supplied documents and follow-up.

Agents: prompts, rules, schedules, voices, limits, integrations, variables, tools, knowledge bases and call settings. Conversations: phone numbers, audio, recordings, transcripts, messages, duration, cost, outcome, escalation reasons, technical logs and executed actions.

Integrations: identifiers or credentials for connected services such as calendars, shops, messaging, CRM and telephony. Technical data: IP, device, browser, security events, errors, session activity and operating logs. Billing: tax details, usage, plan, amounts, payment incidents and accounting documents. Partner attribution: referral code, associated partner, registration date and commercial status needed for attribution.

4. Purposes and legal bases

Account creation/maintenance and platform provision: contract or requested pre-contractual steps. Customer-configured call/audio/transcript processing: processing on instructions; the customer determines the applicable basis towards its interlocutors, such as consent, contract or legitimate interests. Support: contract or requested pre-contractual information.

Security and abuse prevention: legitimate interests in protecting accounts, service integrity and preventing fraud and unauthorised access; legal obligations where applicable. Billing/accounting: contract and legal duties. Forms/demos: pre-contractual steps requested by the person. Partner attribution: pre-contractual steps and relevant commercial agreements; partners see programme tracking, with additional verification protecting contact details.

Our marketing: consent or, for existing customers, legitimate interests for similar services under article 21.2 of Spain’s LSSI, always with an opt-out. Electronic marketing requires consent or a prior contractual relationship, lawfully obtained contact details and our own similar products/services. Registration alone is not marketing consent. A simple free opt-out is provided on collection and in every message; you may also object at info@atendy.es.

Data needed for account creation, authentication, requested functions and invoicing are contractual or legal requirements; without them the related function cannot be provided. Optional data and marketing consent are not conditions of contracting. You may object to legitimate-interest processing under the GDPR.

Sources include you, your company’s authorised persons, received communications and activated integrations. Customer-controlled interlocutor/contact data come from their conversations, lists or connected services; that customer is responsible for explaining sources and purposes.

5. Calls, recordings, voice and AI

Atendy may record, transcribe and analyse conversations for customer review, action audits, rule improvements, cost measurement and human escalation. Customers must clearly explain the agent, any recording/transcription, purposes and how to exercise rights.

AI processes conversations to generate responses, transcripts, summaries and requested actions. Customers must identify the controller and explain purposes, legal basis and retention. An AI notice does not replace privacy information or required consent.

For communications addressed to Atendy, AI tools may classify enquiries and prepare replies or summaries for our team. General questions may receive automated responses. Necessary content may be processed by section 7 providers. Human assistance is available at info@atendy.es.

Voice is processed to conduct conversations and generate audio or text. Atendy does not use voice for biometric identification. The platform must not be configured for solely automated legally or similarly significant decisions without human review and an appropriate basis. Set escalation rules for uncertainty, conflict, requests for a person, urgency and sensitive information.

Embedded voice widget: public agents may be embedded on customer or Atendy websites. Starting a conversation processes voice, transcribes and stores the conversation under the agent owner’s account and records audio if enabled. Before starting, the widget displays a notice and a link to the applicable privacy policy. Rights may be exercised with the named controller or through us.

6. Sensitive data and regulated sectors

Atendy does not request special-category data by default. Conversations may nevertheless include health, financial, complaint, debt, employment or other sensitive information. Customers must configure suitable instructions, notices, legal bases, retention and permissions for their sector and jurisdiction.

Special categories such as health data additionally require a GDPR article 9 condition. Financial/debt data are not automatically special categories, but need appropriate protection. Minimise collection and assess whether high-risk processing requires a data protection impact assessment.

6a. Tools, call transfers and notifications

Activated calendar, CRM, shop or other tools send necessary query/action data and use responses to assist callers. Arguments, results and disclosed data may appear in transcripts and call tool logs, subject to section 10.

Transfers with confirmation may give the configured recipient a summary and necessary details; their spoken response may be transcribed and processed to accept or reject the transfer. Transfer monitoring may analyse audio signals to determine whether a call was answered. These functions do not themselves establish recipient identity.

Configured notifications, summaries and follow-ups can disclose contact details, conversation reasons/summaries and outcomes to selected recipients. Customers must restrict recipients to those involved, provide privacy information, and apply access and retention rules to copies in their own systems.

7. Providers and recipients

The following providers may receive data for the stated functions. Not all are involved in every account or receive the same data. Their role depends on the function and contracting relationship.

7.1. Providers involved in the contracted service

Providers processing interlocutor data on the customer’s behalf act as Telvia’s subprocessors for the relevant functions. Their involvement depends on channels and enabled features; they may also support account management by Telvia.

Hosting and account services: providers host the application, authenticate users and store the data needed to deliver the service. Communications: providers transport calls and messages and send notifications and confirmations, processing contact details and necessary content.

Artificial intelligence: providers process audio, text and, when the knowledge base is used, uploaded documents to generate responses, transcripts, summaries and requested actions. Security and diagnostics: providers process technical and necessary operation data to prevent abuse and duplicates and resolve incidents.

Customers can access provider identities, functions and available documentation in the provider and subprocessor register at provider and subprocessor register after signing in. Contractual and subcontracting-chain information is also available through info@atendy.es, including before contracting. This does not restrict data subjects’ information rights.

7.2. Atendy management, payments and analytics

These services support Atendy’s customer relationship, support, payments or website. They do not all receive call content or act as subprocessors for every customer’s processing.

Email and support: communication and collaboration providers receive addresses, messages and information needed to manage enquiries and accounts. Payments: payment and subscription providers receive identification and billing data necessary to collect payments.

Website analytics: measurement services operate only with cookie-banner consent, never in the customer panel or embedded widget. The Cookie Policy identifies the provider, technologies and applicable conditions.

7.3. Telephony and customer-connected services

Customers choose their accounts, numbers and integrations. Data are disclosed for activated functions. Provider roles depend on who contracts the service, its function and applicable terms.

Customer-connected telephony, messaging, calendars, CRM, shops and email services receive the information needed for the queries, communications or actions enabled by the customer. Section 8 links to the specific notices explaining each connection.

The service uses infrastructure in the EU and providers performing the functions described; international transfers are explained in section 9. Section 10 and, where applicable, the DPA govern retention. Fonts are served from our own servers without disclosure to an external font provider.

We do not sell personal data. Disclosure is limited to service delivery, legal obligations, customer requests or security. For processing on the customer’s behalf the DPA applies automatically with the Terms, subject to any specific written agreement.

8. Services you connect to Atendy

Integrations are optional. Connecting a calendar, shop, messaging, CRM or other service authorises the exchange of data needed for the functions you enable. The connected provider processes data under its relationship with you and the applicable terms; it does not necessarily receive every conversation in your account.

Permissions, uses, recipients and disconnection or deletion options are explained in the integration privacy notices, which supplement this policy and are available before connecting. Disconnecting does not automatically erase information already included in conversations or copies retained by the provider.

Google Workspace data are used only for authorised functions, in compliance with Google policies and Limited Use requirements, and are not used to train AI models. The Google notice explains access, use, sharing and deletion.

• Integration privacy notices
• Google Workspace and Limited Use

9. International transfers

Primary storage and the calling infrastructure administered by Telvia are in the EU. Other providers may process outside the EEA; European hosting does not mean all processing takes place exclusively in Europe.

Where transfers occur, we use applicable adequacy decisions, including the EU–US Data Privacy Framework for certified providers, European Commission standard contractual clauses and supplementary measures where necessary. Request details or copies of applicable safeguards at info@atendy.es. Third-party data and trade secrets are protected without preventing access to legally required information.

10. Retention

Account/settings: while active and for necessary legal/contractual liability periods. Recordings/transcripts/summaries: according to customer instructions, purpose and justified follow-up. Customers must set a limited proportionate period and delete when that purpose ends, using available functions or requesting erasure. An active account does not justify indefinite retention; return/deletion on termination follows the DPA.

Technical/security logs: as needed to detect/investigate incidents, prevent abuse and evidence actions, then deleted or anonymised unless legally justified. Connection credentials: while active, removed immediately on disconnect in the editor or account deletion.

Demo requests/web forms: up to 6 months after last interaction if no business relationship follows. Support: as needed to resolve/follow up, then only data necessary for legal duties or claims for the applicable period. Business-contact data: up to 2 years after last interaction unless opt-out/objection. Billing: statutory tax and commercial-law periods.

Legal/claims retention is limited to necessary data and time. Residual backups follow the DPA and do not permit ordinary use after erasure is requested. Ask info@atendy.es for the criterion applicable to your data.

11. Your rights

Request access, rectification, erasure, objection, restriction, portability or withdrawal of consent at info@atendy.es. You may complain to the Spanish Data Protection Agency (https://www.aepd.es) or another competent supervisory authority under the GDPR.

If your call was handled by a customer’s agent, direct your request to that customer. If you write to us and we can identify them, we forward it and assist under the DPA. Where Atendy is controller, we handle it.

As controller we respond within one month. For complexity or number of requests, we explain within that month any extension, up to two additional months. Requests are free except statutory exceptions. Additional identity information is requested only where reasonable doubts exist. Withdrawal does not affect prior lawful processing. Commercial support hours do not suspend rights deadlines.

12. Security

We apply risk-appropriate technical and organisational measures for confidentiality, integrity and availability, including access control and communication protection. Sensitive operational details are not public; customers receive required processor-compliance information under the DPA. No system is completely invulnerable. Breaches are notified to customers, authorities or affected people where required under GDPR conditions and deadlines.

13. Minors

The service is for businesses/professionals, not account holders under 18. Customer interlocutors may be minors; customers must apply age- and processing-appropriate legal bases, notices and safeguards. A business platform does not exclude their rights. We delete accounts found to have been created by minors. Report concerns to info@atendy.es.

14. Changes

We may update this policy for legal, technical or product changes, publishing the current version and date here and communicating significant changes appropriately. Consent for any new purpose requiring it is requested beforehand; publication does not replace consent.