AI & Data Protection

Use of an AI-supported voice assistant to receive incoming calls

To process telephone enquiries automatically, we use the Excelsior Media Smart Phone Assistant. It processes call content on our behalf in order to record, forward or answer your request. This involves automatic speech recognition (speech-to-text), semantic analysis (natural language processing) and, where applicable, text generation (text-to-speech).

Call content may be recorded, transcribed or documented. This only happens if you have been informed accordingly at the beginning of the call and you continue the call. You are regularly informed by the announcement that you are being connected to an AI assistant. You can end the call at any time to prevent processing.

Processed data and legal bases

In particular, the statements you make during the call, technical connection data (date, time, duration) and any voluntarily provided personal data such as name or telephone number are processed. Interaction data is also processed, for example to guide the conversation or in the event of disconnections.

The legal bases are Art. 6(1)(b) GDPR (for contract initiation or performance) and Art. 6(1)(f) GDPR (legitimate interest in efficient and scalable communication).

Transfer to third countries and sub-processors

Our own website is hosted by Strato GmbH. For technical implementation we use sub-processors, in particular for hosting, speech recognition and semantic analysis. Personal data may thereby be transferred to the USA by the sub-processor. As a rule, this is done on the basis of an adequacy decision pursuant to Art. 45 GDPR, as the service providers are certified under the EU-U.S. Data Privacy Framework. If such a decision is lacking, transfer takes place on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR and supplementary protective measures. The requirements of Art. 44 GDPR are observed.

Training, automated decisions and retention

Pseudonymised data may be used for training purposes to improve speech processing. Retracing data to individual persons is excluded or made considerably more difficult. Automated decision-making within the meaning of Art. 22 GDPR does not take place.

Data is stored only for as long as necessary for the stated purposes. It is then automatically deleted or anonymised.