Last updated: September 2024
Below, we inform you about the processing of personal data that we carry out at Elia. With this privacy policy, we want to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of individuals with regard to the processing of personal data and the free movement of these data and repealing Directive 95/46/EC (hereinafter, the “General Data Protection Regulation” or “RGPD”), as well as any legislation on data protection that applies to us because of the territories in which we operate.
Today, at Elia, we treat data in different ways and with different types of relationships: leads, customers, web users, users of our AI Telephone Agents platform. It is possible that some of these sections apply to you because they are generic and that in others you only have to consult some of their sections. If so, you only have to go to the subsection that interests you.
SOUND HARPSICHORD, S.L. a Spanish company with registered office at Calle Valle del Roncal 13, 28692, Villanueva de la Cañada, Spain and CIF B19881192 (hereinafter, “Elia”) is committed to protecting your personal data. This privacy policy (hereinafter, the “Privacy Policy”) will inform you of how we take care of your personal data when you interact with our website (hereinafter, the “Website”), our Platform (hereinafter, the “Platform”) or in the context of providing our services.
Contact details of the person responsible: Telephone (+34 618 367 858), email (legal@heyelia.com)
Contact details of the DPO: email (legal@heyelia.com), postal address (Calle Valle del Roncal 13, 28692, Villanueva de la Cañada, Spain).
Elia's main service consists of the provision of a cloud-based AI Telephone Agent management platform used by organizations (hereinafter, “Customer” or “Customers”) to optimize their telephone service processes, centralizing and digitizing those administrative tasks related to the needs of users who purchase their products or services (hereinafter, the “End Users”).
In this context, Elia processes your personal data as a data processor. Due to the nature of our business, Elia has no direct relationship with users or data subjects. We only process End User personal data on behalf of our Customers and in accordance with their instructions. Therefore, if you are a person who uses our Platform as a user, we inform you that we act only as data processors. Our Customers decide the purposes for which our Platform is used, as well as the means they use for the collection and processing of data, depending on the magnitude of the functions of our Platform, and any additional processing of them.
Examples:
The subjects whose personal data we process in this context refer to End Users of the Platform. Alternatively, with the use of the Platform, we may process the data of individuals whose data is provided by the End Users of the Platform themselves.
The categories of personal data that can be entered on the Platform can be of the following types:
If you choose to access our Platform through the website using the Google, Okta or Microsoft Azure login tool, these companies will share with us your full name, email address, language preferences and profile picture for authentication purposes. The data is transmitted for the indicated purpose of logging in and always respecting the configuration that the user has determined on their account with Google.
As for the types of processing operations, they may vary from the collection or registration of your data within the Platform, such as their organization or structuring, storage, conservation and, ultimately, once the relationship is over, their deletion and definitive destruction at the request of the Customer.
For the specific geolocation functionality, we inform the interested party that Elia works with the Google Maps service. In this regard, we inform our End Users that they can access the Data Protection Conditions of that independent controller at:
https://cloud.google.com/maps-platform/terms/maps-controller-terms.
In the event that our Customers wish to use any of the integrations we offer with our Platform to complement different functionalities, they must accept the respective terms and conditions and privacy policy of those providers, and the data will be processed for the purposes determined in those policies.
As we have already mentioned, at Elia we do not process your personal data for our own purposes. We may process usage and analytical information, as well as financial, statistical and aggregated data from the Platform. From all this information, there may be certain data derived from personal data. Whenever we are going to use any of this data for the improvement and subsequent development of our products and/or services, we will do so only if they are anonymized. Keep in mind that this treatment is not the same as the use of analytical cookies, which, as a user of our website or Platform, you can freely authorize or deny the first moment you access.
In this context, once the provision of treatment services from Elia ends, by default, we will keep the blocked data in an S3 system for twelve (12) months. We recommend that our Customers take the opportunity to extract all the information from the Platform, since after that period we will permanently destroy your data, unless the Customer has already expressly requested definitive deletion within this period.
Finally, we may use tracking devices that may allow us to collect usage data or metadata from the Platform. This usage data allows us to analyze the functioning of the Platform when our users interact with our different functionalities and to detect possible errors or incidents to try to amend them from a technical point of view. However, the use of these devices for analytical purposes will be subject to the consent of the Customers upon first access and their acceptance can be configured at any subsequent time, in accordance with what we report through the Platform's Cookie Policy (available at all times once you access through the “My Settings” or “My Settings” section of your user account).
Not all the data that we detail in this section apply to any treatment. In order to be able to consult the exact type of data that applies to each treatment and its origin, please review this and the following section in addition, for purposes and bases of legitimation.
In general, in order to be able to provide our different services, we collect the following personal data:
Data about our leads and/or web users
If you are in our Elia database, we may have received the following information about you:
You provide us with such data directly through forms such as direct contact, request for a demo, attendance at events, business fairs and/or webinars or forms for requesting materials and/or digital content offered by Elia, among others.
Notwithstanding the foregoing, we may also collect your data through third-party providers with whom Elia has a contractual relationship or through social networks and similar platforms, such as LinkedIn.
For all these cases, at Elia, we try to ensure that these providers obtain consent correctly or that they have the appropriate evaluations and that they have adequate protection measures.
Information about our customers
Once a contract exists between Elia and its Clients, as a representative of your organization or point of contact, we may have received the following data for the successful purpose of the contractual relationship:
Customers provide us with such data directly or through the respective contractual agreement or as a result of contacts between Elia and your organization.
Information on minors
Elia offers a B2B service to organizations, aimed and designed to be used by adults. Elia's services are not aimed at processing personal data of minors without legal capacity to hire or work. Our services are focused on managing telephone service in the context of an organization. In this regard, we do not authorize people under 18 years of age or without legal capacity to sign up to create an account on our Platform or request our services. If we notice that a minor without legal capacity to contract wants to use our Platform, we reserve the right to cancel it, to immediately delete such data from our systems and to take whatever legal action we deem appropriate, among other appropriate measures.
In order to give you this information in a clear and as understandable way as possible, in this section we want to divide the purposes for which we can process your data depending on the group of stakeholders you belong to, as well as on the basis of legitimacy within each group of stakeholders:
Leads and/or users:
We treat your data as a lead or web user for the following purposes:
a. The following purposes of the processing are carried out based on your consent (art. 6.1.a GDPR):
We want to highlight that in relation to these purposes you will have the right to withdraw your consent at any time.
Data processed: Name and surname, telephone number and corporate email address, treatment, position, name and/or sector of the organization.
Data processed: Name and surname, telephone number and email address, position, name, sector and/or size of the organization.
Data processed: Name and surname, telephone number and email address, position and sometimes, name, sector and/or size of the organization.
Sometimes, we manage these events, courses and/or webinars in collaboration with other organizations or acting as promoters. So in these situations we can communicate the personal data that you have provided to us. In these cases, we will request your prior consent to communicate them to these third parties for their own commercial purposes, such as sending information and content related to their products and/or services. These third-party collaborators will have their own privacy policies and you will be able to obtain more information about the processing of your data, which will be under their responsibility. For more information, regarding possible communication of your data with third parties, you can contact us at legal@heyelia.com.
Data processed: First and last name, corporate email address, name and size of the organization.
Data processed:
(a) Navigation, traffic and/or metadata data: IP address, behavioral data through our website obtained from the use of cookies.
(b) Data about your organization's preferences and needs: It consists of information provided directly by you about what Elia features may interest you, as well as information deduced by Elia about the preferences and needs that the organization you are part of may have.
Data processed: First and last name, username, Image and voice, language to communicate.
Every time you attend a video call with our Sales teams and the call is recorded, we will take into account that we have previously obtained your consent.
b. The following purposes of the processing are carried out based on the execution of a contract to which the interested party is a party or for the application at the latter's request of pre-contractual measures (art. 6.1.b GDPR):
Data processed: treatment, position, name and/or sector of the organization, functionalities of our platform that you have selected.
Data processed: name and surname, position, corporate email and telephone number, name, sector and size of the organization and functionalities of our platform that you have selected.
c. The following processing purposes are carried out based on our legitimate interest (art. 6.1.f GDPR):
Data processed: treatment, position, name and surname, size, name and/or sector of the organization, interactions with products or content on our websites (provided that you have consented to the use of our cookies), interesting features of our platform that you have selected.
Provided that we have your consent to receive exclusive or personalized advertising communications, communications may be sent based on the profile generated from the data described and in accordance with the characteristics detailed in this privacy policy.
In addition to email, from Elia we will communicate with you for advertising purposes through different online channels. These other forms of communication include SMS, instant messaging applications or platforms and, in particular, the use of social networks or third-party platforms.
At Elia, we try to use all these channels in the best possible way and in compliance with data protection principles. In this context, your data will always be shared with the respective guarantees of confidentiality and data security.
In relation to the use of the channels offered by social networks or platforms, in general, in order to use them, we must provide a series of necessary and sufficient data, such as: corporate name, country, email address and telephone number. Prior to sharing your data with these platforms or social networks, encryption will be applied to your data using tools provided by them. In this way, only the social network or platform can verify that there is a match with any of its users. In other words, once we send this data, the social network or platform will automatically assign an encryption code to prevent us from identifying users and only then will it check if there are any matching users in their community.
The platforms with which we are interested in collaborating are those where we can make a useful impact on our professional leads. Each platform will have its own way of calling it, but these methods of generating audiences are often referred to as Custom Audiences, Matched Audiences or personalized audiences. By default, in the context of these platforms or social networks, we will only apply customized audiences with a single segment set by Elia, which will be based on the preferred features indicated by the lead himself or so that you no longer receive advertising related to Elia (that is, to exclude you from receiving our advertisements and not burden you with commercial information).
Elia does not have access to data from these social networks or platforms. Your social network user data is not shared with us at any time. We will simply have access to statistical information related to the database that we have provided. In this sense, the social network or platform does not allow us to communicate directly with you. If you have a user account on that social network or platform, you will be shown advertising communications within the social network itself.
In addition, from Elia we can also apply what is usually called Lookalike Audiences or similar audiences. These activities consist of platforms or social networks showing advertising information to third party users with profiles similar to Elia users. In other words, these platforms will determine that you have similar tastes or preferences to our users and will show you promotional content about Elia because they think it might interest you.
Despite the above, we want to make it clear that the privacy settings you have on those platforms or social networks will prevail. Although you have consented to receiving advertising communications from Elia, if you have restricted the privacy permissions of your profile through the respective social network or platform, we will not be able to carry out these activities. If you want to restrict the privacy settings of your user profile, we recommend that you consult directly the current conditions and privacy policies of those platforms or social networks.
If you want to receive non-personalized advertising communications and, therefore, that we do not process your data to carry out these advertising activities with social networks, you can object by sending your request directly to legal@heyelia.com and we will respond to your request.
Elia's legitimate interest in relation to our use of these advertising services on social networks or other platforms consists of our intention to improve our advertising communication strategy with our professional leads and ensure that they receive information that is truly of interest depending on the type of organization they are part of. The benefit that this generates for us is to increase the scope of knowledge of our products and services, as well as the contracting of our services -if it ends up becoming effective-. The benefit for you as an interested party is to have information on telephone service management platforms, as well as related products and services that may be of interest to the organization of which you are part. If you want to access this weighting, you can request it from us through the following account: legal@heyelia.com.
Finally, keep in mind that sometimes you may see advertising for Elia on a social network without us having previously shared any of your personal data with them. In these cases, it is the same platform or social network that shows you advertising according to its own criteria and Elia will not be intervening. The display of this advertising will depend exclusively on how you have configured your user profile on that platform or social network.
Data processed: Position, number of employees in the organization (by rank), sector and country/region of the organization, features of interest to our platform, origin of the lead, interaction with our content and websites (for example, use of freebies, download of content, marketing campaigns in which you participated, interaction with our communications, last date of participation in a demo, or last date of signing with Elia, if applicable).
At Elia, we use a series of algorithmic models that allow us to:
(1) better personalize our relationship and commercial communications with the lead; and
(2) determine the segment or score of the lead. This will allow us to follow a commercial strategy with respect to it and incorporate it into certain personalized and predefined treatment sequences. To this end, we will offer you those products or services that we consider may be of greatest interest to you. If you want to access the weighting of rights, you can request it from us through the following account: legal@heyelia.com.
More specifically, these sequences may mean that, whenever the lead has consented, they receive personalized communications according to the interests shown or according to characteristics specific to the organization to which they belong (size, sector, country, etc.).
The determination of these personalized sequences is obtained thanks to a series of calculations based on a predictive model or pattern. In order to improve these predictive models or patterns, we provide the above-mentioned data for training and improvement. In this way, we optimize the rules of those predefined sequences or profiles to which you have been assigned. In the end, we can continue to offer personalized service to the lead and that allows us to know what characteristics of our products or services we should highlight to generate greater interest.
You have the right to object to this purpose at any time. Under no circumstances does opposing this treatment worsen or condition your business relationship with Elia. If you only object to this purpose and we continue to have your consent to send you advertising or commercial communications, we will continue to offer you our products or services, but in a more generic way.
Data processed: Name and surname, telephone number and/or email address, treatment, position, name and/or sector of the organization, data derived from meetings, powers of representation and contact details as legal representative (in the contract if signed).
Elia's legitimate interest in relation to these contacts is based on being able to contact you to offer or promote our products and services in accordance with the possible interest of your organization in initiating or maintaining a commercial or similar relationship with Elia (we consider that we are entitled to do so based on art. 19 of the LOPDGDD). The benefit that this generates for us is to increase the scope of knowledge of our products and services, as well as the sale -if it ends up becoming effective-. The benefit for you as an interested party is to have information about our human resources management platform, as well as related products and services that may be of interest to the organization of which you are part. If you want to access this weighting, you can request us through the following account: legal@heyelia.com.
Customers:
We treat your data as a professional contact for Elia's clients for the following purposes:
a. The following purposes of the processing are carried out based on your consent (art. 6.1.a GDPR):
We want to highlight that in relation to these purposes you will have the right to withdraw your consent at any time.
Data processed: Name and surname, telephone number and email address, position, name, sector and/or size of the organization.
Data processed:
(a) Navigation, traffic and/or metadata data: IP address, behavioral data obtained from the use of cookies and other devices.
(b) Data about your organization's preferences and needs: It consists of information provided directly by you about which Elia features interest you, as well as information deduced by Elia about the preferences and needs that the organization you are part of may have.
b. The following purposes of the processing are carried out based on the execution of a contract to which the interested party is a party or for the application at the latter's request of pre-contractual measures (art. 6.1.b GDPR):
Data processed: Name and surname, corporate email and telephone number, contract data, financial data of the organization, data and metadata for platform use, voice and image (in case of video conferencing) and other data derived from communications with the interested party.
In this context, Elia will carry out several treatment activities focused on providing a service throughout the life cycle of the provision of services and establishing good communication with the administrative users of the Customer's account and/or other users who request assistance. These can range from assistance in uploading information and initial support to administrative users who are going to use the Platform, such as sending offers about new features and their subsequent activation, managing payments or collections, informational communications specific to the contractual relationship, assisting and supporting users in clarifying questions, providing information or resolving incidents, holding meetings and even providing final support for managing the Customer's offboarding with Elia.
c. The following purposes of the processing are carried out based on our legal obligation (art. 6.1.c GDPR):
Data processed: As a communicating person, the data we process are the name and surname, voice (depending on the type of complaint), email, telephone and/or postal address, as well as the description of the facts, documents and evidence provided. The foregoing, without prejudice to the fact that as an informant you have the right to file a complaint anonymously.
To better understand the context of this processing of your data, we recommend that you always review the respective privacy policy of our internal channel and thus have more details of the purposes for which we will process your data, as well as the rest of the information on data protection.
Data processed: Name and surname, corporate email and telephone number, hiring data, financial data of the organization.
Primarily, these processing activities are focused on complying with the due diligence measures to which we are subject in accordance with current applicable regulations.
d. The following processing purposes are carried out based on our legitimate interest (art. 6.1.f GDPR):
Data processed: Image and voice, basic data derived from communications and feedback provided by the customer himself on these calls.
Whenever necessary and when you attend a video call that is going to be recorded, you will be duly informed of this.
At Elia, we make these recordings with the intention of detecting areas of improvement, both in the service provided to our Customers and in the quality of any of our products and services. As a Customer, the benefit is that based on the opinions or suggestions you make during these meetings, we can correct both possible errors detected in our products and services and in the attention provided. At Elia, we continuously strive to keep your level of satisfaction high.
Data processed: Name and surname (except anonymous surveys), data derived from communications held with the interested party such as opinions or suggestions.
These surveys are not mandatory, but they are very valuable to us.
At Elia, we carry them out with the intention of identifying areas of improvement, both in the service provided to our Customers and in the quality of any of our products and services. As a Customer, the benefit of answering them is that based on your opinions or suggestions, we improve our products and services and strive to keep your level of satisfaction high.
Data processed: Position, number of employees in the organization (by rank), sector and country/region of the organization, functionalities of our platform that you have indicated to us that are of interest to your organization, origin of the contact, interaction with content on our websites (for example, use of freebies, download of content, marketing campaigns, in which you have participated, interaction with our communications, last date of participation in a demo, or last date of signing with Elia, if applicable).
These predictive models will consist of the following:
(a) Determine the segment of the scoring system of which your organization is part and incorporate you into certain personalized sequences for that segment of treatment of our Clients' contacts and have a better focus on business contact. This treatment will consist of analyzing the suitability of the appropriate commercial strategy for Clients. The purpose of this treatment is the classification of the Client organization according to a scoring system predefined by Elia, with different groups based on the data of the organization itself (sector, size, country, etc.) and the behavioral data of the contacts of that organization. All of the above, based on predictive models or patterns that will tell us when a Customer may be dissatisfied and then adjust our business strategy or relationship with that Customer.
(b) Analyze the Customer's life cycle.
(c) Identify opportunities to switch to higher plans for our Customers.
In order to improve these predictive models or patterns, we incorporate the above-mentioned data for the purpose of training and improving them. In other words, we will only process data from Elia's internal sources and information derived from the contractual relationship between Elia and the Customer. In this way, with this training, we optimize the rules of those pre-established sequences or segments to which your organization has been assigned.
Notwithstanding the above, these predictive models do not make any decisions on our own. We simply use them as just another data analysis resource. Decision-making will always be Elia's and always in search of the common benefit -his own and that of our Clients-.
You have the right to object to this purpose at any time. Under no circumstances does opposition worsen or condition your relationship with Elia. If you only object to this purpose, we will continue to provide you with our services to the Customer, but in a more generic way. If you want to access the weighting carried out, you can request it from us through the following account: legal@heyelia.com.
Data processed: data derived from contracting; observed platform usage data (for example, number of user profiles filled out, number of performance reviews launched, etc.); data from communications held with the interested party; navigation data; data obtained from the execution of statistical models.
Data processing in this context is carried out anonymously. In other words, we will only use such data once they have been duly anonymized.
This treatment will also allow us to analyze your queries or other contacts that are related to incidents, bugs or issues that are recurring on our Platform to better understand these errors raised by our Customers and try to give them a solution.
Other purposes:
For the purposes of Elia's selection processes, if you want to join our team, either because there is a position that matches your profile or because you want to send us your CV, we recommend that you always review the respective privacy policy to know the purposes for which we will process your data, as well as the rest of the information on data protection.
As a general rule, the data processed by Elia are not shared with third party recipients. However, we can collaborate with other entities and share your data with them:
In addition, in some cases we give access to your data to our suppliers, who provide a service to Elia, but never for their own purposes. When selecting them, we always try to choose suppliers that provide us with sufficient adequate guarantees in the processing of your data. Among the different categories of providers we use, we can find:
When we process your data, it is hosted in the EU and is processed within the territory of the EU. In this regard, your data will be stored in the Eu-Central1 region of Amazon Web Services (AWS). More specifically, in Frankfurt. In general, we hire service providers also located within the European Economic Area or in countries that have been declared to have an adequate level of data protection.
In some cases, the data we collect will be transferred to data processors in third countries, as understood in Article 44 of the GDPR, such as the United States. Primarily, we will base such transfers on an adaptation decision by the European Union pursuant to Article 45 of the GDPR. In the event that there is no adequate decision to transfer your data to the third country, we use other guarantees specific to Chapter V of the GDPR. Primarily, we will transfer your data on the basis of the current standard contractual clauses. However, we may use other types of measures provided for by the RGPD, provided that they allow us to guarantee adequate protection of your data and which you can consult upon request.
At Elia, we create profiles on our Clients and on our leads, as well as on some of our web users. All these profiles have a purely commercial purpose and are especially focused on our Clients, legal entities and within the framework of our business relationship with them or with the potential leads or organizations with whom we are negotiating or to whom we are offering our products and/or services.
As we have explained in the respective previous sections on purposes and bases of legitimation, we base these activities on Elia's legitimate interest, on the benefit that our Clients and potential customers receive the most useful information they can find and so that they receive effective personalized service, depending on the segment of which we consider that a Customer or potential customer is part. In accordance with this, at Elia we have carried out the corresponding weighting of legitimate interest, in which we have analyzed the benefits or interests we have as a data controller, as well as the interests and rights of the interested parties whose data we process in these activities. If you want to access or want us to explain in more detail the fundamental elements of this weighting, you can contact us directly at: legal@heyelia.com.
Under no circumstances will any of these profiles prevent you from exercising your data protection rights. In addition, this set of profiling operations is never based on automated decisions, since there is human intervention on our part and it is we who determine the conditions for segmentation or Scoring of customers and we end up deciding how to act for/with our Customers or potential customers. In this sense, they do not have any legal effect on contacts, nor do they affect them in a similar way. We only use them to segment the recipients of our communications, who are ultimately our Customers or potential legal entity clients.
If profiles are made and decisions are made based solely and exclusively on automated processing and these may cause legal effects or significantly affect them, you will be duly informed of this, of the logic applied to those decisions, as well as of your rights to obtain human intervention, to express your point of view and to challenge such decisions.
At Elia, we keep personal data for different periods and depending on the type of information, the period of our contract with our Clients, the legal requirements relating to certain types of data and other factors. In general, whenever your data is no longer necessary for the purposes for which it was collected, we will stop processing it.
If we need to retain your data to comply with a contractual or legal obligation, or to resolve disputes, we will keep it only to comply with those obligations, as well as to assert our rights of defense. In this regard, we will restrict access to specific people or functions.
If you have given us your consent, we will keep your data until you revoke your consent.
If there is a contractual relationship between Elia and the organization of which you are a part, we will process your data while the contractual relationship is still in force.
In relation to information communicated through the reporting channel, this will be stored only for as long as is necessary and provided in order to comply with the requirements imposed by the applicable whistleblower protection regulations, if any. After that time, the complaints will be suppressed with the appropriate security measures, without any obligation to block the data.
Once the above deadlines expire, your data will be kept duly blocked for making it available to Public Administrations, Judges and Courts and other competent authorities for the sole purpose of being able to deal with complaints until the end of the statute of limitations for the respective actions. After which, your data will be destroyed.
In accordance with the applicable data protection regulations (RGPD), as a data subject you have certain rights when we process your personal data. For this reason, we will give you an appropriate response within the established deadline when you request the exercise of your rights.
As an example, here are some of the rights you can exercise:
Elia normally acts on requests and provides information free of charge. To exercise your rights, you can direct your requests to exercise your rights by sending a written communication to the following email address legal@heyelia.com. If you want to make a query or suggestion regarding the processing of data by Elia, you can go to this same address.
Keep in mind that in some cases we may need to verify your identity and may require supporting documentation from you. Similarly, in very specific cases, we may charge you a reasonable fee to cover our administrative costs of providing information for:
You have the right to file a complaint about our processing of your personal data with the competent data protection supervisory authority. Prior to filing a complaint with the Supervisory Authority, you have the right to contact our DPO.
At Elia, we implement state-of-the-art security standards to prevent unauthorized access, maintain data accuracy and ensure the correct use of information. We also apply appropriate organizational measures to protect your data.
We also apply these same standards or safety regulations when working with business and technology partners. We only select and hire data processors and third-party providers who have adequate security measures and offer sufficient guarantees, including technical and organizational measures, to ensure adequate protection of the data we entrust to them.
In addition, internally, we also ensure that any member of Elia who will have access to your data has signed a non-disclosure agreement or clause and we have established internal measures and processes such as continuous training and a series of policies that are updated on a regular basis to ensure data security, as well as the confidentiality, availability and resilience of our systems and services. Among other measures, we highlight that at Elia we have defined a management procedure and an incident response plan in case we detect any vulnerability in our systems and/or that may affect your personal data.
For more information related to our security measures you can contact our Security page.
We reserve the right to modify this privacy policy whenever we think it is necessary to keep it updated and adapt it to the reality of the development of our products and services, to industry standards or to new regulations. If such changes are substantial or important, we will do our best to inform you of them.
