GDPR Compliance

1. GDPR Overview

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It applies to all organizations processing personal data of individuals in the European Union, regardless of where the organization is located.

1.1 Key GDPR Principles We Follow

• Lawfulness, fairness, and transparency: We process data legally, fairly, and transparently
• Purpose limitation: Data is collected for specific, explicit, and legitimate purposes
• Data minimization: We only collect data that is adequate, relevant, and necessary
• Accuracy: Personal data is kept accurate and up-to-date
• Storage limitation: Data is retained only as long as necessary
• Integrity and confidentiality: Data is processed securely with appropriate protection
• Accountability: We can demonstrate compliance with GDPR principles

1.2 Territorial Scope

GDPR applies to Team-Connect AI because we:

• Are established in the UK (which maintains GDPR through UK GDPR)
• Offer services to individuals in the EU/EEA
• Monitor behavior of individuals in the EU/EEA through our AI platform

2. Data Controller Information

Under GDPR Article 4(7), Team-Connect Limited acts as the data controller for personal data processed through our AI customer service platform. As the controller, we determine the purposes and means of processing your personal data.

2.1 Joint Controllers

In some cases, we may act as joint controllers with our customers when they use our AI platform to process their customers' personal data. In such cases:

• We establish clear arrangements determining respective responsibilities
• We ensure individuals can exercise their rights against either controller
• We provide transparency about the joint processing arrangement

2.2 Data Processors We Use

We work with carefully selected data processors to provide our AI services:

• Cloud Infrastructure: AWS, Google Cloud (EU/UK regions)
• Analytics: Google Analytics 4 (with IP anonymization)
• Customer Support: Intercom, Zendesk
• Payment Processing: Stripe (PCI DSS compliant)
• Communication: SendGrid, Twilio

3. Legal Basis for Processing

Under GDPR Article 6, we must have a legal basis for processing your personal data. We rely on different legal bases depending on the purpose of processing.

3.1 Legitimate Interest Assessment

When we rely on legitimate interest as our legal basis, we conduct a balancing test to ensure our interests don't override your fundamental rights and freedoms:

3.2 Special Category Data

Team-Connect AI does not intentionally collect special category personal data (GDPR Article 9) such as:

• Health data
• Racial or ethnic origin
• Political opinions
• Religious beliefs
• Trade union membership
• Genetic or biometric data
• Data concerning sex life or sexual orientation

4. Your Data Protection Rights

Under GDPR, you have eight fundamental rights regarding your personal data. We are committed to facilitating the exercise of these rights and will respond to requests within one month.

4.1 Exercising Your Rights

To exercise any of these rights, you can:

• Email our DPO: dpo@team-connect.co.uk
• Use our privacy portal: Available in your account dashboard
• Call us: +44 (0) 161 524 8417
• Write to us: Team-Connect Limited, 7 Chelford Road, Handforth, SK9 3SQ

4.2 Verification Process

To protect your personal data, we may need to verify your identity before processing rights requests:

• We may ask for additional identification documents
• Account holders can use secure login for verification
• Third-party requests require proper authorization documentation
• We use proportionate verification measures based on the sensitivity of data

5. How We Process Your Data

This section explains what personal data we collect, how we process it, and the safeguards we implement to protect your privacy while providing our AI customer service platform.

5.1 Personal Data We Collect

Account and Profile Data

• Identity data: Name, username, job title, company name
• Contact data: Email address, phone number, postal address
• Account data: Password (hashed), security questions, preferences
• Profile data: Profile picture, bio, communication preferences

Usage and Technical Data

• Service usage: AI interactions, call logs, feature usage, settings
• Technical data: IP address, browser type, device information, operating system
• Analytics data: Page views, session duration, click-through rates
• Performance data: Response times, error logs, system performance metrics

Communication Data

• Support communications: Help desk tickets, live chat messages, email correspondence
• AI conversation data: Voice recordings, transcripts, interaction metadata
• Marketing data: Email engagement, campaign responses, preferences

Financial Data

• Billing information: Subscription plan, usage metrics, invoice history
• Payment data: Processed securely by Stripe (we don't store card details)
• Tax data: VAT numbers, tax jurisdiction (as required by law)

5.2 Automated Decision-Making and Profiling

Our AI platform uses automated processing to provide intelligent customer service responses. Here's how we handle automated decision-making under GDPR Article 22:

5.3 Data Sharing and Recipients

We only share your personal data when necessary and with appropriate safeguards:

Internal Recipients

• Customer Success Team: For account management and support
• Technical Team: For platform maintenance and troubleshooting
• Security Team: For fraud prevention and security monitoring
• Legal Team: For compliance and legal matters

External Recipients

• Cloud providers: AWS, Google Cloud (with DPAs and SCCs)
• Analytics providers: Google Analytics (IP anonymized)
• Payment processors: Stripe (PCI DSS compliant)
• Support tools: Intercom, Zendesk (customer support)
• Legal authorities: When required by law or court order

6. International Data Transfers

We primarily store and process your data within the UK and European Union. However, some of our service providers may process data outside the EEA. We ensure appropriate safeguards are in place for all international transfers.

6.1 Transfer Mechanisms

When we transfer personal data outside the EEA, we use the following GDPR-approved mechanisms:

6.2 Specific Transfer Scenarios

Cloud Infrastructure

• Primary locations: UK and EU data centers
• Backup locations: US (with SCCs and additional safeguards)
• Providers: AWS, Google Cloud Platform
• Safeguards: Encryption, access controls, data residency commitments

Support and Analytics

• Customer support: Intercom (US) - SCCs in place
• Analytics: Google Analytics with IP anonymization
• Communication: SendGrid (US) - SCCs and encryption

6.3 Government Access and Surveillance

We take measures to protect your data from unwarranted government access:

• Legal challenges: We challenge overly broad or unlawful requests
• Notification: We notify you of government requests unless legally prohibited
• Minimization: We limit data provided to the minimum legally required
• Transparency reports: We publish annual transparency reports on government requests

7. Data Retention

We only retain your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes. Our retention periods are based on business needs, legal requirements, and industry best practices.

7.1 Retention Periods by Data Type

7.2 Secure Deletion Process

When retention periods expire or deletion is requested, we follow a secure deletion process:

7.3 Exceptions to Deletion

We may retain data beyond normal retention periods when:

• Legal proceedings: Data needed for active litigation
• Regulatory investigations: Required by authorities
• Security incidents: For ongoing security investigations
• Legal obligations: Statutory retention requirements

8. Data Security Measures

We implement comprehensive technical and organizational measures to ensure appropriate security for personal data, taking into account the nature, scope, context, and purposes of processing, as well as the risks to individuals' rights and freedoms.

8.1 Technical Security Measures

Encryption

• In transit: TLS 1.3 encryption for all data transmission
• At rest: AES-256 encryption for stored data
• Application level: Field-level encryption for sensitive data
• Key management: Hardware Security Modules (HSMs) for key storage

Access Controls

• Multi-factor authentication: Required for all system access
• Role-based access: Principle of least privilege
• Regular reviews: Quarterly access permission audits
• Automated deprovisioning: Immediate access removal upon role changes

Network Security

• Firewalls: Web Application Firewalls (WAF) and network firewalls
• Intrusion detection: 24/7 monitoring and threat detection
• VPN access: Encrypted connections for remote access
• Network segmentation: Isolated environments for different data types

8.2 Organizational Security Measures

Staff Training and Awareness

• GDPR training: Mandatory for all employees handling personal data
• Security awareness: Regular phishing tests and security updates
• Incident response training: Procedures for data breach response
• Confidentiality agreements: All staff sign data protection agreements

Policies and Procedures

• Information Security Policy: Comprehensive security framework
• Data Protection Policy: GDPR compliance procedures
• Incident Response Plan: Structured breach response process
• Business Continuity Plan: Data protection during disasters

8.3 Security Certifications and Standards

9. Privacy by Design and Default

Under GDPR Article 25, we implement data protection by design and by default. This means privacy and data protection are embedded into our AI platform from the ground up, not added as an afterthought.

9.1 Seven Foundational Principles

We follow Dr. Ann Cavoukian's seven foundational principles of Privacy by Design:

9.2 Technical Implementation

Data Minimization

• Collection limitation: Only collect data necessary for specified purposes
• Processing limitation: Process only the minimum data required
• Storage limitation: Retain data only as long as necessary
• Access limitation: Grant access only to authorized personnel

Pseudonymization and Anonymization

• User identifiers: Replace direct identifiers with pseudonyms
• Analytics data: Anonymized aggregation for insights
• AI training data: Anonymized datasets for model improvement
• Reporting: Aggregated, non-identifiable reports

9.3 Organizational Implementation

Privacy Impact Assessments (PIAs)

• Mandatory assessments: For all new features processing personal data
• Risk identification: Systematic identification of privacy risks
• Mitigation measures: Implementation of risk reduction strategies
• Regular reviews: Ongoing assessment of privacy impacts

Privacy by Default Settings

• Account creation: Minimum necessary permissions by default
• Data sharing: Opt-in rather than opt-out for non-essential sharing
• Marketing communications: Explicit consent required
• Analytics: Anonymized by default with option to opt-out

10. Privacy Impact Assessment (PIA)

Under GDPR Article 35, we conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals' rights and freedoms. Our AI customer service platform has undergone comprehensive privacy impact assessment.

10.1 When We Conduct DPIAs

We perform DPIAs for processing that involves:

• Systematic and extensive profiling with significant effects
• Processing of special category data on a large scale
• Systematic monitoring of publicly accessible areas on a large scale
• New technologies that may pose privacy risks
• Processing that may prevent individuals from exercising rights

10.2 DPIA Process

1. Necessity assessment: Determine if DPIA is required
2. Process description: Document processing activities and purposes
3. Necessity and proportionality: Assess if processing is justified
4. Risk identification: Identify risks to individuals
5. Risk assessment: Evaluate likelihood and severity
6. Mitigation measures: Implement controls to reduce risks
7. Consultation: Engage DPO and, if needed, supervisory authority
8. Review and monitoring: Regular reassessment of risks and measures

10.3 Supervisory Authority Consultation

If our DPIA indicates high residual risk that cannot be adequately mitigated, we consult with the relevant supervisory authority (ICO in the UK) before beginning processing.

11. Data Breach Notification

Under GDPR Articles 33 and 34, we have established procedures to detect, report, and investigate personal data breaches. We are committed to transparency and will notify relevant parties within the required timeframes.

11.1 Breach Detection and Response

Our incident response process follows these steps:

11.2 Notification Requirements

Supervisory Authority Notification (Article 33)

We notify the ICO within 72 hours when a breach:

• Is likely to result in risk to individuals' rights and freedoms
• Involves accidental or unlawful destruction, loss, alteration
• Results in unauthorized disclosure or access to personal data

Individual Notification (Article 34)

We notify affected individuals without undue delay when a breach:

• Is likely to result in high risk to rights and freedoms
• Could result in discrimination, identity theft, or financial loss
• Might cause damage to reputation or social disadvantage

11.3 Breach Prevention Measures

• Continuous monitoring: 24/7 security monitoring and alerting
• Access controls: Strict authentication and authorization
• Encryption: Data protection even if accessed unlawfully
• Regular testing: Penetration testing and vulnerability assessments
• Staff training: Regular security awareness training
• Incident drills: Regular breach response exercises

11.4 Breach Register

We maintain a register of all data breaches, regardless of whether notification was required. This helps us identify patterns, improve security measures, and demonstrate accountability.

12. How to Exercise Your Rights

We make it easy for you to exercise your GDPR rights. You can submit requests through multiple channels, and we guarantee a response within the legal timeframe.

12.1 Alternative Contact Methods

12.2 What to Expect After Your Request

1. Acknowledgment (72 hours): We'll confirm receipt of your request
2. Identity verification: We may ask for additional identification
3. Processing: We'll locate and prepare your data
4. Response (30 days): We'll fulfill your request or explain why we cannot
5. Follow-up: We'll check you're satisfied with our response

13. Data Protection Officer (DPO)

Under GDPR Article 37, we have appointed a Data Protection Officer to oversee our data protection strategy and ensure compliance with GDPR requirements. Our DPO is your primary contact for all privacy-related questions and concerns.

13.1 DPO Responsibilities

Our DPO is responsible for:

• Monitoring compliance: Ensuring GDPR compliance across all processing activities
• Training and awareness: Educating staff about data protection obligations
• Data protection impact assessments: Conducting and reviewing DPIAs
• Point of contact: Liaising with supervisory authorities and data subjects
• Risk assessment: Identifying and mitigating data protection risks
• Policy development: Developing and updating data protection policies

13.2 When to Contact Our DPO

Contact our DPO for:

• Exercising your GDPR rights
• Questions about how your data is processed
• Concerns about data protection practices
• Reporting potential data protection violations
• Requesting information about our legal basis for processing
• Questions about international data transfers
• Complaints about our handling of your personal data

13.3 Independent Status

Our DPO operates with complete independence:

• No conflicts of interest with data processing decisions
• Direct reporting line to senior management
• Sufficient resources to perform duties effectively
• Protected from dismissal for performing DPO duties
• Bound by confidentiality regarding data protection matters

14. GDPR Compliance Timeline

Our journey to GDPR compliance has been comprehensive and ongoing. This timeline shows our key milestones and continuous improvement efforts.

14.1 Future Compliance Commitments

• Quarterly reviews: Regular assessment of compliance status
• Annual audits: Independent third-party compliance verification
• Technology updates: Adoption of new privacy-enhancing technologies
• Regulatory monitoring: Tracking changes in data protection law
• Best practice adoption: Implementing industry leading practices

15. Policy Updates and Changes

We may update this GDPR compliance information from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We are committed to transparency about any changes that may affect your privacy rights.

15.1 When We Update This Policy

• Legal changes: New regulations or guidance from supervisory authorities
• Service changes: New features or processing activities in our AI platform
• Business changes: Corporate structure, location, or ownership changes
• Security updates: Enhanced security measures or incident responses
• Best practices: Adoption of improved privacy protection methods

15.2 How We Notify You of Changes

For significant changes that affect your rights:

• Email notification: Sent to all registered users
• Website banner: Prominent notice on our homepage
• Account dashboard: Alert in your user dashboard
• Direct communication: For changes requiring new consent

For minor changes (clarifications, formatting, contact updates):

• Updated "Last Modified" date at the top of this page
• Changes highlighted in our privacy policy changelog
• Notice in our next regular communication

15.3 Your Options After Updates

When we make significant changes, you can:

• Continue using our service: Acceptance of the updated terms
• Withdraw consent: For processing based on consent
• Exercise your rights: Request data deletion or restriction
• Contact our DPO: Discuss concerns about changes
• File a complaint: With supervisory authority if you disagree

15.4 Staying Informed

To stay updated on our privacy practices:

• Subscribe: to our privacy updates newsletter
• Follow: @TeamConnectAI on Twitter for announcements
• Check: this page regularly for updates
• Contact: our DPO with specific questions