Privacy Policy

1. Who We Are

SCIT Technology SRL (“PBXTools”, “we”, “our”) operates the PBXTools platform — an AI-powered suite of tools for telephone exchanges, including call transcription, reporting, softphone, and PBX security.

Our platform is designed exclusively for business use (B2B) and processes communication data on behalf of our customers. This policy describes what data we collect, how we use it, how we protect it, and what rights you have.

Data Controller: SCIT Technology SRL, Cluj-Napoca, Romania DPO Contact: [email protected] Official website: https://pbxtools.ro

2. Data We Collect

2.1 Data You Provide Directly

Account data: Name, email address, company name, VAT/CUI number, phone number
Billing data: Fiscal address, tax ID, card details (processed exclusively by Stripe — we do not store card data)
Support: Messages, attachments, session logs submitted in support tickets
Communications: Emails, messages via the contact form

2.2 Automatically Collected Data

Analytics: IP address (anonymized via Cloudflare), browser, operating system, pages visited, time spent on site
Cookies: Essential and optional cookies (full details in our Cookie Policy)
Server logs: HTTP requests, timestamps, user agent, response codes — retained for security and troubleshooting

2.3 PBX Data (Processed for Customers)

This data is processed exclusively on behalf of our customers, in our capacity as Processor:

CDRs (Call Detail Records): Call metadata — numbers, duration, timestamps, status (no audio content unless transcription is enabled)
Transcriptions: Text output from Speech-to-Text processing, stored encrypted with restricted access
AI Analyses: Summaries, sentiment scores, tags, alerts — derived data from automated processing
Audio recordings: Stored only if the customer explicitly enables transcription; automatically deleted after processing

Important: We do not access or use customer PBX data unless explicitly requested (e.g., for troubleshooting) or as instructed through their account settings. Each customer’s data is completely isolated from other accounts.

2.4 AI Front Desk Data (Processed for Customers)

For the AI Front Desk service, our customer is the controller of the data, and we process it as a processor, only on the customer’s behalf (details in the Terms and Conditions, section 10.1):

Requests: the messages sent through the contact forms of the customer’s websites and the emails received in the customer’s dedicated mailboxes, with the contact details in them
Chat conversations: the messages visitors write in the chat window on the customer’s websites and the AI assistant’s replies; the contact details a visitor leaves in the window’s form
The customer’s knowledge: the texts, documents and website pages the customer makes available to the assistant
Technical data: a fingerprint (hash) of the visitor’s IP address, not the address itself; the page the visitor wrote from

The data is used to sort the requests, write a proposed reply from the customer’s knowledge and send it after approval (or automatically, only where the customer chose so). Today we use OpenAI, through its API, without the models being trained on this data. Closed requests and ended conversations are deleted automatically after the period chosen by the customer (90 days by default, between 30 and 365). To exercise their rights over this data, visitors contact the company that uses the service.

3. Purpose of Processing and Legal Basis

Purpose	Legal Basis (GDPR)	Retention Period
Service delivery	Art. 6(1)(b) — Contract performance	Contract duration + 5 years
Billing and payments	Art. 6(1)(c) — Legal obligation (fiscal)	10 years (fiscal legislation)
Technical support	Art. 6(1)(f) — Legitimate interest	2 years
Service improvement	Art. 6(1)(f) — Legitimate interest	26 months (anonymized data)
Platform security	Art. 6(1)(f) — Legitimate interest	12 months (logs)
Direct marketing (with consent)	Art. 6(1)(a) — Consent	Until withdrawal
PBX data processing	Art. 28 — Processing agreement	Per customer instructions

We never sell personal data. We share data only with:

Authorized Processors

Partner	Purpose	Location	Basis
Cloudflare	CDN, DDoS protection, Web Analytics	Global (HQ in USA)	SCC + DPA
Stripe	Secure payment processing	Global (HQ in USA)	SCC + DPA
Hetzner	Server hosting, storage	Germany & Finland (EU)	DPA

AI Providers

Transcription and AI analysis services receive only transcribed text, not original audio. All processing is under strict DPA agreements.

Authorities

We share data with authorities only when explicitly required by law (e.g., court orders, ANSPDCP requests).

All processors are GDPR compliant with signed Data Processing Agreements (DPA).

5. Embedded Content from Other Sites

Our pages may include third-party content:

YouTube videos — for documentation and tutorials
Stripe Elements — for payment processing

These services may collect their own data (IP, cookies) according to their own privacy policies. Interacting with this content is equivalent to directly visiting those sites.

6. Security Measures

We implement rigorous technical and organizational measures:

Encryption: AES-256 at rest, TLS 1.3 in transit
Access: Role-based access control (RBAC) — each user accesses only their own data
Isolation: Customer data is completely segregated between accounts
Audit: Complete logging of all data access
Location: Servers exclusively in the EU (Hetzner — Germany & Finland)
Backup: Automated encrypted backups, 30-day retention
Firewall: Multi-layered protection systems against unauthorized access
Monitoring: 24/7 monitoring with automatic anomaly alerting

7. Automated Decision-Making

We use automated processing for the following purposes:

Security

Automatic detection and blocking of unauthorized access attempts (brute-force, DDoS)
Identification of suspicious behavior based on access patterns

PBX Data Processing

Automatic call transcription via Speech-to-Text
Automatic generation of summaries, sentiment scores, and alerts via AI models
These processes are initiated exclusively by the customer and do not involve automated decisions with legal effects

No automated process produces decisions with significant legal effects without human intervention.

Under Regulation (EU) 2016/679, you have the following rights:

Right of access (Art. 15) — Request a complete copy of personal data we hold
Right to rectification (Art. 16) — Correction of inaccurate or incomplete data
Right to erasure (Art. 17) — “Right to be forgotten” (with legal exceptions — e.g., fiscal obligations)
Right to restriction (Art. 18) — Limit processing in certain circumstances
Right to portability (Art. 20) — Export in structured format (JSON/CSV)
Right to object (Art. 21) — Refuse processing based on legitimate interest
Right to withdraw consent (Art. 7) — At any time, without retroactive effects

How to Exercise These Rights

Send an email to [email protected] with the subject “Exercise GDPR Rights”
Specify which right you wish to exercise
Provide sufficient information for identification (the email associated with your account)
We respond within 30 days of receiving your request
In complex cases, the deadline may be extended by 60 days, with prior notification

9. International Data Transfers

Primary data storage is exclusively in the EU (Hetzner servers in Germany and Finland).

For third-party services headquartered outside the EU (Cloudflare, Stripe), transfers are carried out based on:

Standard Contractual Clauses (SCC) approved by the European Commission
Data Processing Agreements (DPA) signed with each provider
Additional technical measures: end-to-end encryption, data minimization, pseudonymization

AI transcription services receive only text for processing, not directly identifiable personal data.

10. Security Incident Notification

In the event of a security incident affecting personal data:

We notify ANSPDCP within 72 hours of discovery, per Art. 33 GDPR
We inform affected users without undue delay, per Art. 34 GDPR
We document the incident, its impact, and corrective measures taken
We implement preventive measures to avoid similar incidents

11. Data Retention Periods

Data Type	Duration	Reason
Account data	Contract duration + 5 years	Legal obligations
Billing data	10 years	Fiscal legislation
PBX data (CDR, transcriptions)	Per customer settings	Customer-controlled
AI Front Desk — requests and conversations	90 days by default, adjustable 30–365 by the customer	Customer-controlled
Server logs	12 months	Security
Support data	2 years	Legitimate interest
Analytics data	26 months (anonymized)	Service improvement
Marketing data	Until consent withdrawal	Consent

After the retention period expires, data is permanently deleted or irreversibly anonymized.

12. Cookies

We use essential and optional cookies. For complete information about cookie types, their duration, and management options, see our Cookie Policy.

13. Minors

Our services are exclusively for business entities and are not directed at individuals under 16 years of age. We do not knowingly collect data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

14. Policy Changes

We notify by email of substantial changes at least 30 days before they take effect
Minor changes (clarifications, format updates) take effect upon publication
The last update date is displayed at the top of the page
We recommend periodically reviewing this page

15. Contact

SCIT Technology SRL Cluj-Napoca, Romania

DPO Email: [email protected] General Email: [email protected] Phone: +40 376 443 322 Contact page: /en/contact

Supervisory Authority

If you believe your personal data has been handled incorrectly or your rights have not been respected, you may file a complaint with:

National Supervisory Authority for Personal Data Processing (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania Website: www.dataprotection.ro