GDPR and Data Processing

SIMCOAI is built for business customers that need to configure customer support, front-desk calls, chat and workflow records. The business customer decides what data is processed, why it is processed and how long it should be kept for its customers.

SIMCOAI provides the platform, security controls, provider integrations, logs and support needed to process data under those instructions where it acts as processor.

The customer is usually controller for data about its own callers, website visitors, patients, clients, guests, members or shoppers. The customer should maintain privacy notices, lawful basis records, staff instructions, retention policies and DSAR handling.

SIMCOAI should be configured with only the information needed to answer, route or log the customer task.

SIMCOAI is usually controller for account administration, website visitors, billing contacts, support enquiries, security telemetry, legal acceptance records and supplier management.

These records are processed to provide the service, manage contracts, secure the platform, meet legal duties and communicate with business contacts.

Where SIMCOAI processes personal data on behalf of a business customer, the following terms apply and form part of the agreement between SIMCOAI LTD (processor) and the customer (controller). Subject matter: provision of the SIMCOAI service. Duration: the term of the agreement plus the wind-down period below. Nature and purpose: hosting, AI-assisted response generation, call and chat handling, workflow records, analytics and support. Categories of data subjects: the customer’s customers, callers, enquirers and staff. Categories of personal data: contact details, communication content and metadata, booking, order and refund details, and related records the customer submits.

SIMCOAI will: (a) process personal data only on the customer’s documented instructions, including as configured in the dashboard, unless required by law to do otherwise, in which case we will inform the customer unless the law prevents it; (b) ensure persons authorised to process the data are bound by confidentiality; (c) implement appropriate technical and organisational measures under Article 32; (d) engage subprocessors only under a written contract imposing materially equivalent obligations, and remain liable for their performance; (e) taking into account the nature of processing, assist the customer with data subject rights requests and with its obligations under Articles 32–36; (f) notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data; (g) at the customer’s choice, delete or return personal data at the end of the agreement (subject to records we must retain by law) within 30 days; and (h) make available information reasonably necessary to demonstrate compliance and allow for audits, which will normally be satisfied by written responses and available documentation.

Before go-live, customers should identify lawful bases for customer support, call handling, recordings/transcripts, analytics, marketing follow-up, integrations and retention. Consent, contract, legitimate interests and legal obligation may apply in different places.

Where consent is needed, customers must record and honour it. Where legitimate interests is used, customers should balance business need against individual rights and expectations.

UK PECR rules can apply to cookies, marketing calls, messages and similar technologies alongside UK GDPR. Customers should not use SIMCOAI for marketing outreach without appropriate consent, notices, suppression controls and sender compliance.

Call recording, direct marketing, WhatsApp/SMS templates and tracking technologies need their own checks before launch.

Use the least data needed for the workflow. Avoid free-text collection of card numbers, national identifiers, health data, children data or confidential third-party data unless specifically reviewed.

Short, structured questions usually reduce risk and improve AI quality. Escalate instead of asking for sensitive details.

If an individual asks for access, correction, deletion, restriction, portability or objection, identify whether SIMCOAI or the business customer is the controller for that record. Customer workflow data requests usually belong to the business customer.

SIMCOAI can assist with locating records where technically possible and commercially reasonable, subject to identity, security and legal checks.

Customers should decide retention periods for chats, calls, transcripts, workflow records, analytics and exports. SIMCOAI may keep operational logs, billing records and legal acceptance records for separate security, accounting and legal reasons.

Do not keep transcripts indefinitely just because storage is available. Where a subscription is cancelled, SIMCOAI retains the customer workspace for 2 years from the end of access so the customer can return without rebuilding their configuration; it is then deleted. Customers may request earlier deletion, which SIMCOAI will action except where a legal or tax obligation requires specific records to be kept.

Where a business customer uses the customer database, SIMCOAI holds one record per person containing the identifying and contact details that business has collected, together with any additional fields it has chosen to define. A caller is matched to an existing record using the telephone number they are calling from, so a record can be identified before the caller states who they are; matching a record is distinct from confirming the caller’s identity, which is dealt with in the next section. The business customer is the controller of these records; SIMCOAI is a processor.

Deleting a customer record removes that record and unlinks it from the bookings, refunds, orders and escalations it was connected to. Those workflow records are not deleted with it, because they are the business's own trading and accounting history and may be subject to separate retention obligations. Where an erasure request extends to the underlying workflow records, the controller must request that separately and SIMCOAI will action it except where a legal or tax obligation requires specific records to be kept.

Where a business customer defines additional fields on a customer record, that business is responsible for deciding what is recorded in them. Special category data should not be entered into a customer record unless the controller has established an Article 9 condition for doing so.

Before the assistant discusses information already held on a customer record, it establishes whether the person it is speaking to is that customer. Recognising a record and confirming the person are treated as separate steps, and only the second permits disclosure of what is already on the account.

A caller is treated as confirmed where the calling line identity supplied by the telephone network matches the number on the record; where the caller states both the name and the email address held on the record and both match; or where the caller returns a single-use code sent to the email address already on the record. A telephone number spoken by the caller is not accepted as confirmation, because it does not evidence who is holding the line. Where a caller supplies their own email address or an order reference, the assistant assists with the records matching that detail without treating it as a full identity confirmation.

Until a caller is confirmed, the assistant may take a new booking, order or refund request from them and may address them by name, but does not disclose existing records, contact details or the contents of an account. Where confirmation is not achieved, the request is captured and passed to the business customer to handle.

SIMCOAI records the fact of each check: the customer record concerned, the method used, whether it succeeded, and the call it took place on. This is processed for security and fraud-prevention purposes, and is the record by which a controller can demonstrate that a disclosure was made to a confirmed individual. A confirmation applies only to the conversation in which it was obtained and is not carried over to a later contact. These records are held with the customer record and are removed with it; single-use codes are held only for the short period in which they can be used.

The methods above are checks proportionate to a customer-service context. They are not an assurance that impersonation cannot occur. Controllers handling higher-risk requests should configure escalation to a person rather than relying on the assistant to release information.

Use role-based access, strong passwords or OAuth, least-privilege API keys, careful integration scopes, secure staff offboarding and periodic review of billing/admin activity.

SIMCOAI applies technical controls including request rate limits, strict browser security policies, protected administrative routes, pricing and entitlement checks applied on our own systems, isolation of administrative credentials from customer access, and traceable request records used for troubleshooting.

Account access data — passkey public keys, authenticator secrets, single-use sign-in tokens and federated identifiers where you use Google sign-in — is processed to authenticate you and to protect the account. For Auth0-backed accounts, passwords are held and verified by Auth0 rather than by the SIMCOAI dashboard. SIMCOAI holds no password record for your account, in any form. Passkey private keys remain on your device and are never transmitted to SIMCOAI. No biometric data is processed by SIMCOAI or by the identity provider. Where a passkey or device-based second step is unlocked with a fingerprint or face scan, that verification is performed by your own device and its result — a yes or no — is all that is ever communicated. No fingerprint, facial geometry or other biometric template is collected, transmitted, stored or used to identify you, so no special category data under Article 9 UK GDPR arises from these sign-in methods.

Sign-in events are retained as part of the account audit trail so that you and we can investigate suspicious access. Where you exercise a deletion right, authentication data is removed with the rest of the account record, subject to any retention we are legally required to observe.

Multi-factor authentication cannot be bypassed by SIMCOAI support on request. This is deliberate: an account recovery route that support can trigger is also a route an attacker can social-engineer.

AI should support customer service and routing, not make final regulated decisions. Sensitive topics should be handed to a human. Model responses should be tested with realistic scenarios before production use.

Keep business knowledge updated. Vague or stale knowledge increases hallucination and customer harm risk.

Sign‑in and account security are operated through Auth0 (Okta, Inc.) as a subprocessor engaged under the general written authorisation in this policy. SIMCOAI remains the controller for account‑administration data and, where the customer is controller of end‑customer data, that allocation is unaffected: the identity provider does not receive end‑customer records, call content, conversation logs or workflow data.

The categories processed for authentication are limited to what a login requires: email address and its verification state, the provider‑issued subject identifier, sign‑in and sign‑out events with timestamp, multi‑factor and authenticator‑app enrolment state, passkey and passwordless registrations, and, where a customer chooses Google or Microsoft sign‑in, the account identifier and basic profile claims returned by that provider. SIMCOAI stores a linked record containing the user reference, provider name, provider subject, email address, verification flag, basic profile metadata and last sign‑in timestamp, so an account can be matched to its identity across sessions.

Data subject requests are handled by SIMCOAI as the single point of contact. Where a request requires erasure or rectification of authentication records, SIMCOAI will action its own records and instruct the identity provider for records held there; the customer does not need to approach the provider separately. Where authentication data is processed outside the UK, the international transfer mechanism set out in this policy applies and is reviewed on the same cycle.

Availability of any individual method — passkeys, authenticator apps, email sign‑in links and codes, Google or Microsoft sign‑in, or passwordless login — is stated as available where enabled for an account. Nothing in this section is a warranty that a given method is enabled, that authentication is uninterrupted, or that any control prevents compromise.

The customer gives general written authorisation for SIMCOAI to engage the subprocessors needed to run the service, currently including Fasthosts (hosting, servers, storage, domain services and transactional email for the self-hosted database), Auth0 (Okta, Inc.) for login and account security, Stripe (billing), Twilio (telephony and messaging), the managed AI model provider OpenAI for AI responses (SIMCOAI manages their credentials centrally), Deepgram (speech recognition) and ElevenLabs (voice) on phone-enabled plans, Cloudflare (security and delivery) and hosting/monitoring providers. The current list is summarised in the supplier table below and available on request.

We will give notice of intended additions or replacements of subprocessors via the dashboard, documentation or email. If the customer reasonably objects on data protection grounds within 14 days, the parties will discuss in good faith; if no solution is found, the customer may cancel the affected feature or subscription and receive a pro-rata refund of prepaid fees for the unused period.

Some of the suppliers listed above process personal data outside the United Kingdom. Naming the safeguard relied on is a requirement of Chapter V UK GDPR, so it is set out here rather than left to each supplier.

Where SIMCOAI transfers personal data outside the UK, or allows a supplier to do so, the transfer is made on one of the following bases: (a) UK adequacy regulations, where the destination is covered by them; (b) the ICO’s International Data Transfer Agreement; or (c) the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum. Where (b) or (c) applies, a transfer risk assessment is carried out before the transfer begins and repeated if the destination, the supplier or the data materially changes.

Suppliers that may process outside the UK include Auth0 (Okta, Inc.), Stripe, Twilio, OpenAI, Deepgram, ElevenLabs and Cloudflare. The mechanism relied on for an individual supplier, and the transfer risk assessment where one applies, are available to customers on request. Some suppliers also rely on their own certifications, such as the UK Extension to the EU–US Data Privacy Framework; a supplier’s certification is not treated as sufficient on its own without checking that it is current.

Customers with strict location or transfer requirements should raise them before go-live, because some can be met by restricting which features are enabled and some cannot be met at all. Do not assume every workflow is suitable for every jurisdiction without review.

SIMCOAI will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data, and will provide information reasonably available to us about the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences and the measures taken or proposed. We will cooperate with the customer and take reasonable steps to mitigate the effects of the breach.

If you suspect an incident, preserve logs, timestamps, account IDs and affected workflow details, notify us promptly at hello@simcoai.co.uk and avoid deleting evidence until triage is complete. The customer remains responsible for its own controller obligations, including deciding whether to notify the ICO within 72 hours and affected individuals where required.

Higher-risk deployments should maintain records of processing activities and consider a DPIA, especially where call recording, large-scale monitoring, sensitive data, profiling or vulnerable individuals are involved.

SIMCOAI can provide product information to support customer assessments but does not replace independent legal review.

Before launch, confirm privacy notices, cookie notices, call disclosure, recording settings, retention, escalation rules, support contacts, lawful basis records, billing status and test results.

Re-review configuration after plan upgrades, new add-ons, new integrations or changes to customer-facing workflows.