SINGLE NOTICE: "AUTOMATED CALLS BY AI VOICE AGENT"

0.1 GDPR Roles

When the Customer uses Convertr to contact its leads, prospects, or end clients, the Customer acts as the data controller and Convertr acts as the data processor, upon documented instruction and within the limits set by the applicable contractual documentation.

Convertr acts as a data controller only for its own processing operations, notably those related to:

• website management;
• Customer account management;
• support;
• security;
• and, where applicable, the contractual relationship and billing.

0.2 Convertr Operational Organization

As part of its operational organization, Convertr may rely on:

• duly authorized personnel acting under its authority;
• and, when necessary for the performance of the service, the Convertr Professional Services Provider, namely Mr. Adel BELGROUN, for setup, configuration, integration, guidance, maintenance, support, or advertising marketing operations, within the limits of his contractual scope, under confidentiality, on a strict need-to-know basis and with access limited to what is strictly necessary.

0.3 Applicable Documents

This notice supplements:

• the Privacy Policy;
• the Legal Notices;
• the T&Cs (Terms & Conditions);
• and, where applicable, the DPA (Data Processing Agreement).

In the event of a conflict, the contractual documents applicable to the service prevail regarding the execution of the service, without limiting the rights granted to data subjects.

0.4 Contact

For any request for guidance or related to data protection: contact@convertr.fr

1.1 Transparency on Interaction Method

When this feature is activated by the Customer, the call may be carried out, in whole or in part, by an automated voice agent.

As of the date of this version, Convertr recommends, out of caution and reinforced transparency, that it be indicated from the beginning of the call, or as soon as it is relevant:

• that the call is made on behalf of the Customer;
• that it has a commercial or commercial follow-up purpose, when this is the case;
• and, when the chosen scenario provides for it, that the interaction is being carried out with an automated system or an AI-assisted voice agent.

1.2 Identity of the Customer

The call is made in the name of and on behalf of the Customer. You can request at any time:

• the Customer's identity;
• its company name or brand;
• and a means of contact.

1.3 Possibility of Speaking to a Human

Depending on the configuration chosen by the Customer and their operational availability, you may ask to be connected with a human representative.

If this option is not available, particularly outside scheduled hours or in case of unavailability, the call may be limited to qualification, message taking, a proposal for subsequent follow-up, or be terminated.

1.4 Possible Objectives of the AI Voice Agent

Within the initial scope, the automated voice agent can notably be used to:

• ask a limited number of qualification questions;
• gather information useful for commercial treatment;
• produce scoring or categorization;
• propose, if this option is activated, an appointment booking or a human callback;
• transmit simple information related to the request or follow-up.

1.5 Scoring / Profiling — without biometrics or voice cloning at launch

Depending on the activated scenarios, automated analysis of responses can be performed to direct commercial follow-up.

These mechanisms may constitute profiling when they use personal data to evaluate certain aspects, for example, processing priority, expressed interest, or the probability of a follow-up.

At launch, Convertr does not intend to implement:

• voice-based biometric identification;
• biometric voice recognition for identification purposes;
• nor voice cloning intended to imitate a real person.

2.1 Why You Are Being Contacted

At launch, calls via AI voice agent are intended to be used primarily following a prior action by the data subject, for example, when they have:

• filled out a form;
• requested to be contacted back;
• requested a demonstration, a callback, or information;
• or interacted with a Customer's system allowing commercial follow-up.

However, the applicable legal framework depends on the actual context of collection, the status of the contacted person, the channel used, the relevant sector, and the scenario adopted by the Customer.

The Customer remains solely responsible for the applicable legal basis, the information provided, obtaining consent when required, and the corresponding proof.

2.2 On-Demand Activation

The automated calls module is only used on demand and according to the Customer's configuration. Convertr does not initiate automated calls without:

• explicit activation;
• effective configuration;
• and instructions or configurations associated with the Customer's account.

2.3 Rules Regarding Hours and Frequency in France

When the call pertains to unsolicited commercial prospecting directed at a consumer, the Customer must comply with applicable rules regarding days, times, and frequency. As of the date of this version, this may include inter alia:

• calls generally authorized from Monday to Friday, from 10:00 am to 1:00 pm and from 2:00 pm to 8:00 pm, excluding public holidays;
• the prohibition, for the same professional, of soliciting or attempting to solicit the same consumer more than 4 times within 30 calendar days;
• and, in the event of a refusal expressed during the conversation, refraining from contacting the person again before the expiration of a 60 calendar day period.

Convertr provides technical mechanisms, such as statuses, opt-outs, logs, or histories, but concrete adherence to these rules depends on the source data, scripts, call lists, configurations, and usages chosen by the Customer.

2.4 Major Evolution as of August 11, 2026

As point of context, effective August 11, 2026, French law provides, for consumers, a principle prohibiting telephone solicitation without prior consent, except for statutory exceptions, particularly in certain cases related to an ongoing contract.

When this rule applies, it is up to the concerned professional to be capable of demonstrating the existence of valid prior consent, or to substantiate the invoked exception.

2.5 Case of Automated Systems / Call Automaton

When a device is legally classified as a call automaton or an automated direct prospecting system directed at a physical person, scenario conformity must be evaluated with a reinforced level of vigilance.

As a precaution, when the Customer utilizes an automated voice agent, they are responsible for ensuring compliance, notably regarding:

• informing the individual;
• the applicable legal basis;
• proof of consent when required;
• the existence of a simple opt-out or unsubscribe mechanism;
• and proper configuration of scripts, scenarios, and call lists.

2.6 Your Right to Object / Opt-out

You may at any time:

• ask for the identity of the Customer on whose behalf the call is being made;
• request no longer to be contacted by phone for solicitations related to this Customer;
• report that a number is incorrect;
• request human intervention, when possible;
• express opposition to automated follow-up or future solicitations.

Depending on activated tools, Convertr can allow an opt-out status to be recorded, terminating the active automated scenario.

The Customer remains solely responsible for the effective, lasting, and coherent observance of this opposition across all of their channels, campaigns, databases, and connected systems.

2.7 SMS Follow-up (if activated)

Certain Customers may activate SMS follow-up, for example, to confirm an exchange, remind of an appointment, or send a link.

In this case, a straightforward means to stop these communications must be provided, for example via a STOP keyword or contact info indicated by the Customer.

3.1 At Launch: No Audio Recording by Default

At launch, Convertr does not intend to record nor retain call audio by default. The platform primarily utilizes, based on activated features:

• textual transcriptions;
• summaries;
• technical metadata;
• and items useful for follow-up, qualification, or appointment booking.

3.2 If Audio Recording is Activated by the Customer

If an audio recording or retention feature is activated by the Customer, the person called must be clearly informed of this at the start of the call, along with an indication of the purpose pursued and, when required, an opt-out mechanism or another compliant applicable mechanism.

Such recordings should generally only be activated for limited purposes, such as:

• evidence;
• quality;
• security;
• dispute resolution;
• or compliance monitoring.

Appropriate measures are therefore anticipated, including:

• limited retention periods;
• restricted access;
• appropriate security;
• and adequate contractual boundaries.

3.3 General Reminder

Recording words spoken privately or confidentially without adhering to the applicable legal framework can expose one to legal risks, including criminal penalties.

4.1 Data Potentially Processed During the Call

Depending on the activated scenarios, processing may involve inter alia:

• identity and contact data;
• information related to the expressed need;
• answers provided during the call;
• availability or callback preferences;
• technical metadata associated with the call;
• transcriptions, summaries, scores, tags, statuses, or qualification criteria, based on activated features.

The collection of sensitive data is neither sought out nor intended by the service. The Customer remains responsible for their scripts, scenarios, setups, and usages, as well as minimizing data processing.

4.2 Recipients

Information originating from the call may be accessible to:

• the Customer and its authorized teams;
• authorized individuals within Convertr;
• the Convertr Professional Services Provider, namely Mr. Adel BELGROUN, when their intervention is necessary within the context of their contractual scope;
• and, where applicable, technical providers required for the functioning of activated features.

Convertr does not sell personal data.

4.3 Technical Providers / Subprocessors

Depending on the features turned on, Convertr may utilize:

• Twilio: telephony and SMS;
• Retell AI: voice agent, processing required for call execution, transcriptions, and interaction logs, conditionally activated;
• AI Model Providers via APIs, notably OpenAI, Anthropic, Mistral, or Google Gemini, based on practically active workflows.

These AI model providers can be invoked via APIs in the context of Convertr's active workflows or scenarios, specifically orchestrated via the locally self-hosted n8n tool, strictly within limits needed for concerned functionalities.

4.4 Retention Periods

Unless instructed otherwise by the Customer, a specific configuration is applied, or bound by legal obligation, default operational baselines may practically reflect:

• call transcriptions, when active: limited duration and, barring documented need, generally up to 6 months;
• summaries, qualification, scoring, tags, statuses, and associated histories: up to 12 months;
• SMS and related logs: up to 12 months;
• activity and security logs: up to 12 months;
• backups: limited technical rotation, generally up to 60 days.

Upon contract end, modalities around return, export, deletion, anonymization, or limited technical retention are designated by applicable contractual agreements.

4.5 Transfers Outside the EEA

Depending on technical providers and activated features, data processing or transfers outside the European Economic Area may be involved.

When this is the case, Convertr implements appropriate data transfer mechanisms corresponding to the situation, such as an adequacy decision when applicable, or appropriate contractual guarantees supplemented, when required, by technical, organizational, or contractual safeguards.

The mechanism effectively engaged may vary based on:

• the concerned provider;
• their location;
• service configuration;
• and activated features.

4.6 Security

Convertr implements technical and organizational measures calibrated to risk and the service development stage, including the following:

• access administration;
• logging;
• reasonable continuity and backup routines;
• selecting providers displaying compatible assurances;
• incident resolution protocols.

4.7 Invoking Your Rights

For any request pertaining to a call directed on behalf of a Customer, notably spanning opposition, access, correction, erasure, restriction, or another invoked right, the primary interlocutor remains the Customer, owing to their capacity as the data controller.

Should reaching the Customer prove unduly challenging or if guidance is sought, you may write to: contact@convertr.fr

You may also lodge a grievance with the competent Data Protection Authority (such as the CNIL in France).