Privacy

The Aircall Privacy Policy (the “Privacy Policy”) relates to, and, to the extent necessary, supplements the Aircall Terms of Use which appear at https://aircall.io/terms-of-use/sas for the European version and at https://aircall.io/terms-of-use/inc for the North American (US & Canada) version. Unless otherwise provided herein, all terms starting with a capital letter shall have the meaning ascribed to them in such Terms of Use.

1. Definition and nature of Personal Data

During the use of the Aircall services (the “Services”) subscribed via the website https://aircall.io (hereinafter referred to as the “Site”), Aircall.io., Inc., a Delaware corporation, located at 33 W 17th St, New York, NY 10011 and its subsidiaries, in particular Aircall SAS, a French société par actions simplifiée (SAS) whose registered office is at 11-15, rue Saint Georges, 75009 Paris (France), registered with the Paris Registre du commerce et des sociétés under No. 807 437 595 (“We”, “Us”, “Our” or “Aircall”) may require from Your organization which subscribed to the Services (“You”, “Your” or the “Subscriber”) to provide Us with Personal Data to access and use the Services, or You may need or happen to provide Us with Personal Data for the same purposes. For the purpose of this Privacy Policy, the term “Personal Data” means any data or information that enables the identification of an individual (whether directly or indirectly), such as their family name, first name, photograph, post address, email address, telephone number, data relating to their transactions with You, detail of their orders and subscriptions placed with You, IP address, voice, as well as any other information about them that You provide Us with. It also relates to any personal information of Your employees, agents or representatives provided to Us for the purpose of using the Services.

2. Purpose of this Privacy Policy

This Privacy Policy applies to any individual accessing and using the Services directly or indirectly, whether You make or receive a call. By using the Services, You, Your employees, agents and representatives shall be deemed to agree to, and be obligated to comply with, the terms of this Privacy Policy. We may amend the terms of this Privacy Policy from time to time and shall give You notice thereof by email or via a pop-up on the Site. If You do not agree with the amended version of the Privacy Policy, You should stop using the Services as any use of the Services following such notice constitutes Your acceptance of the new Privacy Policy. All amended terms automatically become effective on the sooner of: a) the day You use the Services; or b) ten (10) days after the new Privacy Policy is posted on the Site, provided that You did not inform Aircall of Your refusal of the new version of it, which would amount to a termination notice of the Services with immediate effect, with all due consequences as provided in the Terms of Use.

Should We add new consent-based processing of Personal Data, We shall ensure to obtain Your consent therefor prior to processing such Personal Data (e.g. via a box to tick).

You shall remain at all times responsible for complying with all laws and regulations, in particular those regarding Personal Data, and personally liable for any breach thereof.

We may indeed process Personal Data We collect for the limited purposes described in this Privacy Policy, and thereby act as Data Controller for those limited purposes only. However, and outside of the scope of these limited instances, You shall be considered the Data Controller, and we shall act solely as a Data Processor, as regards the processing of Your information for the purpose of providing the Services.

In that capacity and within the scope of the Services, You are exclusively responsible in particular for:

• making any declarations necessary to the relevant data protection authority;
• complying with its obligations as Data Controller under all applicable laws and regulations informing you about their Data Processing practices and, if required, obtaining your explicit consent when collecting your Personal Data;
• ensuring they have the authority to use any Personal Data collected in accordance with the defined purposes and refraining from any unauthorized use.

3. Purposes

The table below indicates the different purposes Personal Data may be processed for, as well as their different categories, the legal basis the processing is based on, their recipients* and applicable retention period.

Purpose	Personal Data collected	Legal basis	Recipients	Retention
Account creation and management Management of Your access and use of the services	- Name, surname - Email address and phone number - ID, username, and encrypted password	- Performance of an agreement (To provide You with the service You requested). - Legitimate interest (To ensure Our websites/apps remain secure, to protect them against fraud).	- Desk - Freshdesk - Front - HelpScout - HubSpot - Intercom - Pipedrive - Salesforce - Slack - Zapier - Zendesk - Zoho - Any other CRMs/Helpdesks that we may collborate with	Duration of use of the Services
Management of numbers and processing of calls To be able to perform inbound and outbound calls	- Phone number(s) - Call / user identifier(s) - Call metadata (duration, phone number(s) of Your correspondent(s))	- Performance of an agreement (To provide You with the service You requested).	- Amazon Web Services - Intercom - Zendesk - Salesforce - Pusher	Duration of use of the Services
Storage of recordings To be able to access Your call recordings in a secure way	- Call recording - Call metadata (duration, origin and destination phone numbers)	- Performance of an agreement (To provide You with the service You requested, possibility to deactivate this feature at all time). - Legitimate interest (To ensure Our websites/apps remain secure, to protect them against fraud).	- Amazon Web Services - Cloud communication platform - Telecommunication operators - Phone number providers	Duration of use of the Services
Integration with CRMs and Helpdesks To be able to synchronize data about Your calls in Your CRMs/Helpdesk	- User name - Call metadata (origin and destination phone numbers, duration) - User notes	- Performance of an agreement(To provide You with the service You requested, only for the integration that You have activated).	- Amazon Web Services - Cloud communication platform	Duration of use of the Services
Management of commercial agreements and billing	- Name, surname - Email address and phone number - Billing history	- Performance of an agreement (To provide You with the service You requested). - Legitimate interest (To be able to claim payment of outstanding invoices).	- Amazon Web Services - Payment gateway - Salesforce - DocuSign	5 Years
Creation of a client / prospect data base Newsletter and commercial communications subscription	- Consent: To send You direct marketing communications. - Legal grounds: To keep Your details on a suppression list if You have asked Us not to send You any direct marketing anymore.	- Performance of an agreement (To provide You with the service You requested). - Legitimate interest (To ensure Our websites/apps remain secure, to protect them against fraud).	- Amazon Web Services - Salesforce - Pardot	3 years from the last contact / exchange with the data subject / the end of the relationship
To generate statistics on Your experience of the Services and collect Your opinion on the Service (to improve the Services)	- Name - Phone Conversation - Browsing	- Legitimate interest (To understand how You use the Services and to improve them).	- Amazon Web Services - Segment - SatisMeter - Google Analytics and Tag Manager - BI tools - Product analytics tools	6 months
Storage of Your client’s / end users’ Personal Data During and for the purpose of Your use of the Services, You may have to keep record of Your client’s / end users’ personal Data on our servers. Conversely, We may have to keep such records for the purpose of providing our Services to You.	- Name - Date of birth - Citizenship - Post address - Email address - Bank details - Any other relevant Personal Data You may need to store for the purpose of providing Your services	Performance of an agreement (To provide You with the service You requested)	- Salesforce - Any other CRMs/Helpdesks that we may collaborate with	Duration of use of the Services

*You may contact Us to obtain the list of Our sub-processors.

We will inform You, upon request, whether it is compulsory or optional to provide certain Personal Data. Failure to comply with a compulsory request for Personal Data shall result in Your access to the Services being denied or suspended, it being understood however that it shall not affect any of Your financial obligations towards Aircall.

4. Recipients of the collected Personal Data

Only Our personnel, the services in charge of control (especially: external auditor) and Our recipient subcontractors listed in the above table may have access to any Personal Data. Personal Data may also be disclosed in response to lawful requests made by government agencies or public authorities, including public officers or debt collection organizations, to meet national security, law enforcement or any other legal requirements. In any event, Aircall shall remain liable in cases of onward transfers to third parties.

Depending on where You are located, we might have to enforce local regulations and requirements where the use of a local phone number requires to keep user details (in particular, first/last name and address) in the event we should receive an official request from a competent local authority.

5. Transfer / sale of personal databases

We shall not, without Your agreement, sell or let Personal Data to third parties. We shall only transfer Personal Data to another location, whether physical or numerical, if strictly necessary to provide the Services, or if You specifically agree with it.

6. Retention of Personal Data

6.1 General provisions

Where Aircall is the Data Controller of Personal Data (for example, Personal Data relating to the Site visitors, or individuals who register to use our Services), then we retain the Personal Data we collect where we have an ongoing legitimate business need to do so (for example, to provide them with our Services, to enable their participation in an event, and to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process Personal Data, we will either delete or aggregate it or, if this is not possible (for example, because Personal Data has been stored in backup archives), then we will securely store it and isolate it from any further processing until deletion is possible.

If Personal Data is processed for, on behalf of, or for the purpose of the Services taken out by, any Subscriber, we will process Personal Data for as long as we are instructed to do so by the relevant Subscriber that is the Data Controller of such Personal Data.

Personal Data shall be stored for the duration of Your use of the Services as well as for the different renewal periods, and for the purposes listed above.

We may retain Personal Data to comply with Our legal or regulatory obligations. In any case, upon ceasing or lifting of such obligations, Personal Data shall be removed from our systems and records, as well as that of our subcontractors, if any, or otherwise archived or anonymized so that they can no longer be identified.

6.2 Provisions specific to credit / debit card and bank account details

We do not store any bank information or credit details on Our servers, provided that they are handled by a trusted third party independent and different from Aircall.

6.3 Notice to end-users

Our Services are intended for use by enterprises. Where our Services are made available to you through a Subscriber of ours, that enterprise is the Data Controller of your personal information. Your data privacy questions and request should initially be submitted to said Subscriber in its capacity as your Data Controller. Aircall is not responsible for our Subscribers’ privacy or security practices which may be different than this Privacy Policy.

Aircall’s Subscribers are able to:

• restrict, suspend or terminate your access to the Services;
• access and describe your personal information that you provided to them;
• access and export your personal information processed by them; and
• amend your personal information, including your end-user profile.

7. Personal Data Transfer outside of the European Union

Personal Data may be transferred, accessed to and stored in a country located outside the EEA. Personal Data can also be processed by individuals working outside the European Economic Area (“EEA”) who work for Us or for one of Our trusted service providers, such as Our hosting providers (Amazon). In any case, Personal Data are only transferred in a secure manner and in compliance with the applicable regulations. As some countries may not have laws governing the use and transfer of Personal Data, we undertake to take all necessary steps to ensure that third parties comply with the terms and conditions set out in this Privacy Policy. These measures may include controlling the standards applied by such third parties with respect to Personal Data protection and security, and/or the execution of appropriate agreements to deal with such transfers (e.g. the standard contractual clauses adopted by the Commission of the European Union).

Aircall commits to cooperate with EU data protection authorities (DPAs) and comply with the advice given by such authorities.

Aircall abides by and has certified adherence to the principles of the EU-U.S. and Swiss-U.S. Privacy Shield frameworks as set forth by the U.S. Department of Commerce. For more information on the Privacy Shield frameworks, and to view the scope of Aircall’s certification, please visit https://www.privacyshield.gov/. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact us by email to privacy@aircall.io. For residual Privacy Shield disputes that cannot be resolved by the methods above, you may be able to invoke a binding arbitration process under certain conditions. To find out more about the Privacy Shield’s binding arbitration scheme, please see: https://www.privacyshield.gov/article?id=ANNEX-I-introduction

The Federal Trade Commission has investigation and enforcement authority over our compliance with the Privacy Shield.

If we have received Personal Data under the Privacy Shield and subsequently transfer it to a third-party service provider for processing, we will remain responsible if they process Personal Data in a manner inconsistent with the Privacy Shield Principles, unless we prove that we are not responsible for the event giving rise to the damage.

8. Safety / Security

We undertake to implement all necessary precautions, as well as the appropriate organizational and technical measures, to maintain the security, integrity and confidentiality of Personal Data, and in particular to prevent them from being modified or damaged and stop any unauthorized third party from accessing them. In particular, our employees’ accounts are secured by strong passwords, and they are all bound by confidentiality obligations. We also use state-of-the art secured payment systems consistent with applicable regulation. However, You agree that no data transmission over the Internet, or information storage technology, can be guaranteed to be 100% secure.

9. Cookies

Cookies are alphanumeric identifiers / trackers that are transferred to the device You use to access the Services via Your browser. We may implement two types of cookies: technical cookies and advertising cookies.

We use technical cookies to facilitate Your browsing experience (such as session cookies so that You do not have to retype Your login and password when You connect to Your account for example). They simplify Your visit and enhance Your experience of the Services. You can refuse the installation of technical cookies in Your browser settings. However, You acknowledge that this refusal could prevent You from using the Services.

In addition, we also implement advertising cookies which result in the display of targeted advertising on websites that matches Your previous/current browsing activity on the Site. Advertising cookies enable the use of the retargeting technique which is a marketing model purporting to propose tailored advertisements to the end user. As You browse on the Site, advertising cookies will be placed in Your computer so that we can understand what You are interested in. Our display advertising partners enable Us to present You with retargeting advertising on other websites based on Your previous interaction with the Site. The techniques Our partners do not collect personal information such as Your name, email address, post address or telephone number but only Your IP address.

The cookies used by the Site are the following:

Identification of the cookie	Purpose	Nature	Opt-out
Google Ad Service	Retargeting ads	Advertising	Opt-out
Google Analytics	Use of the Site	Performance	Opt-out
Google Tag Manager	Use of the Site	Performance	Opt-out
Intercom	Live chat	Functionality	Opt-out
Pardot	Retargeting emails	Marketing	Opt-out
Wistia	Use of Our Videos	Performance	Opt-out
Zarget	A/B testing	Performance	Opt-out
Facebook	Retargeting ads	Advertising	Opt-out
Amplitude	Use of the Site	Performance	Opt-out
Stripe	Payment	Fraud detection	Opt-out

If You click on the “Accept / Agree” button on the cookies banner upon Your first visit on the Site, You will be deemed to have agreed to the use of cookies by Aircall on Your devices.

In addition, the use of the Site may result in the installation of certain cookies issued by third parties (communication agencies, audience measurement companies, social networks, YouTube, etc.) that are not controlled by Aircall. These cookies are subject to such third parties’ privacy policies.

The default settings for Internet browsers are usually set to accept cookies, but You can easily change Your browser’s settings.

For more information please visit: http://www.aboutcookies.org/.

Please note that if You refuse the installation or use of a cookie, a "refusal cookie" will be installed on Your device to track Your refusal. You need to ensure that You do not delete this cookie so that Your choice is taken into account.

You may also use a cookie management software, such as the TarteAuCitron or TagCommander software. A list of additional software is also available on the French data protection authority website.

10. Third parties links on the Site

Our Site and Services may include links to and from the websites of Our partners, advertisers and affiliates. If You follow a link to any of these websites, please note that these companies have their own privacy policies and that Aircall is not responsible or liable for any use of Personal Data by such third parties. We recommend that You check their policies before You visit these websites.

11. Your rights and choices

When You choose to provide Personal Data, You expressly consent to the collection and use thereof, in accordance with the provisions of this Privacy Policy and applicable laws and regulations.

Any data subject shall have the following rights:

• To access and obtain a copy of Personal Data that we process;
• To rectify the Personal Data if inaccurate or outdated and/or supplement them if incomplete;5
• To object to the processing of Personal Data that is based on legitimate interests;
• To erase Personal Data and to be forgotten;
• To withdraw their consent, at any time, to any processing of their Personal Data that is solely based on their consent (for they may object to receiving Our marketing emails at any time by clicking on the "unsubscribe" link in any email or communication we send them);
• To file a complaint before a supervisory data protection authority;
• To portability: they have the right to move, copy or transmit Personal Data relating to them;
• To restrict or limit the processing of Personal Data;
• To set guidelines to organize the use of Personal Data after their death.

To exercise any of the above rights of if You have questions regarding this Privacy Policy or about the security measures we implement, please contact Us by email at privacy@aircall.io.

In the event of any dispute, claim, question or disagreement arising from or relating to this Privacy Policy or breach thereof (the "Dispute"), and without prejudice to the claimant’s right to seize the CNIL, the French data protection authority (https://www.cnil.fr/en/home), in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the claimant should first seek an amicable resolution thereof by contacting Aircall in writing, stating its grounds and providing any supporting evidence.