Privacy Policy

1. Data Controller

The controller of your personal data is Wavox (the Controller), operator of the wavox.ai platform. For data protection inquiries, please contact us at: [email protected]

2. Data We Collect

• Full name – when submitting a request form or registering an account
• Email address – for communication and system authentication
• Phone number – for product demonstrations and support
• Company name, job title and industry
• Technical data: IP address, browser type, operating system, cookie data
• Chat history from the on-site chat widget and support tickets
• Audio data from calls handled by the voice bot (with consent of all parties)

3. Legal Basis for Processing (Art. 6 GDPR)

• Art. 6(1)(a) – consent of the data subject (contact forms, newsletter)
• Art. 6(1)(b) – processing necessary for the performance of a contract or pre-contractual steps
• Art. 6(1)(c) – compliance with a legal obligation
• Art. 6(1)(f) – legitimate interests of the Controller (analytics, system security, defence of legal claims)

4. Purposes and Retention Periods

• Contact forms and product demos – for the duration and 2 years after completion
• Contract performance and account management – for the contract term and 5 years thereafter
• Direct marketing – until withdrawal of consent or successful objection
• Service improvement and analytics – in anonymised form or for up to 2 years
• Defence against legal claims – for the applicable statutory limitation period

5. Sharing with Third Parties

Your data may be shared with sub-processors acting under data processing agreements: Supabase Inc. (database, authentication), Retell AI Inc. (voice synthesis and analysis), Telegram Bot API (internal notifications). Data is not transferred outside the European Economic Area except where the recipient ensures adequate protection pursuant to an EU Commission decision or Standard Contractual Clauses (Art. 46 GDPR).

6. Cookies and Tracking Technologies

• Essential cookies – required for site functionality and authentication (basis: legitimate interest)
• Analytics cookies – measuring traffic and user behaviour (basis: consent)
• Functional cookies – remembering language preferences and sessions (basis: legitimate interest)

You can manage cookies via your browser settings or withdraw consent through the cookie banner at any time. Withdrawal does not affect the lawfulness of prior processing.

7. Your Rights (Art. 15–22 GDPR)

• Right of access – obtain confirmation and a copy of your personal data
• Right to rectification – request correction of inaccurate or incomplete data
• Right to erasure – request deletion of data in cases specified in Art. 17 GDPR
• Right to restriction of processing – request suspension of processing under Art. 18 GDPR
• Right to data portability – receive your data in a structured, commonly used format
• Right to object – object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent – at any time, without affecting the lawfulness of prior processing

To exercise your rights, please contact us at: [email protected]

8. Data Security

We have implemented technical and organisational measures appropriate to the level of risk, including TLS/HTTPS encryption, role-based access control, incident monitoring and regular security reviews. In the event of a personal data breach we notify the competent supervisory authority within 72 hours.

9. Right to Lodge a Complaint

If you believe that processing of your data infringes GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Poland: Prezes Urzedu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, [email protected], www.uodo.gov.pl.

10. Policy Updates

We reserve the right to update this Privacy Policy. We will notify you of significant changes via the website or by email. The date of the last update is shown at the top of this document.

11. Contact

For data protection matters, please contact us at: [email protected]