Purpose and status
These terms describe how Virturing processes personal data for a customer using the services. They supplement the applicable order or customer agreement and are not a substitute for a signed data processing agreement where one is legally or contractually required. A signed version can identify the contracting entities, subject matter, duration, data categories, locations, and selected subprocessors.
Roles
For customer-configured service data, the customer generally acts as controller or business and Virturing acts as processor or service provider. Each party remains responsible for its independent controller activities. Virturing acts as controller for its own website, account, billing, security, abuse-prevention, and business operations.
Documented instructions
Virturing processes customer personal data only to provide and secure the documented service, follow customer configuration and support requests, comply with law, and meet the applicable agreement. Instructions may cover number routing, media transport, agent execution, tools, recordings, transcripts, events, exports, support, and deletion. Virturing will notify the customer where an instruction appears unlawful unless prohibited from doing so.
Customer obligations
The customer is responsible for a lawful purpose and basis, required notices and consent, accurate instructions, data minimization, recipient and caller rights, tool permissions, recording settings, retention, and responses to individual requests. The customer must not provide data that the service is not authorized or configured to process.
Confidentiality and access
Personnel and contractors authorized to process customer data are subject to confidentiality obligations and receive access based on role and need. Virturing maintains controls for account access, service credentials, administrative access, and support access appropriate to the service.
Security measures
Measures may include encryption in transit, protected storage where applicable, scoped secrets, environment separation, access logging, monitoring, backup protection, dependency maintenance, vulnerability remediation, and incident-response procedures. The customer remains responsible for its endpoints, credentials, user access, connected systems, and workflow configuration.
Subprocessors
Virturing may engage subprocessors for cloud infrastructure, telecommunications, AI and speech, realtime media, identity, payment, analytics, observability, and support. Subprocessors receive only the access required for their function and are subject to data-protection obligations appropriate to that function. Current categories and confirmed website providers are described on the Subprocessors page.
International transfers
Processing locations depend on the selected market, carrier, infrastructure, and workflow provider. Where law requires a transfer mechanism, the parties will use an applicable mechanism such as approved contractual clauses, an adequacy decision, or another lawful safeguard. Customer-specific location commitments must be written in the applicable order.
Individual requests
Taking into account the nature of processing, Virturing will provide reasonable assistance for access, correction, deletion, restriction, objection, portability, and similar requests that the customer is responsible for answering. Virturing may redirect a requester to the customer where the customer controls the data.
Security incidents
Virturing will investigate confirmed unauthorized access to, acquisition of, or disclosure of customer personal data and notify affected customers without undue delay when notification is required under the applicable agreement or law. Notice will include available information about the nature, likely consequences, containment, and recommended customer actions.
Assessments and audits
Virturing will provide information reasonably necessary to demonstrate its processing obligations, subject to confidentiality, security, and provider restrictions. Any audit scope, frequency, access, cost, and remediation process should be agreed in writing to avoid creating risk for other customers or the service.
Return, deletion, and backups
During the service, customers may export supported data through available product functions. At termination or on valid instruction, eligible customer data is returned or deleted according to the agreement, account configuration, technical dependencies, backup lifecycle, and legal obligations. Protected backups are isolated from normal use and expire through their normal lifecycle.
Priority and contact
A signed order, enterprise agreement, or data processing agreement controls where it states different or more specific processing terms. Data-protection questions and requests for a signed DPA can be sent to privacy@virturing.ai.