GDPR Statement

1. Roles

• For personal data processed through Ravoqen on behalf of our business customers (their callers, leads, guests, patients where applicable and other end customers), the customer is the controller and SYNTRANOVA AL LTD is the processor.
• For the ravoqen.com website, demo requests, customer accounts, billing, support and our own sales and marketing, SYNTRANOVA AL LTD is the controller (see the Privacy Policy).

2. Data Processing Agreement

Where SYNTRANOVA AL LTD processes personal data on behalf of the Customer, the Ravoqen Data Processing Agreement forms an integral part of the agreement between the parties. It is accepted together with the Terms of Service when the customer account is created or a subscription is purchased, before any processing on the customer’s behalf begins, and it implements Article 28 GDPR.

3. Subprocessors

We use carefully selected subprocessors for cloud infrastructure, telephony, conversational AI and speech processing, messaging, email delivery, security monitoring and push notifications. The current list, with each subprocessor’s identity, function, location and transfer safeguards, is available to customers in the dashboard under Legal & Compliance → Subprocessors. We notify customers in advance of new or replacement subprocessors, as set out in the DPA.

4. International transfers

Customer data is stored in the EU (servers in Germany, backups in Finland). Some subprocessors process data outside the EEA, notably in the United States; such transfers are covered by Standard Contractual Clauses or an adequacy decision, including the EU–US Data Privacy Framework where applicable.

5. Security

TLS 1.2/1.3 encryption in transit, restricted and logged administrative access, encrypted storage of integration credentials, encrypted off-site backups in the EU, monitoring and regular patching. The Service is not end-to-end encrypted, because processing providers must read the content they process.

6. Personal data breaches

Where Ravoqen acts as processor, SYNTRANOVA AL LTD will notify the affected Customer of a personal data breach affecting Customer Data without undue delay after becoming aware of it and will provide reasonable information and assistance necessary for the Customer to comply with Articles 33 and 34 GDPR. Where we are controller, we notify the supervisory authority and affected individuals as required by law.

7. Retention and deletion

• Call recordings and transcripts are kept for 12 months and then deleted automatically, unless the customer chooses a shorter period or deletes them earlier.
• After the end of the contract, customers can export their data for 30 days; thereafter it is deleted or returned in accordance with the customer’s documented instructions and the DPA, unless the law requires continued storage. Encrypted backups expire within at most 6 months.

8. Data subject requests

Requests concerning customer data are handled by the customer as controller; we forward any request we receive and assist the customer. Requests concerning data for which we are controller can be sent to contact@ravoqen.com.

9. Health data and AI transparency

The default configuration for healthcare businesses is designed to minimise health information (appointment type rather than medical details). Special-category data may only be processed where expressly agreed and where the customer has a valid basis under Articles 6 and 9(2) GDPR. The Service tells people at the start of an interaction that they are communicating with an AI assistant.

Operator. Ravoqen is a brand operated by SYNTRANOVA AL LTD · Nikis 1, Anthoupoli, 2350 Nicosia, Cyprus · Company registration no. HE 485824 (Registrar of Companies, Cyprus) · VAT CY60296296V · contact@ravoqen.com