Details about Personal Data Processing
Annex 1 to the Data Processing Agreement
Nature and purposes of the processing:
The nature and purposes of the processing are defined in the Agreement.
The CLIENT, as the controller, commissions PROVIDER, as the processor, to process Personal Data for the following processing activities:
- Provision of business communication products and services through the cloud communication platform to the CLIENT, including transmission of communications from or to the CLIENT’s software application (API) or via the PROVIDER’s web-based interface (Customer Portal) towards telecom operators or other communication networks;
- Storage of the CLIENT’s Personal Data on the PROVIDER’s platform on behalf of the CLIENT;
- Reporting and analysis and handling other CLIENT’s enquiries according to the CLIENT’s instructions.
- Blocking communications to phone numbers based on risk score threshold agreed with the CLINET using Signal service.
Duration of the processing:
The processing of Personal Data shall be carried out during the provision of PROVIDER Services. PROVIDER shall regularly delete processed Personal Data in accordance with its Data Retention Policy and the corresponding retention schedules, as summarized in the Data Retention Notice available at: https://www.infobip.com/policies/data-retention-notice.
Categories of Data Subjects:
The Personal Data processed may generally concern the following Data Subjects: the CLIENT’s customers or employees (all of them, hereinafter: „end-users“). In any case, and depending on the product/feature used, the precise categories of Data Subjects are always determined solely by the CLIENT.
Categories of Personal Data:
In any case and depending on the product / feature used, the precise categories of Personal Data are always determined solely by the CLIENT.
| Data category | Product/feature |
|---|---|
| CLIENT’s communications content (text, voice, video and audio media, documents, images) and associated communication logs (e.g. timestamp and receiver/sender contact data such as MSISDN, land phone number, or email address) | Communication channels |
| Social media data (e.g end-users’ social media identifiers, usernames and platform-specific IDs, post and comment IDs, content and timestamps of comments/posts, and social media page IDs). | Social Media channels |
| CLIENT’s databases stored on the PROVIDER’s platform containing CLIENT’s end-users’ personal data, including but not limited to name, contact details, date of birth, and gender, imported by the CLIENT or collected on the CLIENT’s behalf (such as People events) in the course of the PROVIDER’s provision of Services. | Conversational CDP (People) |
| In addition to the data categories described under Conversational CDP (People), it may include data unified across all channels and enriched with behavioral event data (e.g. page views, purchase events, session activity), engagement scores, CSAT ratings, preferred communication channel, and segmentation attributes. | AgentOS customer profiles |
| Data provided by the CLIENT and processed through AI-powered features of the INFOBIP Platform such as communication content, campaign and template data, and any other data submitted by the CLIENT for AI-assisted creation, optimization, analysis, and automated processing; may include personal data to the extent included by the CLIENT | AI Credits for usage of AI Services |
| Communication exchanged during end-user interactions with automated chatbot flows and AI-powered journeys, (e.g end-user inputs, bot responses, session identifiers, interaction events, and journey step data) | AgentOS — Automation Studio |
| Communications generated during end-user interactions with AI agents (e.g. conversation transcripts, session identifiers, detected communication intents, interaction events, AI-generated conversation summaries, multimodal inputs (text, images, audio, documents).Where Voice AI Agents are used additional data include voice call audio recordings, real-time speech transcripts, call metadata (duration, timestamps, caller and recipient identifiers) | AgentOS — AI Agents |
| Content stored by the CLIENT for use in AI-assisted responses; may include personal data to the extent provided by the CLIENT | AgentOS — Knowledge Agents |
| Conversation data across all supported channels managed by human agents. This includes summaries, agent notes, suggested replies, resolution data, and session metadata (e.g. URL of web page where chat was initiated, IP-based location, browser and device information), including data processed by AI-assisted features (suggested replies, summaries, translation, real-time knowledge retrieval, and agent writing enhancement). | AgentOS — Inbox Copilot |
| Engagement metrics, interaction logs, and AI-powered analysis of conversation data for performance insights, topic detection and root cause identification | AgentOS — Insights & Analytics |
Special categories of Personal Data:
PROVIDER does not intentionally collect or process any special categories of Personal Data unless the CLIENT or its end-users include such types of data in the content submitted to PROVIDER and/or while using PROVIDER Services.
Nature and purposes of the processing:
Provision of Mobile Identity Services as defined in the Agreement.
The CLIENT, as the controller, commissions to INFOBIP, as the processor, Personal Data processing for the following processing activities:
- Accessing the CLIENT’s network and matching the data for the purpose of verifying end-users
The provision of Mobile Identity Services is carried out without transferring the actual data outside the CLIENT’s network.
Duration of the processing:
The processing of Personal Data shall be carried out during the provision of Mobile Identity Services.
Categories of Data Subjects:
Customers of INFOBIP’s or CLIENT’s clients (hereinafter: “end-users”).
Categories of Personal Data:
Depending on which Mobile Identity Services are used, the following categories include, but are not limited to:
| Data Category | MI Service |
|---|---|
|
• Mobile telephone number (MSISDN) • Public IP address |
Silent Mobile Verification |
|
• Mobile telephone number (MSISDN) • Public IP address • Time period in which SIM Swap occurred • IMSI |
SIM Swap |
The precise Personal Data are determined and controlled solely by the CLIENT and the state-of-the-art technology, during the provision of services defined in the Agreement.
Special categories of Personal Data:
N/A
Nature and purposes of the processing:
Provision of Mobile Identity Services as defined in the Agreement.
The CLIENT, as the controller, commissions to INFOBIP, as the processor, Personal Data processing for the following processing activities:
- Transmission of MI requests from the CLIENT’s software application (API) to Network Operators and MI response from Network Operators to the CLIENT’s
- Reporting and handling other CLIENT enquiries according to the CLIENT’s instructions.
Duration of the processing:
The processing of personal data shall be carried out during the provision of Mobile Identity Services.
Categories of Data Subjects:
The Personal Data processed relate to CLIENT’s end-users.
Categories of Personal Data:
Depending on which Mobile Identity Service is used, the following categories include, but are not limited to:
| Data Category | MI Service |
|---|---|
|
• Mobile telephone number (MSISDN) and Public IP address & port • Date and time when the end-user triggered the flow • Response with details as specified in the Agreement |
Silent Mobile Verification |
|
• Mobile telephone number (MSISDN) and Public IP address & port • Date and time when the end-user triggered the flow • Time period in which SIM swap occurred • IMSI • Response with details as specified in the Agreement |
SIM Swap |
|
• Public IP address & port • Date and time when the end-user triggered the flow • Response (including MSISDN) and with the details as specified in the Agreement |
Number Share (India only) |
The precise Personal Data are determined and controlled by the CLIENT, as well as by the state-of-the-art technology, if necessary during the provision of services defined in the Agreement.
Special categories of Personal Data:
N/A