Skip to content
ContactRequest a demo

Trust Center

GDPR

Processing under Art. 28 GDPR, documents for your data protection impact assessment, retention and deletion policies and role rights. What exists you receive on request; what is a goal we call a goal.

On request
  • DSGVO
Updated on 2 November 2026
Request documentsBack to the overview

At a glance

  1. Designed for

    The platform is built toward the requirement. Evidence such as an attestation does not exist yet – we name it as soon as it does.

  2. On request

    The documents exist. You receive them for your review through the contact form.

  3. Available

    Met and evidenced. We assign this level only once the evidence exists.

Documents on request
  • Data processing agreement (Art. 28 GDPR)On request
  • List of sub-processorsOn request
  • Technical and organisational measuresOn request
  • Documents for the data protection impact assessmentOn request
  • Retention and deletion policyOn request

#The roles

The General Data Protection Regulation distinguishes between the controller and the processor. You remain the controller for your customers' data. Univerx processes it on your behalf, following the instructions set out in the data processing agreement.

The contract text, the list of sub-processors and the technical and organisational measures exist. You can request them through the contact form.

#What matters day to day

Role rights. You decide per role who may listen to a recording, see an analysis or open a case. That includes Univerx Assist and conversation analytics.

Recording. Conversations are recorded only with consent. The consent is stored with the conversation, and the recording follows the retention and deletion policy.

Deletion and export. Data can be deleted per data type once its period ends, and exported on request. That covers your customers' access and erasure requests.

Analytics and co-determination. In Germany, quality and performance analytics often require the works council's agreement under § 87(1) no. 6 of the Works Constitution Act. Univerx is designed so you can set up analytics exactly as agreed with your works council.

The desktop shows only what each role is allowed to see. Sample view.

#Sub-processors

A customer contact platform relies on third-party services such as data centres, telephony or speech processing. Each of them is a sub-processor within the meaning of Art. 28(2) GDPR and needs your authorisation.

Univerx keeps these services in a list showing the purpose and location of processing. The data processing agreement sets out how you are told about changes and how you can object.

DocumentWhat you need it for
Data processing agreementThe basis for processing on your behalf (Art. 28)
List of sub-processorsAuthorising and reviewing the supplier chain
Technical and organisational measuresEvidence of security of processing (Art. 32)
DPIA documentsThe basis for your impact assessment (Art. 35)
Retention and deletion policyRetention per data type, proof of deletion

#Data protection impact assessment

Whether a DPIA under Art. 35 GDPR is required is your decision as controller. With conversation analytics, AI agents and special categories of data it is often advisable. Univerx supplies the material you need: a description of the processing, data flows and measures.

  1. Describe the processing. Channels, data types, recording, AI features and recipients.
  2. Check necessity. Record purpose, legal basis and scope for each data type.
  3. Assess the risks. What could harm customers and employees, and how likely is it?
  4. Define the measures. Role rights, retention periods, masking, consent, logging.

Where the data lives is covered in Data residency & hosting in Germany. The guide to running a contact centre in Europe walks through all the European rules.

#Sources

  • Regulation (EU) 2016/679 (GDPR), consolidated text on EUR-Lex.
  • Art. 28 (processor), Art. 32 (security of processing) and Art. 35 (data protection impact assessment) GDPR.
  • § 87 of the German Works Constitution Act on gesetze-im-internet.de.

Products

Where the topic applies.

The product families this topic matters most for.

  • Univerx Cloud

    One cloud for every customer contact.

    • EU
    • BSI C5
    • NIS2
    Learn more

  • Univerx Contact Center

    Every contact in the right queue.

    • DSGVO
    • BFSG
    • EU
    Learn more

  • Univerx AI

    AI that resolves requests and backs up people.

    • AI Act
    • DSGVO
    • EU
    Learn more

  • Univerx Workforce

    The right people at the right time, planned with the team.

    • DSGVO
    • EU
    Learn more

  • Univerx Trust Center

    Security and regulation as a design principle, not an appendix.

    • DSGVO
    • EU
    • AI Act
    • BSI C5
    • eIDAS
    • NIS2
    • DORA
    • BFSG
    Learn more

Trust & Europe

Every topic in the trust center.

Every topic carries a status. It tells you what is a design goal, which documents you can request and what is evidenced today.

Trust center topics with status, affected product families and number of documents on request
TopicStatus
GDPROn request
Data residency & hosting in GermanyDesigned for · German hosting planned
EU AI ActDesigned for
BSI C5Designed for · goal, no attestation
eIDAS & online IDDesigned for
NIS2Designed for
DORADesigned for
European Accessibility ActDesigned for · WCAG 2.1 AA as a goal
Responsible AIDesigned for · principles & controls
Security & availabilityDesigned for
United States: HIPAA, PCI DSS, SOC 2, TCPA, CCPADesigned for

Frequently asked questions

Who is the controller, who is the processor?

You remain the controller for your customers' data. Univerx processes it on your behalf on the basis of a contract under Art. 28 GDPR.

Where is the data stored?

In EU regions of your choice. Hosting in Germany is planned. The list of sub-processors is available on request.

How long are recordings kept?

As long as you define in the retention and deletion policy. Recording requires consent; retention periods and exceptions are configured per data type.

How do we learn about new sub-processors?

The data processing agreement sets out how Univerx informs you of changes in advance and how you can object. The current list is available on request at any time.

Can we take our data with us when the contract ends?

Yes, an export is planned. Scope and format are agreed in the contract. Afterwards the data is deleted according to the agreed retention and deletion policy.

  • The Frankfurt skyline on the river Main at night
    Trust & Europe

    Data residency & hosting in Germany

    The goal: data and media stay in the EU region you choose. Hosting in Germany is planned. What lives where, and who can reach it, is set out in documents you receive on request.

  • Wood-panelled council chamber with chandeliers
    Trust & Europe

    EU AI Act

    AI disclosure in dialogue, human oversight, logging and model approval: Univerx is designed for the duties of the AI Act. Which risk class your use case falls into, we work out together.

  • Lit aisle between rows of servers
    Trust & Europe

    Security & availability

    Encryption in transit and at rest, identity and access management, network and API security, multi-zone availability and continuity plans: what Univerx is designed for so your customer service keeps running.

  • A woman with headphones sits thoughtfully at a laptop
    Trust & Europe

    Responsible AI

    Transparency, human oversight, fairness, privacy and governance: the principles Univerx builds AI on, and the controls that put them to work in AI agents, Univerx Assist and Semantic².

  • Berlin at blue hour with the TV tower
    Guides2 November 2026 · 11 min read

    Running a contact centre in Europe

    What the GDPR, the EU AI Act and German co-determination mean for routing, recording and analytics – and how to answer the questions from procurement, privacy and the works council before the first contact runs on a new platform.

  • The Frankfurt skyline on the river Main at night
    Europe & regulation1 November 2026 · 5 min read

    Data residency: the five questions procurement and privacy ask

    "The data stays in Europe" is a good start, but not an answer. Five questions procurement and privacy teams follow up with, and what makes an answer reliable.

  • Two colleagues talking in a dimly lit office
    Public sector30 October 2026 · 5 min read

    Social data protection in the contact centre: roles, recording, analytics

    Social data needs more than a tick in the privacy notice. It needs roles that fit, recording with a reason, and analytics that show topics rather than people.

  • Team meeting in a glass meeting room in the evening
    Practice & how-to2 November 2026 · 5 min read

    Talking to the works council about analytics: a preparation

    If you plan to introduce analytics, know the works council's questions before they are asked. A preparation in documents, roles and configuration.

  • Forms and a pen on a dark desk
    Glossary

    Data processing agreement (DPA)

    Using a cloud platform for customer service means a provider processes personal data for you. A data processing agreement under Art. 28 GDPR sets out the roles, instructions and duties involved.

  • An empty meeting room against the light
    Glossary

    Data protection impact assessment (DPIA)

    A data protection impact assessment examines in advance what risks a processing operation poses to the people concerned and how to limit them. In customer service it often applies to analytics, recording and AI.

  • The Frankfurt skyline on the river Main at night
    Glossary

    Data residency

    Data residency describes where data and media are stored and processed. In customer service that covers not just the database but recordings, transcripts, AI processing, backups and support access.

See Univerx on your own example.

In a demo we show the platform along your channels and requests, from AI agents to video, workforce scheduling and analytics.

Request a demoGet in touch

Online, in German or English, with no preparation on your side.