Data handling practices
This section describes how Sinch Contact Pro manages personal data throughout its lifecycle - from collection and consent to retention, deletion, anonymization, and blocking.
Data collection and customer consent
Capturing customer consent for saving personal data varies depending on the channel of the conversation.
Generally, when a customer contacts an organization by phone, email, SMS, messaging apps, or web chat, they understand and consent to their contact data and messages being stored and processed in the system and in the organization.
However, it is recommended that the organization actively informs customers about the collection of personal data in these cases.
Inbound queue calls and IVR calls
Organizations can set a welcome prompt for each phone queue to inform callers about the service they have reached and how their personal data is handled. A good practice is to provide a brief explanation and direct customers to more information, such as the organization's website or privacy policy.
To define such a prompt, create an audio prompt with the type Welcome Message in . For more information, see Prompt management in the System Configurator document.
Call recording
The organization should define its policy for call recording and ensure compliance with data protection laws.
In some industries, call recording is legally required, while in others, it is necessary to fulfill a contract. In these cases, recordings may be made without consent. However, it is generally recommended to obtain customer consent before recording. Organizations can set up a consent IVR, allowing customers to accept or decline call recording.
Customer consent information stays with the call throughout its duration, determining whether call recording is enabled or disabled. If the call is transferred to another queue with different consent settings, the original queue’s settings remain in effect.
Consent settings apply to server-side call recordings. However, in emergency, legal, or business-critical situations, agents can override these settings and record a call without consent.
If consents are used, CDT-controlled local call recordings should not be enabled.
To enable IVR-based consent collection, add the Consent IVR in System Configurator's IVR Management and configure it in . For more information, see Consent IVRs and Configuring Consent IVR in the System Configurator document.
Customer consent or non-consent for call recording can be stored in the database to streamline call handling.
The data protection officer (DPO) can reset consent information if the organization updates its data privacy policy or if a customer withdraws consent. In such cases, it is recommended that the DPO exports and stores the consent database according to the organization's data protection policy. You can manage consents in System Configurator (). For more information, see Managing Customer Consents in the System Configurator document.
Inbound direct calls
As there is a policy described for IVR and queue calls, it is not recommended to publish direct extension numbers for inbound customer service but manage all customer calls via queues and IVRs.
Technically, customer consent can be captured with direct inbound calls as well.
Inbound emails
Organizations can define an automatic receipt message for each email queue to acknowledge receipt of the email, inform the sender about the service they contacted, and explain how their personal data is handled. A good practice is to include a link to the organization's data privacy statement.
To configure an automatic receipt message, create an email prompt with type E-Mail Received Message in System Configurator (). For more information, see Prompt management in the System Configurator document.
Inbound web chats and conversational messaging
This applies to all Sinch Contact Pro supported conversational messaging channels, including web chat, SMS, WhatsApp, Telegram, and similar platforms.
Organizations can define an automatic welcome prompt for each chat or messaging queue to inform customers about the service they are engaging with and how their personal data is handled. A good practice is to include a link to the organization's data privacy statement.
To configure a welcome prompt, create a chat prompt with type Welcome Message in System Configurator (). For more information, see Prompt management in the System Configurator document.
Outbound campaigns
We recommend that the organization ensures the customer’s consent for telemarketing activities prior to importing customer data to the system.
Inbound and outbound WhatsApp messages
The rules for WhatsApp opt-in are set by Meta and we recommend you get familiar with the guidance. Sinch Contact Pro can store WhatsApp opt-in and Communication Panel works according to rules defined by Meta.