PRIVACY NOTICE REGARDING PERSONAL DATA PROCESSING IN CALL CENTER SERVICES

under art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”)

Section I. INTRODUCTION

Dear business partners and clients,

The Mood Media Group of Companies (hereinafter referred to as “Mood Media”, “we,” “us,” “our”) hereby informs you of the processing of personal data as Joint Controllers for the audio recordings within the Mood Media Group, as well as of the rights you have according to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as GDPR).

Mood Media undertakes to comply with the principles of personal data protection, as specified in the national and European legislation on the protection of personal data, as well as in the applicable Internal Policies and Procedures, to maintain the confidentiality of such data and to process them only for the stated purposes, in accordance with this Privacy Notice.

The Mood Media Group of Companies is present both in the EU and outside the EU; the entities engaged in the processing of personal data for the calls recorded by Mood Media are listed in Annex 1 hereto (“Joint Controllers”).

Based on this Privacy Notice, we help you to understand how we process your personal data within our Call Centre Services, what categories of information we process, why we process them, how long we keep them and who can access those data, including your rights and how you can exercise them.

The personal data that are the subject of this document will be processed by the means and for the purposes jointly established by the Joint Controllers, as described below.

Section II. BASIC INFORMATION ON PERSONAL DATA PROCESSING

     a) Data Subjects
Clients’ representatives/customer data
Employees of the Joint Controllers: Call Center Operators/Agents

     b) Categories of Personal Data
The personal data we process in the Call Center activities are those resulting from the audio recording (voice) and the data provided during the phone conversation and include:
Last and first name
Job title
Department
Location
E-mail address
Telephone number
Any other Personal data provided incidentally during the phone call by the data subject.

The Joint Controllers do not record or process in any way “special categories of data” as mentioned in the General Data Protection Regulation.

     c) How we collect your personal data?
Call Recording and Live Monitoring the calls

  • For calls that we receive from you, before the telephone connection is established, the welcome message will mention that the call is recorded and that it might be live monitored. You will be asked to press 1 if you consent. Should you state your refusal to have the conversation recorded and/or live monitored by pressing 2, the recording and monitoring is to be automatically interrupted.
  • With regard to the outbound calls (i.e. calls initiated by the Agents), the calling Agent will seek the client’s approval for the call recording. If the client does not consent to the audio recording:
    • the agent will manually stop the recording and will continue the identification of the client and further will proceed to the troubleshooting process;
    • at the end of the call, the Agent will notify the management team and the IT department of the call to be deleted;
    • Management will proceed to deletion of the audio file related to the beginning of the call.

The calls may be “live monitored” (i.e. listened in real-time) through Talkdesk Live which is a live monitoring dashboard of the Talkdesk users’ accounts activity, but such live monitoring can only by performed by Quality Assurance Specialists and Supervisors within the Joint Controllers (generally referred to as “Authorized Users”). Talkdesk Live alerts managers and supervisors of items that need attention at any given moment, allowing them to make informed decisions. Additionally, Agents can receive invaluable assistive feedback during times they need it most, ensuring customers continue to be provided the high level of service they expect at all times.

Live monitoring the calls is made only under specific circumstances related to the quality of services, probation period of the Agent or the performance of the employment contract.
Please note that Mood Media doesn’t live monitor the calls made by EU Clients.

     d) How we use the personal data we collect. Purposes.
Personal data will be used by Mood Media for the purpose of ensuring the clients’ service quality control, as well as for assessing the performance of the employees. The data may also be made available within the Joint Controllers’ group of companies for the purpose of training the employees in order to improve the overall quality of the clients’ service across the Mood Media Group. In particular, the activity of the employees providing support phone calls to EU and non-EU Clients is analysed by the supervisors within the Mood Media Group. The analysis is made based on certain key performance indicators communicated to the employees during their induction training within the Company.

In order to achieve the purpose above, the processing operations consist mainly of:

  • accessing the personal data by the personnel of the Joint Controllers,
  • storing such personal data in the physical archive (transcripts) or in electronic format, on the infrastructure of the Joint Controllers or of the processors of the Joint Controllers, if any,
  • transferring personal data within Mood Media Group, as well as to the third parties mentioned in letter i) below.

     e) Legal ground of the processing
The legal ground of the processing is art. 6 (1), letter a) from the GDPR – the data subject has given his/her consent for the processing of personal data for one or several specific purposes, mentioned in Section II, letter e) above. The client is informed of the recording and monitoring of the call when a conversation is initiated and he/she has the option to exercise the right to object at any time.

The use of personal data aforementioned for another purpose not related with the ones stated under letter e) above may be carried out only with the consent of the data subjects.

For the employees of Mood Media, who are subject of the recording operations, the legal ground is art. 6 (1) letter f) – the legitimate interest of Mood Media to assess the performance of the employees and provide feedback.

     f) The data retention period of the records
The personal data is stored as follows:

  • the audio recordings are stored for a period of 30 days, excepting the cases when the legitimate interest of Mood Media requires a longer period;
  • after the expiry date, the audio recordings are automatically deleted;

     g) Who can access the recordings?
The recorded calls can be accessed only by the Authorized Users assigned to verify and assess the calls, as listed in Mood Media’s internal policies and procedures, and/or by competent authorities. For avoidance of doubt, Mood Media ensures that persons authorized to process the personal data (such as: employees, agents, representatives, collaborators and contractors etc. of the Processors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and have one of the purposes mentioned at letter d) above, in relation to that processing.

     h) Recipients or categories of recipients of personal data
Personal data are transmitted between Joint Controllers/ within Mood Media Group.
Excepting the Joint Controllers and Talkdesk Inc., in its capacity as Processor and Talkdesk’s Sub-processors, no other parties have access to or process the personal data.
The transfer is made with the observance of conditions meant to secure the data and the recipients undertake the necessary technical and organisational measures to protect the personal data and to comply with the rights of data subjects, according to the law and the contractual commitments concluded. The Joint Controllers shall disclose the personal data at the express request of bodies authorized by law, and the disclosure shall be documented and subject to a rigorous review regarding, on the one hand, the need for communication, and, on the other hand, the compatibility between the purpose of this communication is made for and the purpose for which such data were collected initially for processing. For avoidance of doubt, if a legal obligation imposes the disclosure of the personal data to the relevant authorities, the initial purpose of the data collection mentioned at letter d) above is deemed compatible with such mandatory disclosure under the law.

     i) International transfers of personal data
In order to comply with the GDPR restrictions in respect of the international transfers provided by art. 44 et seq. from the GDPR, Mood Media is continuously reviewing and strengthening the protection measures regarding the international transfers, while keeping in mind the guidelines and recommendations of the EU authorities.

As such, in respect of the Mood Non-Eu Entities and Mood US Entities which are listed in Appendix 1, the international transfer of personal data is regulated by the Standard Contractual Clauses approved by the EU Commission on June 4th 2021. The European Commission approved standard contractual clauses are available here.

For the purposes of the Data Transfers outside the EU, Mood Media Romania shall be deemed the “data exporter” and, respectively, each of the Mood US Entities or each of Mood Non-EU Entities accessing the Data Recordings shall be deemed “data importers”.

In addition to using the Standard Contractual Clauses above, Mood Media is continuously taking steps towards ensuring additional protection measures of the data subjects rights, guaranteed under the GDPR.

Section IV. RIGHTS OF DATA SUBJECTS

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:

  • Request access to your personal data, directly or indirectly collected from you. According to art. 15 of the GDPR, you have the right to receive a confirmation of the processing of personal data and, if necessary, to be informed about: the categories of data processed, the purpose of the processing, possible recipients, the storage period, as well as information regarding your rights. You can also request a copy of your personal data;
  • Request correction of your personal data in case you consider the Data in question as incorrect or incomplete;
  • Request erasure of your personal data (the right to be forgotten involves the deletion of your personal data, without undue delay, with the exceptions provided by law). Data subjects have the right, at any time, to request the deletion of the personal that the Joint Controllers or their processors process for certain reasons. However, a claim grounded on the right might be disregarded by the Joint Controllers if, for example, the personal data are required to defend a right in court of the Joint Controllers;
  • Object to processing of your personal data. In respect of the employees for which the data is processed based on the Joint Controller’s legitimate interest, the employees have the right to object to the processing, on grounds relating to their particular situation, The Joint Controllers shall no longer process the personal data unless the they demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Further information on the right to object to the processing can be found in art. 21 of the GDPR and Mood Media’s internal procedures on the exercise of the data subject’s rights;
  • Request restriction of processing your personal data for a limited period. Under certain conditions provided by law, the data subject has the right to restrict the personal data processing (for example, if the accuracy or correctness of the personal data is challenged by the data subject). In such situations, the processing can only be carried out with the consent of the data subject, with certain exceptions (for example, storage);
  • Request transfer of your personal data; You have the right to receive, in a structured format, currently used and automatically readable, the personal data that you have provided to Mood Media and the right to transmit such data to another controller. This right can only be exercised in compliance with certain legal requirements;
  • The right to withdraw your consent where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent;
  • The right to be informed. This Privacy Policy informs you how we process your personal data, in accordance with the provisions of art. 13 of the GDPR. If you want to find out information regarding the processing other than that specified herein, please send us a request in this regard;
  • The right not to be subject to a decision based solely on automated means, including on profiling. In this regard, we hereby inform you that Mood Media does not carry out automated decision-making based on the processing of your personal data, such as profiling. Your personal data are not subject to an automated individual decision-making process, including profiling, as mentioned under article 22 paragraphs (1) and (4), in Regulation (EU) no. 679 of 27 April 2016;
  • The right to lodge a complaint with the Supervisory Authority for data protection issues, but also to address the issues to competent authorities. Residents of the EEA may file a complaint with a data protection authority. For example, for all data protection matters in Romania, you can contact the Romanian Data Protection Authority;
    The data protection authorities will require you first attempt to resolve any complaint with us; please see the Contact Details section below to file a complaint with Mood Media.

Section V. EXERCISE OF THE RIGHTS BY DATA SUBJECTS

For any requests you may have regarding the exercise of the aforementioned rights and in order to address any other questions regarding the processing of personal data by Mood Media, you can send an email to the following addresses:

Following the review of the request, you will receive a confirmation message that your request has been registered, as well as any other necessary information, as appropriate.

We will try to respond to the request within 30 days. However, the deadline can be extended depending on different aspects, such as the complexity of the request, the large number of requests received or the inability to identify you in a timely manner.

In case it is impossible to identify you, we may request the submission of documents certifying your identity as a data subject or copies thereof. If you do not provide the additional information, we cannot respond to the request.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

Section VI. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

     a) Protection of personal data and security of information
Mood Media constantly maintains adequate technical and organizational security measures for protecting the personal data against accidental or unlawful destruction or accidental loss, deterioration, alteration, disclosure or unauthorized access especially when the processing involves sending data through a network, as well as against any other unlawful processing forms.
Mood Media implemented physical, electronic and procedural protection measures, in order to ensure the protection of personal data. Mood Media restricts the authorized access to personal data to the persons who have a legitimate purpose which is consistent or compatible with the processing purpose mentioned at section II, letter. d) above.

     b) Protection of minors
The personal data do not include data from minors (below 16 years old). Mood Media shall not process the personal data of a natural person regarding whom they are aware that is below sixteen (16) years old. Mood Media does not knowingly request or collect personal data from children below sixteen (16) years old. However, should Mood Media find out that it received Personal data from an individual mentioning, or about whom the company has reasons to believe that is below sixteen (16) years old, then Mood Media shall erase such information from its systems. The relevant minor’s parent or legal guardian may also request that the personal data regarding the child are erased from the files of Mood Media by sending an email containing such request to the following addresses:

     c) Security measures for the personal data processed for the recorded phone calls
To secure the data, Mood Media undertook the following technical and organizational measures:

  • Access to personal data is granted only to a limited number of Authorized Users;
  • The authorized personnel undertake the obligation to keep the confidentiality regarding any type of personal data processing, by means of a document attesting this fact;
  • The authorized personnel is trained with regard to security requirements, to the internal policies of the company and to the applicable laws regarding the fulfilment of duties and obligations incumbent on them in relation to personal data processing and the consequences of infringing upon such requirements;
  • Each authorized user has a personal and unique identification code;
  • The user ID is not and may not be assigned to another person;
  • The information systems and the physical media on which personal data are stored are kept in a secured physical environment;
  • The information systems are fit out with antivirus software and devices for detecting intrusions, in order to protect them against attacks, or other unauthorized actions targeting information systems. The antivirus software and the systems of detection of intrusions are regularly updated;
  • The software, firmware and hardware used within the information systems are regularly checked, in order to detect and remove vulnerabilities and deficiencies of information systems;
  • Audio recordings are AES 256 encrypted;
  • All the employees of Mood Media signed the non-disclosure statement regarding personal data;
  • It is not allowed to copy, download, erase or alter any recorded file, at one’s own initiative/without authorization granted for a specific purpose consistent or compatible with the purposes of the personal data processing mentioned in section II, letter d).

     d) The description and technical specifications of the web-based platform
The recording and transmission of the Data Recordings are made through a browser-based platform licensed by Talkdesk Inc., and accessed through website https://moodmedia.mytalkdesk.com/.

The technical and organizational measures undertaken for the protection of the personal data subject matter herein are extensively described in the Standard Contractual Clauses concluded between Mood Media and Talkdesk Inc. Talkdesk Inc. adopts an Information Security Management System (ISMS) as a framework for continuous improvement of security and using a risk-based approach. This ISMS includes (but is not limited to):

Policies
Talkdesk has and periodically reviews the Information Security Policies as the major guidelines for security practices. This includes Risk Management, Data Classification, Access Control, Software Development and Data Breaches.

Awareness
Awareness on security and compliance is fundamental and provided to all users. Some users may have additional specific awareness, relevant for their function.

Access control
Access is granted on a need-to-know basis and only a small number of users can access production systems where information from Customers is stored. Authentication to production systems is made with 2-factor Authentication as a standard.

Audit logging
Relevant audit logs are maintained, including access to sensitive information (including personal data). The logs are kept in separate infrastructure and only accessed by the Security team.

Data Breaches
Processes are defined to handle data breaches. These processes include notification to relevant stakeholders, according to the type of incident and applicable legislation.

Network security
Talkdesk implemented several security measures to protect our infrastructure from external and internal threats. This includes encryption, firewalls, IDS and other cloud provider specific. Access to production systems is made in secure mode and encryption in transit is a default. Sensitive information is also encrypted at rest.

Physical Security
Talkdesk uses data centers managed by cloud providers and delegates all physical security to them, after a due diligence.

Business Continuity
Talkdesk has several technical implementations to assure business continuity of its service. Those include backups, resilient and redundant infrastructure and Disaster Recovery Plans.

Development
Development is made using a secure development methodology that includes peer review and secure coding and testing.

Continuous improvement and review
Talkdesk security posture is based on a continuous improvement process that includes periodic review of security controls effectiveness.

The technical and organizational measures undertaken for the protection of the personal data subject are extensively described in the Standard Contractual Clauses concluded between Mood Media and Talkdesk Inc.

Section VII. ADDITIONAL INFORMATION ON PERSONAL DATA PROCESSING

     a) Source of personal data
Personal data may be initially collected by one or several Joint Controllers. Subsequently, they are transmitted to one or several Joint Controllers, for meeting the purposes described in Section II, letter d) above in the context of group reporting and analysis.

     b) Automated decision-making and profiling
The above-mentioned personal data will not be the object of an automated decision-making process, such as profiling.

     c) Obligation to provide personal data
As per art. 13 (2), lit.e of the GDPR
The clients are not under the obligation of providing the personal data mentioned, but failing to do so, in respect of certain data (such as relevant contact details for addressing the client’s technical issues) may result in the inability to provide our services.
The agents are under a contractual obligation of providing the personal data, due to the nature of the work performed within the Mood Media entities. Failing to do so may result in the impossibility to perform their work and the subsequent termination of their employment.

Section VIII. CONTACT DETAILS OF MOOD MEDIA REGARDING PERSONAL DATA PROCESSING

     a) Contact details
If you have any questions about this Privacy Notice or how we handle your personal information, please send an e-mail to the following addresses:

     b) Identification details of the Joint Controllers/Mood Media entities – Annex 1
See the list below.

Referred to as Legal corporate name Registered headquarter Country
1. Mood Media Austria Mood Media GmbH Kristein 2, 4470 Enns, Oberösterreich Austria
2. Mood Media Belgium Mood Media Belgium SA Lange Lozanastraat 142, 2018 Antwerpen Belgium
3. Mood Media CZ Mood Media Group CZ sro Lazarská 13/8, 120 00 Praha 2 Czech Republic
4. Mood Media France Mood Media SAS 22 Quai Gallieni, 92150 Suresnes France
5. Mood Media Germany Mood Media GmbH Wandalenweg 30, 20097 Hamburg Germany
6. Mood Media Netherlands Mood Media Netherlands BV Transistorstraat 22, 1322 CE Almere The Netherlands
7. Mood Media Hungary Mood Media Hungary KFT Hegyalja út 7-13, 1016 Budapest Hungary
8. Mood Media  Poland Mood Polska Sp.  Z.o.o. ul. Targowa 24, 03-728 Warszawa, Poland
9. Mood Media Romania S.C. Mood Media Romania S.R.L. Bucharest, George Constantinescu Street no. 3, Entrance A and D, ground floor and 3rd floor, District 2 Romania
10. MMC Romania Mood Media Comercial SRL Str George Constantinescu nr 3, Intrarea A, Parter, Sector 2, 020339, Bucuresti Romania
11. Mood Media Spain Instore Márketing Solutions, SAU Calle La Volta, nº4, Planta 1ª, Local 7 – 08150 Parets del Valles Spain
12. Mood Media Denmark Mood Media A/S Alsikevej 14, 8920 Randers NV Denmark
13. Mood Media Greece New Audio Visual Solutions and Applications Ltd 95C Pentelis Avenue – Chalandri 15234 Greece
14. Mood Media Ireland Mood Media Ireland Limited Unit 1-2, 19 the Rear Courtyard, Castle St, Dalkey, Co Dublin Ireland
15. Mood Media Sweden Mood Media Aktiebolag (AB) c/o Accountor AB – Sankt Eriksgatan 113 – 113 43 Stockholm Sweden
16. Mood Media  UK Mood Media Limited  Unit 3 Airport Trading Estate Wireless Road, Biggin Hill, Westerham, TN16 3PS UK
Referred to as Legal corporate name Registered headquarter Country
17. Mood Media US

17.1.                Convergence, LLC

 

2100 S IH 35 Frontage Rd., Suite 201, Austin, TX 78704 USA
17.2.                DMX Holdings, LLC
17.3.                DMX Residential Holdings, LLC
17.4.                DMX Residential, LLC
17.5.                DMX, LLC
17.6.                Mood Media Borrower, LLC
17.7.                Mood Media Corporation
17.8.                Mood Media Co-Issuer, Inc.
17.9.                Mood Media Holdings, LLC
17.10.             Mood Media North America Holdings Corp.
17.11.             Mood Media North America, LLC
17.12.             Mood US Acquisition1, LLC
17.13.             Muzak Capital, LLC
17.14.             Muzak Holdings LLC
17.15.             Muzak LLC
17.16.             ServiceNET Exp, LLC
17.17.             Technomedia NY, LLC
17.18.             Technomedia Solutions, LLC

We will keep you informed if any changes or updates to the aforementioned list will occur.
This information is provided in addition to the Privacy Policy available at https://moodmedia.com/en/company/privacy-policy/.
Non-English translations of this Privacy Notice are provided for convenience only. In the event of any ambiguity or conflict between translations, the English version is authoritative and controls. The English version can be found at https://moodmedia.com/en/company/privacy-notice-call-center/.

The Joint Controllers will make available, upon request, a copy of the essential clauses to data subjects, unless the clauses contain confidential information, in which case such information may be removed.

Last update: October 2021

 

EXPLORE MOOD MEDIA

WANT THE LATEST INDUSTRY TRENDS?

Name*

You can unsubscribe at any time using the link in our newsletter. For more details, review our Privacy Policy.

This field is for validation purposes and should be left unchanged.