GDPR Data Rights & Deletion Requests

Overview

Sulus supports the data subject rights guaranteed under the General Data Protection Regulation (GDPR) for personal data processed on the platform. This page covers what those rights are, the legal bases Sulus relies on to process your data, the safeguards in place to protect it, and how to submit a request to exercise any of these rights. For how call and chat content is stored, deleted, or excluded entirely, see the HIPAA & PCI and Zero Data Retention (ZDR) pages, which are cross-referenced throughout this one.

Under GDPR, you are entitled to the following rights regarding your personal data processed by Sulus:

• Right to Access — request and obtain a copy of the personal data held about you
• Right to Rectification — request correction of inaccurate or incomplete data
• Right to Erasure (Right to be Forgotten) — request deletion of your personal data, subject to certain conditions (for example, data required to meet a legal retention obligation may not be immediately erasable)
• Right to Restrict Processing — request that processing of your data be limited rather than stopped entirely, in specific circumstances (such as while a dispute over the data's accuracy is being resolved)
• Right to Data Portability — obtain your data in a structured, commonly used, machine-readable format and transfer it elsewhere
• Right to Withdraw Consent — withdraw previously given consent for data processing at any time, without affecting the lawfulness of processing carried out before the withdrawal

Sulus processes personal data under one of the following legal bases, depending on the context:

• Consent — where you or your customers have explicitly agreed to the processing (for example, opting in to receive a call or SMS)
• Contractual necessity — where processing is required to provide the service you've signed up for, such as operating your voice assistant or billing your account
• Legitimate interests — where processing supports a legitimate business purpose (such as fraud prevention or service improvement) that does not override your fundamental rights and freedoms

Which basis applies depends on the specific data and use case — contact your Data Protection Officer or account team if you need the basis identified for a specific processing activity on your account.

Sulus protects personal data using layered technical and organizational safeguards:

• Encryption — data is encrypted both in transit and at rest
• Access controls — internal access to personal data is restricted and role-based
• Regular audits — compliance and security practices are reviewed on an ongoing basis

Transborder data transfers: where personal data is transferred across borders (for example, between regions in Sulus's infrastructure), appropriate safeguards are applied to ensure the transfer meets GDPR's requirements for protecting data outside the originating jurisdiction.

How long call and chat artifacts (recordings, transcripts, logs) are retained depends on your plan:

You can also disable recording, logging, or transcription outright for a given assistant using the artifactPlan field:

"artifactPlan": {
    "recordingEnabled": false,
    "loggingEnabled": false,
    "transcriptPlan": {
        "enabled": false
    }
}

For organizations that need to guarantee no call content is retained at all after a call ends, see the Zero Data Retention (ZDR) page — ZDR is a stronger, organization-wide guarantee than disabling individual artifact fields. For handling of health data (PHI) under a signed BAA, see the HIPAA & PCI page.

To exercise any of the rights above — including a request to erase, restrict, access, or port your personal data, or to withdraw consent — contact your Data Protection Officer or your account team. They will guide you through verifying your identity and processing the request in line with GDPR's response timelines.

Note that some data cannot be immediately erased if it must be retained to meet a legal obligation (for example, billing records required for tax or accounting purposes) — your Data Protection Officer can clarify what applies to your specific request.