PRIVACY NOTICE (ARTICLES 13–14 REG. (EU) 2016/679 – GDPR)

Agendly Platform – web app for managing calls and appointments through an AI-based voice agent

Last update: February 18, 2026

1. Who is the Data Controller

The Data Controller is Agendly S.r.l., with registered office at Via ai Crotti 39 – 22031 Albavilla (CO), Italy, Tax/VAT no. 04236380137, REA 430066, certified email (PEC): agendly@namirialpec.it (hereinafter “Agendly” or “Controller”).

For requests related to personal data protection, you may contact the Controller at the contact details above, using “Privacy” in the subject line.

Agendly has not appointed a Data Protection Officer (DPO), unless otherwise indicated on the Website.

2. Who this notice applies to

This notice describes the processing of personal data carried out by Agendly when:

(a) you register and use the Platform (e.g., account creation, user administration, support, billing); and/or
(b) you interact with Website contact channels (e.g., demo/contact requests).

Important: when the Platform is used by a Customer (professional/business) to manage calls from its end users (e.g., patients/customers/contacts calling a dedicated number), the Customer generally acts as Data Controller of end users’ data, while Agendly acts as Data Processor pursuant to Article 28 GDPR, as set out in the applicable Data Processing Agreement (DPA) and sub-processor list.

3. What data we process (data categories)

Depending on your relationship with Agendly, we may process:

Identification and contact data: first name, last name, email, phone number, role/job title (if provided).
Account and authentication data: credentials, internal identifiers, access logs, account settings.
Contractual and administrative data: data needed to activate the service, manage payments/invoicing and accounting/tax obligations.
Data for assignment/activation of phone numbering (if applicable): documents and information requested by the telecom operator (e.g., legal representative ID, company certificates, registered office data), limited to what is necessary.
Technical and usage data: technical logs, IP address, device/browser identifiers, app events, metrics and diagnostics.
Data related to communications with Agendly: support requests, emails, tickets, chats, submitted content.

Agendly does not require special categories of data (Article 9 GDPR) or data relating to criminal convictions and offenses (Article 10 GDPR). Please do not enter such data in the Platform or communications, unless contractually instructed and covered by adequate safeguards.

4. Purposes of processing and legal bases

Agendly processes personal data for the following purposes, based on the corresponding legal bases (Article 6 GDPR):

A) Registration/account management and provision of the Platform: account creation and management, authentication, service delivery, authorized user management, account security. Legal basis: contract performance or pre-contractual measures (Art. 6(1)(b) GDPR).
B) Assistance and technical support: request handling, troubleshooting, service communications, maintenance. Legal basis: contract performance (Art. 6(1)(b)) and/or legitimate interest (Art. 6(1)(f)) in service continuity and security.
C) Legal and regulatory compliance: accounting/tax obligations, authority requests, telecom obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
D) Security, abuse/fraud prevention and rights protection: security monitoring/logging, unauthorized access prevention, anomaly detection, incident management, legal defense. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
E) Business communications (soft marketing) and contact management: sending information about features/services similar to those already purchased or requested (where permitted), and handling demo/contact requests. Legal basis: legitimate interest (Art. 6(1)(f)) and/or consent (Art. 6(1)(a)) where required. In any case, you may object at any time.
F) Statistics and service improvement (aggregated/minimized form): usage/performance analysis to improve the service, in minimized or aggregated form where possible. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

5. Nature of data provision

Providing data marked as required during registration or service activation is necessary to enter into the contract and/or provide the Platform. Failure to provide such data may make registration or service use impossible.

Providing additional data (e.g., optional information) is voluntary.

6. Processing methods and security measures

Processing is carried out using electronic tools, according to logic strictly related to the purposes described above, and with appropriate technical and organizational measures under Article 32 GDPR (e.g., encryption in transit, access controls and logical segregation, logging and monitoring, backup and restore procedures, vulnerability and patch management).

7. Data retention

Agendly retains personal data for the time necessary to achieve the stated purposes and, in particular:

Service data (e.g., data collected for appointment management): default maximum of 30 days, unless otherwise instructed by the Customer and in line with the selected Plan; after that period, data is deleted or anonymized.
Enterprise Plan: advanced minimization and “operational zero retention” configurations may be enabled to avoid retention of conversational content beyond the time strictly necessary to execute the individual call and produce the service outcome (with possible limitations for history/reporting).
Technical security logs: may be retained longer, in minimized form, for security and compliance purposes.
Administrative and tax data: retained for periods required by applicable law (typically 10 years).
Data for numbering assignment: retained for the period required by the operator and/or sector regulations, and in any case within necessity limits.

8. Recipients and categories of recipients

Data may be disclosed or made accessible to:

Authorized Agendly personnel (need-to-know basis).
IT and hosting/cloud providers (e.g., infrastructure/compute/storage).
Telecom/telephony service providers for call routing and numbering management.
Voice synthesis and AI component providers (where used for service features).
Consultants and professionals (e.g., legal, tax), banks, and administrative providers for contractual purposes.
Competent authorities, where required by law.

Agendly signs Article 28 GDPR-compliant agreements with providers acting as Processors (sub-processors). The updated list of key providers/sub-processors can be requested from the Controller at the contacts in this notice.

8-bis. Examples of sub-processors used for service delivery (indicative)

Agendly may use sub-processors across categories such as hosting/cloud infrastructure, telecom/telephony, voice and AI components, and technical support/security services. The updated list of sub-processors and locations applicable to your Plan/instance is available on request or through contractual/platform documentation.

9. Extra-EEA transfers (GDPR Chapter V) and data residency options

Some Agendly providers may be established in, or process data from, countries outside the EEA (e.g., United States). In such cases, Agendly adopts appropriate safeguards under Articles 44–49 GDPR, such as: European Commission adequacy decisions (where applicable), Standard Contractual Clauses (SCCs), and, where necessary, supplementary measures (e.g., encryption).

Advanced options (Enterprise Plan): where available, configurations can be enabled to limit content retention (“operational zero retention”) and/or prioritize processing and storage in the EU/EEA, according to the Plan and applicable contractual terms.

10. Cookies and tracking tools

The Website may use cookies and similar tools (technical and, where present, analytics/marketing). Technical cookies are necessary for Website operation. For non-technical cookies, where present, consent will be requested through a dedicated banner and preferences can be managed at any time.

For details, including cookie list and duration, see the dedicated Cookie Policy (if published on the Website).

11. Data subjects’ rights

You may exercise rights under Articles 15–22 GDPR (access, rectification, erasure within applicable limits, restriction, objection, portability), as well as the right to withdraw consent (where processing is based on consent), by contacting the Controller at the details above.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) or the competent authority in your Member State.

12. Processing as Data Processor (end customers of Agendly Customers)

If you interact with a voice agent or phone number managed through Agendly on behalf of a Customer (for example, to book/modify an appointment), the Data Controller of your data is generally the Customer you are interacting with. In such cases, Agendly acts as Data Processor and processes data exclusively to provide the service to the Customer, under documented instructions and in compliance with the DPA (Article 28 GDPR).

To exercise rights related to such processing, please contact the Customer (Controller) directly. Agendly may, within legal limits and as set out in the DPA, assist the Customer in responding to requests.

13. Changes to this notice

We may periodically update this notice to reflect legal changes or service developments. The updated version is published on the Website with the latest update date.