Bewertung starten - sipgate LIA

Basic details

Details of the controller and of the person carrying out the assessment.

Controller (legal entity) *

Person carrying out the assessment, and their role *

Internal reference (RoPA ID)

Description of the processing

What the voice AI product processes and the context you deploy it in.

Categories of data processed Set by the vendor

Audio-Rohdaten der Telefonate, automatisch erzeugte Transkripte, Gesprächsmetadaten (Dauer, Teilnehmer), optional vordefinierte Fragen und deren generierte Antworten.

Biometric identification by voice Set by the vendor

No biometric identification

External language models and processing region Set by the vendor

EU/EEA only

Use of your data for model training Set by the vendor

No, contractually excluded

Storage locations and data centre regions Set by the vendor

Ausschließlich Rechenzentren in der EU bzw. im EWR. Sowohl bei Nutzung von Mistral AI als auch von OpenAI verlässt keine Verarbeitung den europäischen Wirtschaftsraum.

Specific business purpose of the deployment * Pre-filled by the vendor

Categories of data subjects *

Volume of processing *

Direction of communication *

Inbound (the data subject calls you)+Outbound (you call the data subject)-Both~

Purpose test

The specific legitimate interest you pursue with the processing.

The specific legitimate interest pursued * Pre-filled by the vendor

Recognition in the GDPR or sector-specific law *

IT and network security (Recital 49)++Fraud prevention (Recital 47)++Direct marketing to existing customers (Recital 47)+Intra-group administration (Recital 48)+Research, statistics+None of the above-

Beneficiaries of the processing *

The data subject as well++The public+The controller and third parties~The controller only-

Additional legal framework

Temporal and geographic dimension * Pre-filled by the vendor

Weight of the expected benefit *

Substantial, with metrics or evidence++Moderate~Slight-

Consequences of not processing * Pre-filled by the vendor

Ethical acceptability * Pre-filled by the vendor

Necessity test

Why the processing is necessary to achieve the purpose, not merely useful.

Justification of necessity * Pre-filled by the vendor

Less intrusive alternatives considered * Pre-filled by the vendor

Why the alternatives are not sufficient * Pre-filled by the vendor

Features enabled and disabled Set by the vendor

Only the minimum the purpose requires

Retention of the audio recordings Set by the vendor

No storage - audio is processed transiently for transcription and discarded afterwards

Optional: Pseudonymisation and anonymisation

Yes, once the purpose is fulfilled++Partially (certain fields)+No~

Fairness of the approach *

Fair and balanced++Partly fair~Not fairBlocker

Balancing test

How your interest relates to the rights and interests of the data subjects.

Nature and sensitivity of the data *

Not sensitive, no Art. 9 or 10 data++Personal data, no special category~Special categories (Art. 9)-Criminal conviction data (Art. 10)-

Sensitive inferences drawn from the voice Set by the vendor

Die sipgate-AI-Features ziehen keine sensitiven Rückschlüsse aus der Stimme. Es findet keine Emotionsanalyse, keine Ableitung von Gesundheits-, Herkunfts- oder ähnlichen Merkmalen und keine biometrische Sprecherwiedererkennung statt. Talk Ratios trennt Sprecher rein akustisch, ohne sie zu identifizieren oder zu bewerten.

Vulnerable individuals affected *

No++Occasionally possible~Regularly-

Transparency before the call *

Announcement plus privacy notice++Announcement during the call++Privacy notice on the website++No specific information~

Willingness to explain openly *

Yes, without reservation++Yes, with an explanation of the customer benefit+Probably not, explaining it would be difficult-No, the details should not be disclosedBlocker

Reasonable expectations in this context *

Expected in this context++Partly expected~Not expected-

Likelihood of objections and complaints *

Low++Moderate~High-Very high-

Nature of the relationship with the data subject *

Existing customer, long-term relationship++Prospect in active discussions+Employment relationship-Unknown third party-Public relationship (e.g. press, public authority)~

Possible adverse consequences *

None of substance++Minor (inconvenience)+Moderate (financial disadvantage)-Severe (exclusion, discrimination)Blocker

Likelihood and severity *

Solely automated decision-making Set by the vendor

No, no automated decision is made

How human oversight is set up *

Legal basis and safeguards under Art. 22(2) and (3) *

Employment context

Involvement of the works council or staff council *

A works agreement is in place++Works council informed and involved+Information only, no involvement-Not assessedBlocker

Exclusion of performance and behaviour monitoring *

Excluded, limited by technical means++Limited and documented+Not excluded-

Safeguards

Technical and organisational measures you have put in place.

Encryption Set by the vendor

At rest and in transit

Access controls Set by the vendor

RBAC and MFA

Logging and auditability Set by the vendor

Standard log

Model governance Set by the vendor

Partly established

Evidence of the security level Set by the vendor

Regulatory supervision and industry evidence (e.g. telecoms regulator, PCI DSS SAQ, critical infrastructure regime, TISAX)

Transfer mechanism for third country transfers Set by the vendor

Not applicable, no transfer

Optional: Organisational measures at the controller

Handling of data subject rights *

Processes established for all rights++Processes for the core rights+Handled ad hoc-

Objection process under Art. 21 GDPR *

Established, documented, low-threshold++Defined but rarely used+No established process-

Erasure concept *

Documented and automated++Documented, triggered manually+Informal~None-

Mention in the privacy notice *

Yes, summarised in the notice and the LIA linked++Yes, named in the privacy notice+Internally in the RoPA only~Not documented so far-

Outcome

Your final assessment and the conditions you impose on yourself.

Overall assessment *

Outcome of the assessment *

Sustainable~Sustainable subject to conditions~Not sustainable~

Optional: Conditions and requirements

Next review date *

Optional: Events triggering an early re-assessment

Review before completion

Check every entry and answer each question truthfully. An inaccurate statement will not survive scrutiny by a supervisory authority and renders the record worthless.

Check your email