What our assistants do — and do not do — with your data

1. AI transparency: you know it is an AI (AI Act, article 50)

Since 2 August 2026, anyone talking to an AI system must be clearly told so from the start. This is a rule of the European AI regulation (the AI Act, art. 50 §1). There is no exemption for small businesses, and a line in terms and conditions is not enough.

At Secondia: the phone assistant introduces itself as “[your company]'s AI assistant” in its first sentence, with no human first name. This site's chat presents itself as an AI. Emails prepared by an assistant (reminders, replies) say so too. These notices are never removed to “sound more human”.

2. No audio recording, by design

In Belgium, recording a phone conversation without the consent of everyone on the call is prohibited (art. 314bis of the Criminal Code and art. 124 of the Electronic Communications Act), apart from narrow legal exceptions. The Data Protection Authority (the Belgian body that watches over privacy) has recalled that a mere greeting message does not amount to consent.

Secondia therefore records no audio file of calls. It is not a disabled option: it is how the service is built. The assistant only produces a transcript (the text of the conversation) and a summary. They are used to pass the message on to you and let you check what was said.

3. Retention: 30 days

Call transcripts and summaries are kept 30 days from the call, then deleted. That window gives you time to handle a message, check an instruction or report an error to us. It is the same for every client.

Other data (client account, tracked invoices, reminder history, activity log) follows the periods set in the Data Processing Agreement (DPA). At the end of the contract, it is deleted or returned to you within 30 days, unless the law requires it to be kept.

4. Legal basis (why the law allows it) and roles

For the data of people who call and of people who receive an invoice reminder, your business is the “controller” (it decides why and how the data is used). Secondia is the “processor” (art. 28 GDPR): we handle the data on your behalf, only on your written instructions.

The “legal basis” is the reason that makes the processing lawful. You choose it; the usual ones are performance of the contract with your customer (message taking, appointments, reminder for a due invoice) and your legitimate interest (making sure your business answers the phone).

No health data is processed: no consultation reason, no symptom, no diagnosis. This limit is written into the contract (DPA §3, Terms §9) and shapes how the assistants are designed, in particular for medical practices.

5. Individuals' rights

Anyone whose voice was transcribed, or who received an invoice reminder, can ask to see their data, correct it, erase it, limit its use or object to it (art. 15 to 21 GDPR). They go first to the client business. Secondia helps, and can also be contacted directly at contact@secondia.app: reply within 24 business hours, handled within the legal one-month deadline.

In case of disagreement, a complaint may be lodged with the Belgian Data Protection Authority (dataprotectionauthority.be).

6. Sub-processors

A “sub-processor” is a company to which Secondia entrusts part of the work (hosting, payments…). Only those listed in article 6 of the DPA are authorised. If a telephony or voice provider is needed, it is named in your contract. Any change is notified to you, and Secondia remains liable for its sub-processors.

If a sub-processor handles data outside the EU, the transfer is governed by standard contractual clauses (model rules approved by the EU) or an adequacy decision (the EU recognises the country as safe). Data is hosted in the EU whenever possible.

• Vercel — application hosting
• Supabase — database (EU)
• Stripe — payments
• Anthropic — AI models
• Resend — transactional email
• + the telephony/voice provider named in your contract, where applicable

7. Security and incidents

Data is encrypted while in transit (unreadable to outsiders), access is controlled, actions are logged and each client's data is kept separate. Inbound messages are screened against attempts to trick the assistant and against capture of banking details (IBAN). In the event of a data leak, Secondia notifies the client within the period set in the DPA so that the client can meet its own obligations.