Privacy Notice for Call Recording, AI Processing and Biometric Data

1. Introduction and Scope

This Privacy Notice explains how Emplifi (“Emplifi”, “we”, “us”, “our”) processes personal data when customers, prospective customers, or other business contacts participate in calls or virtual meetings that may be recorded and analysed using Clari Inc. (“Clari”), including the use of artificial intelligence (“AI”) technologies.

This notice applies globally, including in the European Economic Area (“EEA”), United Kingdom, United States, Canada, Latin America, the Middle East, and Asia-Pacific regions.

2. Controller and Contact Details

Emplifi acts as the data controller for the personal data described in this notice.

For questions, requests, or to exercise your data protection rights, please contact: support@emplifi.io

3. Applicable Laws

Processing is carried out in accordance with applicable data protection and privacy laws, including but not limited to:

Europe & UK

• EU General Data Protection Regulation (EU) 2016/679 (“GDPR”)
• UK GDPR and Data Protection Act 2018

United States

• California Consumer Privacy Act / CPRA
• Applicable U.S. federal and state privacy laws
• U.S. state wiretapping laws (including one-party and all-party consent regimes)
• Applicable biometric privacy laws (e.g. Illinois Biometric Information Privacy Act (BIPA))

Canada

• Personal Information Protection and Electronic Documents Act (“PIPEDA”)
• Applicable provincial privacy laws

Latin America

• Brazil Lei Geral de Proteção de Dados (“LGPD”)
• Mexico Federal Law on Protection of Personal Data Held by Private Parties (“LFPDPPP”)
• Other applicable local data protection laws

Middle East

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”)
• Saudi Arabia Personal Data Protection Law (“PDPL”)

Asia-Pacific

• Singapore Personal Data Protection Act (“PDPA”)
• Australia Privacy Act 1988 (Cth) and Australian Privacy Principles

Cross-cutting frameworks

• EU AI Act (where applicable)
• Other applicable ePrivacy, surveillance, and biometric/data protection laws

4. Categories of Personal Data Processed

We may collect and process the following categories of personal data:

• Identification Data: name, job title, employer
• Contact Data: business email address, phone number
• Communication Data: call recordings (audio and/or video), transcripts, chat logs
• Technical Data: IP address, device information, system logs
• Professional Data: role, company, business interactions
• Voice Data: audio data which may be considered biometric data under certain laws
• AI-Generated Outputs: summaries, action items, sentiment analysis, and insights

5. Purpose of Processing

We process personal data for the following purposes:

• Managing and documenting business communications
• Recording and transcribing calls for accuracy and record-keeping
• Generating AI-driven summaries, insights, and recommendations
• Supporting sales, forecasting, and customer relationship management
• Training, quality assurance, and service improvement
• Ensuring compliance with legal and regulatory obligations

6. Legal Basis for Processing

Depending on the jurisdiction, we rely on one or more of the following legal bases:

• Legitimate Interests
  To conduct and improve business communications and customer engagement in a B2B context
• Consent
  Where required by applicable law (including for call recording and processing of voice data that may qualify as biometric data)
• Contractual Necessity
  Where processing is required in connection with pre-contractual or contractual business activities
• Legal Obligations
  Where processing is required to comply with applicable laws

Where consent is required, it is obtained through clear notice and participant choice prior to or at the start of recording.

7. Call Recording, Notice and Participant Choice

Participants are informed that recording may occur through:

• a pre-call notice or pop-up prior to joining; and
• a real-time notification that recording is in progress at the start of the call

Where required by law, recording will only proceed where valid consent has been obtained.

By joining and continuing to participate in a call after being notified that recording is in progress, participants acknowledge and consent to such processing where permitted by law.

Participants may:

• request that recording be stopped;
• choose not to join the call; or
• leave the call at any time

8. Use of Artificial Intelligence

We use AI technologies (via Clari) to:

• transcribe call content
• generate summaries and action items
• provide insights and recommendations to support business operations

Safeguards include:

• Human oversight over all AI outputs
• No automated decision-making producing legal or similarly significant effects
• No use of customer data to train general or third-party AI models
• AI use limited strictly to service delivery

9. Biometric Data Processing

Voice data collected during calls may be considered biometric data under certain laws.

We confirm that:

• such data is used solely for recording, transcription, and analysis
• it is not used for identification or authentication purposes
• it is not sold or commercially exploited
• appropriate safeguards are implemented
• explicit consent is obtained where required by law

10. Data Sharing

We may share personal data with:

• Clari Inc., acting as a processor
• Clari sub-processors (including cloud service providers such as Microsoft Azure)
• Emplifi group companies
• Professional advisors (e.g. legal, audit)
• Regulators, courts, or authorities where required

All processing is subject to contractual safeguards and applicable data protection requirements.

11. International Data Transfers

Personal data may be transferred internationally, including to the United States and other jurisdictions where our service providers operate.

Where required, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs)
• Equivalent transfer mechanisms under applicable law

12. Data Retention

We retain personal data for up to three (3) years, unless a longer retention period is required by law.

Call recordings and transcripts are periodically reviewed and deleted in accordance with internal retention policies.

13. Your Rights

Depending on your jurisdiction, you may have rights to:

• access your personal data
• request correction of inaccurate data
• request deletion of your data
• restrict or object to processing
• withdraw consent (where applicable)

Requests may be submitted to: support@emplifi.io

14. Jurisdiction-Specific Considerations

European Union / United Kingdom

Transparency, fairness, and consent requirements apply

AI processing subject to emerging EU AI Act obligations

United States

Compliance with state wiretapping laws (including all-party consent where applicable)

Biometric laws respected; no biometric identification or profiling

Canada

Meaningful consent standard applies under PIPEDA

Brazil / Mexico / LATAM

• LGPD and LFPDPPP lawful basis and data subject rights apply
• Consent and transparency emphasized

Middle East (UAE / Saudi Arabia)

• Consent-based processing frameworks apply
• Cross-border transfer rules considered

Asia-Pacific (Singapore / Australia)

• Notification and consent-based regimes apply
• Data protection principles enforced through local legislation

15. Security

We implement appropriate technical and organisational measures, including:

• encryption of data in transit and at rest
• access controls and role-based permissions
• audit logging and monitoring
• vendor due diligence and contractual safeguards

16. Updates

This Privacy Notice may be updated from time to time to reflect changes in processing practices, technology, or legal requirements.