Data processing details

Data processing details

Last Modified May 15, 2021 / Previous Versions

Dragon Medical Direct (DMD) (aka SpeechKit) Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of products to Company in accordance with Nuance’s published product documentation for the product in question, including voice recognition services to translate voice dictation to text for healthcare providers. The subject matter, nature and purpose of the Processing is delivery of Nuance Services in support of Dragon Medical Direct, an on-premise product in accordance with

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors,

as described in Nuance’s published product and service documentation, including voice recognition services to translate voice dictation to text for healthcare providers. Company or Distributor, depending on whether Nuance uses a Distributor, also instructs Nuance for an initial 12 month period to provide a Customer Support Package, whereby data from the Company’s system will be sent to Nuance’s CSO team to be placed into a dashboard of user metrics utilizing Microsoft’s Power BI tools. Dashboards are shared with Company demonstrate how the license is being used, including, but not limited to, license activity, throughput or volumes dictated, the number of minutes the license is active, what efficiencies are being utilized.

(b) The categories of Data Subjects are (1) patients or clients who receive medical care from Company and who are the subject of reports Processed by the products, and (2) Company personnel, including doctors, nurses, administrators, medical personnel and other authorized individuals who use the Products.

(c) The types of Personal Data involved are under the control of Company as Controller and will depend on the categories of Personal Data Processed by Company using the products, but will likely include name, date of birth, medical record number, other identification numbers, age, description of medical treatment and diagnosis, or financial information. Additionally, Personal Data of Company personnel will also be Processed, including name, contact information and voice recordings.

(d) The healthcare records created with Dragon Medical Direct are maintained on Company's on‑premise platform and the retention of those records is at the discretion of Company. The duration of the Processing is the duration of the Main Agreement, Terms of Service, or Agreement respectively, and any data retention period specified therein or by law (or, if no specific data retention period is specified in the Product Agreement, the data retention period specified by Nuance data retention and destruction policy). Records pertaining to Nuance's account management, accounting and customer relationship management system are maintained for the duration of the relationship and for a period thereafter consistent with Nuance’s data retention and destruction policy.

(e) Processing of Personal Data will be conducted in the following locations: Austria, Spain, Ireland, and the United States.

Dragon Medical One (DMO) (aka SpeechKit) and including PowerMic Mobile Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of the Services to Company in accordance with Nuance’s published product documentation for the product in question, including voice recognition services to translate voice dictation to text for healthcare providers. Dragon Medical One is a cloud-based platform that helps to produce clinical documentation for medical professionals, through voice recognition services to translate voice dictation to text. To fully optimize the voice recognition abilities of these programs, Company or Distributor, depending on whether Nuance uses a Distributor, instructs Nuance and its service providers/sub-processors and Affiliates to use, compile (including creating statistical and other models), annotate and otherwise analyze the data to develop, train, tune, enhance and improve the speech recognition, natural language understanding and other components of Nuance’s software and technologies embodied in the Services.

(b) The categories of Data Subjects are (1) patients or clients who receive medical care from the Company and who are the subject of reports Processed by the Services, (2) Company personnel, including doctors, nurses, administrators, medical personnel and other authorized individuals who use the Services, (3) employees, agents, and contingent workers of Resellers (who are natural persons), and (4) employees, agents, or contingent workers of Distributor (who are natural persons).

(c) The types of Personal Data involved are under the control of Company as Controller, and will depend on the categories of Personal Data Processed by Company using the Services, but will likely include name, date of birth, medical record number, other identification numbers, age, description of medical treatment and diagnosis, or financial information. Additionally, Personal Data of Company personnel will also be Processed, including name, contact information and voice recordings. Further, Personal Data of Distributor and Reseller personnel, including name and contact information, will also be Processed in the provision of third level service support and data analytics.

(d) Hosting of Personal Data will be conducted in the following locations:

North America: in the US for US Companies and in Canada for Canadian Companies;

EMEA: in Germany for German Companies and in France for all other EMEA Companies;

LATAM: in the US for LATAM Companies;

APAC: in Australia for Australian companies

(e) The duration of the Processing is the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Any data retention period specified in the above terms, as applicable, or by law (or, if no specific data retention period is specified in the above terms, the data retention period specified by Nuance data retention and destruction policy).

Dragon Medical Workflow Manager (“DMWM”) Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of the Services to Company in accordance with Nuance’s published product documentation for the product in question, including voice recognition services to translate voice dictation to text for healthcare providers. Dragon Medical Workflow Manager is an end-to-end cloud-based clinical documentation creation solution that manages all steps in the clinical documentation process from creation to distribution and every step in between. Through DMWM letters and patient reports can be dictated using a microphone, digital recorder, or mobile device. Medical Professionals can also utilise Nuance’s AI-based speech recognition functionality to further enhance the documentation process and reduce the need for transcription, allowing clinicians to quickly and accurately create and electronically sign documents for immediate distribution by using voice recognition services to transcribe audio to text. To fully optimize the voice recognition abilities of these programs, Company or Distributor, depending on whether Nuance uses a Distributor, instructs Nuance and its service providers/sub-processors and Affiliates to use, compile (including creating statistical and other models), annotate and otherwise analyze the data to develop, train, tune, enhance and improve the speech recognition, natural language understanding and other components of Nuance’s software and technologies embodied in the Services.

(b) The categories of Data Subjects are (1) patients or clients who receive medical care from the Company and who are the subject of reports Processed by the Services, and (2) Company personnel, including doctors, nurses, administrators, medical personnel and other authorized individuals who use the Services.

(c) The types of Personal Data involved are under the control of Company as Controller and will depend on the categories of Personal Data Processed by Company using the Services, but will likely include contact information, name, date of birth, medical record number, patient account number or other identification numbers, age, description and diagnosis of medical treatment, metadata, financial information, browsing information and other data contained in letters. Additionally, Personal Data of Company personnel will also be Processed, including name, contact information and voice recordings.

(d) Hosting of Personal Data will be conducted in the following locations:

United Kingdom for United Kingdom

Australia for APAC

(e) The duration of the Processing is the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Any data retention period specified in the above terms, as applicable, or by law (or, if no specific data retention period is specified in the above terms, the data retention period specified by Nuance data retention and destruction policy).

Dragon Anywhere and Dragon Professional Anywhere Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of the Services to Company in accordance with Nuance’s published product documentation for the product in question, including voice recognition services to translate voice dictation to text for users. Dragon Professional Anywhere is a cloud-based platform that helps to produce documentation through voice recognition services to translate voice dictation to text. The software and service is an application that permits users to dictate documents and reports that may include proprietary terminology. The application supports voice-based correction, formatting and navigation. Dictated text can be shared via email or saved as documents. To fully optimize the voice recognition abilities of these programs, Company or Distributor, depending on whether Nuance uses a Distributor, instructs Nuance and its service providers/sub-processors and Affiliates to use, compile (including creating statistical and other models), annotate and otherwise analyze the data to develop, train, tune, enhance and improve the speech recognition, natural language understanding and other components of Nuance’s software and technologies embodied in the Services.

(b) The categories of Data Subjects are (1) clients who receive services from the Company and who are the subject of reports Processed by the Services, (2) Company personnel and other authorized individuals who use the Services, (3) employees, agents, and contingent workers of Resellers (who are natural persons), and (4) employees, agents, or contingent workers of Distributor (who are natural persons).

(c) The types of Personal Data involved are under the control of Company as Controller, and will depend on the categories of Personal Data Processed by Company using the Services. Additionally, Personal Data of Company personnel will also be Processed, including name, contact information and voice recordings. Further, Personal Data of Distributor and Reseller personnel, including name and contact information, will also be Processed in the provision of third level service support and data analytics.

(d) Hosting of Personal Data will be conducted in the following locations:

United States of America

(e) The duration of the Processing is the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Any data retention period specified in the above terms, as applicable, or by law (or, if no specific data retention period is specified in the above terms, the data retention period specified by Nuance data retention and destruction policy).

MIX, Conversational AI and Nuance Experience Studio Data Processing Details

(a) The categories of Data Subjects are:

Employees, agents, or contingent workers of Company (who are natural persons);

Natural persons authorized by Company to use the Services (for example customers and prospective customers of Company);

(b) The nature and purpose of the Processing is to facilitate chat conversations between Company’s customers/prospects and Company’s employees, agents, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject. This conversation could also include dialog with a virtual assistant;

(c) The subject matter of the Processing is the chat conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;

(d) The types of Personal Data involve information necessary to enable communications between Company and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:

Device/Client Identifier – Identifier that enables communication between Company and user, such as a socket id or IP Address;

Chat Message Content – Transcript of the chat message between Company and user, including personal information normally exchanged during a customer service conversation such as name, address, or email address;

Meta Data – Specific personal information requested by the Data Subject or Company necessary to fulfil the customer service request, such as customer id, verification information such as mother’s maiden name, data of birth, or social security number, credit card number, or information related to Data Subject’s account with Company;

(e) The Processing will comprise of collecting data from Company’s web site, mobile app, or via a messaging channel (such as SMS), sending it to Company’s employee, agent, or contingent worker via an HTML-based agent desktop application. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;

(f) Hosting of Personal Data will be conducted in the following locations:

For Companies in North America in the USA;

For Companies in EMEA in UK, Ireland, France, and The Netherlands;

For Companies in APAC in Australia;

For Companies in LATAM in the USA;

(g) The duration of the Processing will be for 18 months for Services, reporting and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Virtual Assistant and Live Chat Data Processing Details

(a) The categories of Data Subjects are:

Employees, agents, or contingent workers of Company (who are natural persons);

Natural persons authorized by Company to use the Services (for example customers and prospective customers of Company);

(b) The nature and purpose of the Processing is to facilitate chat conversations between Company’s customers/prospects and Company’s employees, agents, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject. This conversation could also include dialog with a virtual assistant;

(c) The subject matter of the Processing is the chat conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;

(d) The types of Personal Data involve information necessary to enable communications between Company and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:

Device/Client Identifier – Identifier that enables communication between Company and user, such as a socket id or IP Address;

Chat Message Content – Transcript of the chat message between Company and user, including personal information normally exchanged during a customer service conversation such as name, address, or email address;

Meta Data – Specific personal information requested by the Data Subject or Company necessary to fulfil the customer service request, such as customer id, verification information such as mother’s maiden name, date of birth, or social security number, credit card number, or information related to Data Subject’s account with Company;

(e) The Processing will comprise of collecting data from Company’s web site, mobile app, or via a messaging channel (such as SMS), sending it to Company’s employee, agent, or contingent worker via an HTML-based agent desktop application. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;

(f) Hosting of Personal Data will be conducted in the following locations:

For Companies in North America in the USA;

For Companies in EMEA in UK, Ireland, France, and The Netherlands;

For Companies in APAC in Australia;

For Companies in LATAM in the USA;

(g) The duration of the Processing will be for 13 months for Services, reporting and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Gatekeeper Data Processing Details

(a) The categories of Data Subjects are:

Employees, agents, or contingent workers of Company (who are natural persons)

Natural persons authorized by Company to use the Services (for example customers and prospective customers of Company);

(b) The nature and purpose of the Processing is to facilitate chat conversations between Company’s customers/prospects and Company’s Employees, agents, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject. This conversation could also include dialog with a virtual assistant.;

(c) The subject matter of the Processing is the chat conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject.;

(d) The types of Personal Data involve information necessary to enable communications between Customer and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:

Device/Client Identifier – Identifier that enables communication between Company and user, such as telephone number, CLI, other telephony data, socket id or IP Address;

Biometric Data – VoicePrints, ConversationPrinttm, behavioral biometrics and other biometric identifiers and biometric information;

Call Center Conversation – audio recording of the Data Subject/user speaking with a Company representative. Although not explicitly requested, unstructured conversation can contain personal information including, but not limited to: name, address, credit card number;

Chat Message Content – Transcript of the chat message between Company and user, including personal information normally exchanged during a customer service conversation such as name, address, or email address;

Meta Data – Specific personal information requested by the Data Subject or the Company necessary to fulfill the customer service request, such as date of birth, account id, customer id or CLI;

(e) The Processing will comprise of collecting data from Company’s call center, IVR, or digital channels such as mobile apps or web (e.g. live chat). This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;

(f) Processing of Personal Data will be conducted in the following locations:

For Companies in North America in the USA and Canada;

For Companies in EMEA in UK, Ireland, France, Germany, and The Netherlands;

For Companies in APAC in Australia;

(g) The duration of the Processing will be for 18 months for Services, reporting and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Cloud IVR Services Data Processing Details

(a) The categories of Data Subjects are:

Employees, agents, or contingent workers of Company (who are natural persons)

Natural persons authorized by Company to use the Services (for example, customers and prospective customers of Company);

(b) The nature and purpose of the Processing is to facilitate automated conversations between Company’s customers/prospects and Company’s IVR applications, employees, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These conversations can include general Company information or requests and transactions specific to an individual Data Subject.;

(c) The subject matter of the Processing is the automated conversations related to a specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;

(d) The types of Personal Data involve information necessary to enable communications between Customer and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:

Device/Client Identifier – Identifier that enables the communication between Company and user, such as customer’s phone number

Automated Conversation Content – Recording or logging of the conversation between Company and user, including personal information normally exchanged during an automated conversation such as name, address, or email address

Meta Data – Specific personal information requested by the Data Subject or the Company necessary to fulfil the customer service request, such as customer id, verification information such as mother’s maiden name, date of birth, or social security number, credit card number, or information related to Data Subject’s account with Company;

(e) The Processing will comprise of collecting data during the automated conversation or collecting from Company’s backend systems. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools.;

(f) Processing of Personal Data will be conducted in the following locations:

For Companies in North America in the USA;

For Companies in EMEA in UK;

(g) The duration of the Processing will be for 13 months for Services, reporting, and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Dragon TV Data Processing Details

(a) The categories of Data Subjects are:

Employees, agents, or contingent workers of Company (who are natural persons)

Natural persons authorized by Company to use the Services (for example, customers and prospective customers of Company);

(b) The nature and purpose of the Processing is to facilitate television user experience enhancements by means of voice services between Company’s customers/prospects and Company’s television delivery services, SmartSpeaker support services, employees, or contingent workers and to operate, maintain, tune, enhance, improve, and provide technical support for the Services. These interactions can include general Company information or requests and transactions specific to an individual Data Subject;

(c) The subject matter of the Processing is the audio and resulting transcription related to each specific request by the Data Subject, to answer a question or make updates to the Company services provided to the Data Subject;

(d) The types of Personal Data involve information necessary to enable communications between Customer and Data Subject and provided by the Data Subject in order to gain the information or update Company services, including but not limited to:

Device/Client Identifier – Identifier that enables the communication between Company and user, such as a unique identifier allocated to the device by the OEM.

Audio Command/Query Content – Incoming audio captured from microphones on Device or a Remote Control Unit (RCU) and the transcription of that audio.

User identifier – Specific personal information requested by the Data Subject or the Company necessary to fulfil the customer service request, such as userID;

(e) The Processing will comprise of receiving speech requests from the Data Subject via the Device or RCU on their premises during the transaction conversation or collecting from Company’s backend systems. This data will be retained in a hosted database (with the exception of data that is masked according to predefined forms, automatic pattern matching, or manual overrides) and made available to authorized users of Nuance data APIs or reporting web tools;

(f) Hosting of Personal Data will be conducted in the following locations:

For Companies in EMEA:
•In the EU (Ireland) for DTV (based on NCS)
•In UK1 for DTVaaS (based on Core Tech SaaS);

For Companies in Rest of World: in the USA;

(g) The duration of the Processing will be for 120 days for Services, reporting, and analytics, and 3 years to maintain, tune, enhance, improve and provide technical support or the duration specified in documented instructions by Company or Distributor, depending on whether Nuance uses a Distributor, but in no event longer than 90 days following the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

1Depending on the outcome of Brexit, this may be split between UK hosting for customer in the UK and elsewhere in the EU for EMEA customer outside of the UK.

Nuance Winscribe Dictation (“Winscribe DD”) Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of the Services to Company in accordance with Nuance’s published product documentation for the product in question, including voice recognition services to translate voice dictation to text for healthcare providers. Nuance Winscribe Dictation is a cloud-based platform that enables business professionals to automate their dictation-to-transcription workflow and remove manual steps from the process. Winscribe DD automatically collects and delivers dictations, assesses information about each job and delivers work to the appropriate transcriptionist or support team. Users can choose between sending dictated work to support staff for transcription, sending it to Dragon Speech Recognition engine for automatic voice-to-text transcription or sending it to an outsourcing agency for completion. To fully optimize the voice recognition abilities of these programs, Company or Distributor, depending on whether Nuance uses a Distributor, instructs Nuance and its service providers/sub-processors and Affiliates to use, compile (including creating statistical and other models), annotate and otherwise analyze the data to develop, train, tune, enhance and improve the speech recognition, natural language understanding and other components of Nuance’s software and technologies embodied in the Services.

(b) The categories of Data Subjects are (1) clients who receive services from the Company and who are the subject of reports Processed by the Services, and (2) Company personnel, including business professionals and all other authorized individuals who use the Services.

(c) The types of Personal Data involved are under the control of Company as Controller and will depend on the categories of Personal Data Processed by Company using the Services, but will likely include contact information (address, phone number, email address), name, date of birth, medical record number or other identification numbers, age, gender, description of medical treatment and diagnosis, appointment data, test results, financial information, metadata, IP Address, browsing time, cookie information, website history, sensitive data (genetic data, health data, sex life, sexual orientation, racial or ethnic origin, religion or religious beliefs) and other data contained in the dictations (audio files). Additionally, Personal Data of Company personnel will also be Processed, including name, contact information and voice recordings.

(d) Hosting of Personal Data will be conducted in the following locations:

United Kingdom for United Kingdom

Australia for APAC

(e) The duration of the Processing is the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors

Any data retention period specified in the above terms, as applicable, or by law (or, if no specific data retention period is specified in the above terms, the data retention period specified by Nuance data retention and destruction policy).

PowerShare Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of the Services to Company in accordance with Nuance’s published product documentation for the product in question. PowerShare is a cloud-based platform for uploading, storing, and copying studies, and for transmitting studies with patients, providers, potential patients, and other facilities.

(b) The categories of Data Subjects are (1) potential patients of Company, (2) patients who receive medical care from the Company and who are the subject of studies Processed by the Services, (3) Company personnel, including doctors, nurses, administrators, medical personnel and other authorized individuals who use the Services, (4) employees, agents, and contingent workers of Resellers (who are natural persons), and (5) employees, agents, or contingent workers of Distributor (who are natural persons).

(c) The types of Personal Data will likely include name, date of birth, medical record number, other identification numbers, age, and health information, including medical images. Additionally, Personal Data of Company personnel will also be Processed, including name and contact information. Further, Personal Data of Distributor and Reseller personnel, including name and contact information, will also be Processed in the provision of third level service support and data analytics.

(d) Data Centers for Processing of Personal Data will be in the following locations:

United States

(e) The duration of the Processing is the duration of

(i) the Main Agreement in case of a DPA for End Users;

(ii) the Terms of Service in case of a DPA for Nuance Services;

(iii) the Agreement in case of a DPA for Nuance Distributors.

Any data retention period specified in the above terms, as applicable, or by law (or, if no specific data retention period is specified in the above terms, the data retention period specified by Nuance data retention and destruction policy).

Proactive Engagement Data Processing Details

(a) The subject matter, nature and purpose of the Processing is delivery of Services to Company in accordance with Nuance’s published product documentation for the product in question, including outbound Voice, SMS and Email notifications. The Proactive Engagement Platform is a Nuance hosted platform that sends consumers notifications on behalf of our clients. Flight cancelation/delay messages, fraud on a credit card, payment reminders, utility outages, appointment reminders. The data is the list of consumers to be notified, the messages are personalized, the data includes, phone numbers, email addresses, first and last name, and additional data related to the use case, flight numbers, overdue payment amounts, credit card transactions, appointment details etc

The categories of Data Subjects are:

Employees, agents, or contingent workers of Company (who are natural persons)

Natural persons authorized by Company to use the Services (for example, customers and prospective customers of Company);

(b) The nature and purpose of the Processing is to facilitate personalized automated outbound notifications to Company’s customers who have opted on to receive outbound Voice, SMS or Email notifications related to the Company’s products or services.

(c) The subject matter of the Processing is the data used to create the outbound notification.

(d) The types of Personal Data involve information necessary to enable outbound notifications to the Data Subject, including but not limited to:

Phone number/Email Address

Data related to the specific use case – Specific personal information related to the notification necessary to personalize the message, such as customer id, verification information such date of birth, or last 4 social security number, last 4 credit card number, or other information related to Data Subject’s account with Company.

(e) The Processing will comprise of collecting data during the automated conversation or collecting from Company’s backend systems. This data will be retained in a hosted database and made available to authorized users of Nuance data APIs or reporting web tools.

(f) Processing of Personal Data will be conducted in the following locations:

data center in Tuwila WA (Seattle) and Aurora CO (Denver)

(g) The duration of the Processing will be for 13 months for detailed data related to the notification and 7 years for aggregate data (count of total SMS sent or email sent etc).