How can we help?

Organizations using Polyosync may process personal information relating to customers, employees, prospects, and other individuals. Such processing can be subject to data protection laws, including the UK GDPR, EU GDPR, or other applicable privacy requirements. Polyosync provides technology for business operations, but using the platform does not remove an organization's legal responsibilities. What is personal data? Personal data is information relating to an identified or identifiable individual. Examples may include: 1. Names. 2. Email addresses. 3. Telephone numbers. 4. Customer communications. 5. Appointment details. 6. Employee information. 7. Other information that can identify a person directly or indirectly. Who is responsible for deciding how personal data is used? For many business use cases, the customer organization determines the purposes and means of processing personal data. Depending on the activity, this may make the organization a data controller under applicable law. Polyosync may act as a processor for certain customer-directed activities. The exact legal roles depend on the processing activity and applicable agreements. What should organizations consider before using personal data? 1. Whether there is an appropriate legal basis for processing. 2. Whether individuals have received required privacy information. 3. Whether the information is necessary for the intended purpose. 4. Whether sensitive information requires additional safeguards. 5. Whether the relevant users are authorized. 6. Whether external integrations introduce additional processing. 7. Whether retention periods are appropriate. 8. Whether international transfers require specific safeguards. Can AI Employees process personal data? AI Employees may process personal information when it is relevant to an authorized business operation. Organizations should assess whether the intended processing is lawful and appropriate. Should businesses upload every available customer record? No. Data minimization is an important privacy principle. Only information reasonably necessary for the intended purpose should be provided. What about special-category or highly sensitive data? Organizations should assess additional legal, contractual, and security requirements before processing sensitive information. Do not assume that every category of sensitive information is appropriate for every AI workflow. Does using Polyosync automatically make a business GDPR compliant? No. Compliance depends on the organization's processing activities, legal obligations, contracts, and technical and organizational measures. Using a software platform does not independently establish compliance. Recommended approach Define the purpose of each processing activity, minimize unnecessary personal information, review applicable legal obligations, and configure AI operations accordingly.