Law 25 when software answers your calls
Four obligations rest on your business, not on your vendor. Here they are, what a vendor owes you so you can meet them, and what none can do on your behalf.
What does Law 25 require when software answers and records?
Four things, and they rest on your business: inform a person and obtain consent before collecting personal information, appoint someone in charge of protecting personal information, keep a register of confidentiality incidents, and handle sensitive information more carefully than ordinary information.
Reception software exempts you from none of those four. It can carry out parts — announcing a recording at the start of a call, logging access, erasing a record on request — yet responsibility stays with a business that collected personal information.
What you should demand from a vendor is specific: where your records live, who else processes them, how long a copy exists elsewhere, and through which channel an access or deletion request gets handled.
Where you probably are
You run a small business of a few people. You know Law 25 exists, you may already have added a sentence to a form on your website, and you have no legal department. You have just realised that software answering your phone records conversations, and that those conversations carry names, addresses, sometimes health information.
Good news: those four obligations come down to simple acts, and three of them cost nothing. Bad news: nobody other than you can perform them, and a vendor telling you otherwise is doing you harm.
What the law asks of your business
Consent must be sought before collection, in understandable terms, for a stated purpose. A recorded call is therefore announced at its start, before conversation begins, and a caller keeps a choice to hang up.
A person in charge of protecting personal information is appointed inside your business. It may be you. That name or title, and a way to reach them, must be published.
A confidentiality-incident register records events touching personal information, what was done about them, and whether a risk of serious injury required notifying affected people and the Commission d’accès à l’information.
Sensitive information — health, financial situation, biometric data — calls for stronger protection and clearer consent. A clinic receives calls carrying it on nearly every line.
What changes at your front desk
A recording is announced at the start of a call, rather than buried on a web page. It must be short, plain, and say why conversation is kept.
A rule that applies to calls applies to writing: a text message, a chat on your website or an email reply also collect personal information, and also need a purpose and consent.
An access or deletion request has to reach something that answers. If a caller writes asking for a copy of what you hold, or asking you to erase it, you must be able to do so — so a vendor owes you that capability inside a tool, rather than by email request.
Retention is a decision made by your business, not a setting software makes for you. Keep what you need, as long as you need it, and no longer.
What Zenvox does, and what it cannot do for you
What a product does: a recording is announced at the start of every call; access is logged; exporting and erasing a record are product operations available in an app; a role given to each teammate limits what they see.
What a product publishes: where your call records live, which processing is entrusted to a subprocessor, how long a copy survives there, and where a privacy impact assessment for that transfer stands. Those sentences are written in a single place and reused everywhere, so no diverging version circulates; they sit at the foot of this page.
What a product cannot do: appoint your responsible person, write your privacy policy, decide your retention period, or keep your incident register for you. No technical measure makes data untouchable either, and a page claiming otherwise would be lying to you.
Questions your customers actually ask
“Are you recording?” — yes, and it is announced at the start. “Can I speak to a person?” — a receptionist transfers or takes a message under a rule you set, and asking for a transfer needs no justification.
“What do you do with my information?” — you answer with your own purpose: calling back, preparing a visit, opening a file. That sentence, written into your instructions, is what a receptionist will say for you.
Related product pages
Pages detailing measures taken, and known limits.