Privacy Notice

1.  About this notice

This notice explains how Genesys Cloud Services, Inc. and its affiliates (“Genesys”, “we”, “us”) process personal data in connection with the Agentic Virtual Agent chatbot made available on the Genesys.com website (“AVA”).

It applies to authorized Genesys employees and contractors globally. This notice is designed to satisfy transparency requirements as per applicable data protection laws, including the GDPR (applied as the baseline standard).

2. The AVA

The AVA is an AI-powered chatbot, developed and controlled by Genesys, made available to users of the Genesys.com website. The AVA is designed to enhance user experience by enabling users to ask questions about Genesys offerings, pricing, and other information available on the Genesys.com website. In addition, the AVA provides functionality for users to arrange product demos. Users located in the United States, United Kingdom, India, New Zealand, Germany, Austria, Switzerland, Israel or Singapore may book a demo directly through the AVA with the AVA offering the user several proposed dates and times. Users outside these countries cannot book a demo directly but may request that a Genesys representative contact them to discuss their inquiry.

To use either the demo booking or contact-request functionality of the AVA, the user is asked to provide a business email address. Upon submission, the AVA queries Genesys’ Customer Relationship Management system (“CRM”) to determine whether the provided email address is associated with an existing contact record. If a matching record is found, the AVA uses the information contained in that record to auto-populate the remaining required fields, specifically: first name, surname, company name, phone number, and country. Where the CRM does not contain some or all of the aforementioned personal data, the AVA requests this information directly from the user.

Once the demo or contact request is submitted, that request and the provided information is routed to Genesys’ account team to be assigned to a dedicated Genesys representative.

3. Who this notice applies to

This notice applies to authorized Genesys employees and contractors, and to employees who access the personal data collected and otherwise processed by the AVA.

4. Personal data we (may) process

4.1. Contact details:

Name, surname, business email address, business phone number and employer organization.

4.2 Usage and technical data:

We may collect IP Address, unique user and session identifiers, session referrer URLs and session timestamps.

4.3 What we do not process

Genesys does not intend to process any personal data (including sensitive categories of personal data such as health data, biometric data, financial account data, government identifiers, or children’s data) other than that provided in sections 4.1 and 4.2. Users must not enter these categories of data into the AVA.

5. Legal bases for processing

Genesys processes personal data only where there is a lawful basis to do so under applicable law. For most processing activities covered by this notice, Genesys relies on its legitimate business interests. Our legitimate interests in operating the AVA, as further set out below.

Where a different basis applies, such as legal obligation or consent for non-essential cookies – this is indicated in the table below.

6. Recipients and sub-processors

We do not sell personal data processed through the AVA and do not use it for cross-context behavioral advertising or profiling that produces legal or similarly significant effects.

We may share personal data with:

• Genesys group companies and personnel;
• Cloud infrastructure providers (the AVA is hosted on AWS US-East-1);
• Genesys contractors and vendors;
• Legal, regulatory, and public authorities where required by law.

All recipients are subject to appropriate data protection obligations.

7. International transfers

Personal data collected through AVA may be transferred to countries outside your home jurisdiction, including the United States where the AVA is hosted on AWS US-East-1. Where transfers are subject to legal restrictions, Genesys relies on one or more of the following mechanisms:

• European Commission Standard Contractual Clauses (SCCs) – 2021 version, for transfers from the EEA;
• UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, for transfers from the United Kingdom;
• Swiss Standard Contractual Clauses as adapted for the nFADP, for transfers from Switzerland;
• EU-US Data Privacy Framework;
• Adequacy decisions as adopted by the European Commission where applicable; and
• Contractual safeguards or consent where required by applicable law.

8. Your privacy rights

Subject to applicable law, you may have the right to:

• access personal data we hold about you;
• request correction of inaccurate data;
• request erasure where no overriding retention obligation applies;
• restrict or object to processing;
• lodge a complaint with your local data protection supervisory authority.

To exercise any right, please contact dataprivacy@genesys.com. We will respond within one month, extendable by two months for complex requests. No fee is charged unless requests are manifestly unfounded or excessive.

Where you are a Genesys’ customer organization’s employee, rights relating to personal data processed by your employer should be directed to your employer, not to Genesys.

9. Security, retention, and cookies

9.1 Security

Genesys implements appropriate technical and organizational measures including encryption in transit and at rest, role-based access controls, authentication controls, and security monitoring. The Genesys Cloud Security Policy applies to the AVA.  The CRM and the third-party software used to schedule appointments and register user inquiries (as identified in Section 2) are subject to their respective providers’ security measures, which Genesys has assessed as appropriate.

9.2 Retention

We retain your contact details as part of our ongoing customer relationship management records. Your Contact Details will remain in our systems unless you request its deletion by contacting us or exercising your data protection rights.

If collected, your usage and technical data will be deleted after 60 days.

9.3 Cookies

The AVA uses cookies to enable the proper functioning of the AVA, including maintaining and restoring messaging sessions, ensuring conversation continuity, supporting co-browsing and authentication functionality, and tracking session activity. Genesys will provide consent choices where required by applicable law for non-essential cookies. For details, refer to the Genesys Cookie Policy at https://help.genesys.cloud/articles/genesys-cloud-and-cookies/

10. Updates to this notice

Genesys may update this notice from time to time. The version date at the top of this notice reflects the most recent update.

11. Contact and complaints

For questions about this notice or to exercise privacy rights,
contact: dataprivacy@genesys.com

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. EU/EEA supervisory authority contacts are available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en