GDPR compliant
Your data and the GDPR
“GDPR compliant” is our own statement, not a certification by the CNIL, the French data protection authority. The proof is in Ben's terms of use, in French, and each point links to its article.
Ben is your processor
Your agency remains the controller. Ben processes your clients' data on your agency's behalf, under article 28 of the GDPR. The processing agreement is part of the terms of use you accept when you create your account.
Ben's sub-processors
Ben's servers are in France, and its encrypted backups in the Netherlands. Telephony, voice, transcription and the AI behind written replies go through providers that process data in the United States. If you connect your WhatsApp number, WhatsApp processes your messages too. The European Commission's standard contractual clauses, or the Data Privacy Framework, cover the transfers outside the European Union. Annex 2 names each sub-processor.
Retention periods
Ben deletes call recordings 90 days after the call. Ben erases contacts, transcripts, messages, requests and appointments three years after the last exchange with the contact. Ben applies these periods every night.
Security
Every connection goes through HTTPS. Ben encrypts the access to your calendars and mailboxes before storing it. An advisor sees only the agencies they work in. Ben makes an encrypted backup every day.
Your clients know they are talking to an AI
Every call starts with a fixed announcement. Ben says he is the agency's AI assistant and that the call is recorded. In writing, Ben's first reply says so too.
Your clients' rights
Your clients have the right of access, rectification, erasure, restriction, objection and portability. Ben helps your agency answer their requests. At your request, Ben erases a person without waiting for the end of the retention periods.
Try Ben