Privacy policy

telkit AS is a Norwegian limited company, registration number [to be supplied: company registration number], registered at [to be supplied: registered business address]. Privacy questions go to personvern@telkit.no.

Data protection officer: [to be supplied: data protection officer, or confirmation that we are not required to appoint one].

Which role we hold depends on the data. The split decides who you should approach.

Processor

Audio, recordings, transcripts, message content and call data created when a customer uses the API. The customer sets the purpose and we act on their documented instructions. A GDPR Article 28 agreement is in place before production use.

Controller

Our customers' contact details, email you send us, and traffic on telkit.no. Here we set the purpose ourselves.

If a business using telkit sent you an SMS or called you, that business is who you should contact. We do not know their purpose and cannot answer for them, though we will pass your request on if you send it to us.

Account data

Name, email, phone number, employer and billing details. The basis is the contract with the customer.

Content data

Audio, recordings, transcripts and the text of SMS messages. We only ever handle this as a processor.

Traffic data

Call detail records: who called whom, when, for how long, and SMS delivery status. Norwegian electronic communications law requires us to retain some of it.

Log data

IP address, timestamp, endpoint and error codes for API calls. The basis is legitimate interest in operations, debugging and security.

KYC documentation

Company certificate, ID and proof of address for whoever orders a Norwegian number. Number allocation rules require it.

Website data

Page views and events on telkit.no, collected in PostHog EU Cloud.

We do not sell data on. Content customers send through the API is not used to train models.

Recordings, transcripts and message content are stored with Hetzner in Finland (Helsinki) and Germany (Falkenstein and Nürnberg). The media plane for voice calls is contractually pinned to eu-central in Frankfurt, and speech-to-text runs against European endpoints.

We never store media URLs in the database, only the storage key. The URL is signed at the moment someone reads the file, and it expires.

Hetzner has no Norwegian region, so our standard is the EEA rather than Norwegian soil. If your organisation requires data to stay inside Norway, we solve that on a dedicated setup. More on data residency.

We do not process everything ourselves. Carriers, SMS aggregators and media infrastructure are sub-processors, and you have a right to know who they are.

All of them are bound by processing terms equivalent to the customer's own. The list is an annex to the data processing agreement and is updated here first. You are notified before a new sub-processor is taken into use, in time to object.

Recordings and transcripts have a retention period the customer sets, and they are deleted on request. CDRs and KYC documentation cannot be deleted before the statutory retention period expires. The data processing agreement reconciles the GDPR right to erasure with that retention duty.

The rule is that data stays in the EEA. Where a sub-processor exceptionally has to handle something outside it, that happens under the EU Standard Contractual Clauses, with a separate assessment of the receiving country.

You can ask for:

• access to the data we hold about you
• correction of data that is wrong
• erasure, where we have no legal ground to keep it
• restriction of processing while an objection is handled
• a copy of your data in a machine-readable format
• an objection to processing we base on legitimate interest

Send requests to personvern@telkit.no and we answer within 30 days. If you believe we handle your data unlawfully, you can complain to Datatilsynet, the Norwegian Data Protection Authority.

We use PostHog EU Cloud to count page views and see which pages actually get read. The data sits in the EU. We run no advertising trackers and share no traffic data with ad networks.

• AES-256 on recordings, transcripts and message content at rest
• TLS 1.3 on all API and webhook traffic, and webhooks are additionally signed with Ed25519
• Role-based access control per customer, and mandatory two-factor login for the console
• Timestamped audit logs on access and changes

On a personal data breach we notify the customer without undue delay, with the logs and trail they need for their own 72-hour deadline to Datatilsynet.

We update this policy when the processing changes. The date at the top shows the last change. If a change is material, we email customers before it takes effect.