Unexus Connect privacy statement
For everyone whose data passes through Unexus Connect: people who work with it at one of our customers, and people who call, chat, email or message an organisation that uses it. In plain words: who is responsible for your data, what happens to it, and where to go with a question.
Version 1.0, 18 October 2026.
What this covers
Unexus Connect is the contact centre platform that organisations use to handle their contacts with the people they serve. This statement covers everything that is part of it: the app in Microsoft Teams, the web and desktop client, the Unexus Mobile app, and the tools for supervisors and administrators.
It applies to you if:
- you work at an organisation that uses Unexus Connect, or
- you have called, chatted, emailed, sent a WhatsApp or text message to such an organisation.
It is not about our website or about us as a company. That is in our privacy policy for the website.
We have written this in plain words. Is there something you still do not follow? Email us.
In short
- The organisation you work for, or that you contacted, is in charge of your data. We run the platform on their instructions.
- So with questions about your data, go to that organisation first. If you come to us, we pass your question on to them.
- For a few things we decide ourselves. Those are listed below, and for those you can come straight to us.
- Everything runs at Microsoft in the European Union. Only notifications to the mobile app pass through Google and Apple.
- We do not use your data for anything of our own, we sell nothing on, and we do not train AI models with it.
Who is responsible for what
The organisation is in charge. The organisation that uses Unexus Connect decides what is recorded, why, on which legal basis and for how long. The law calls that the controller. It is that organisation's privacy statement that tells you what it does with your data and how to ask about it.
We work on its instructions. We host and run the platform and only do with the data what the organisation asks of us, as agreed in a data processing agreement. The law calls that a processor. We do not look into the content for our own purposes.
For a few things we decide ourselves. To keep the platform secure for all our customers and to help when something goes wrong, we decide some things ourselves. For those we are the controller. They are listed under "What we decide ourselves".
Who we are
Unexus B.V.
Oude Utrechtseweg 24
3743 KN Baarn
the Netherlands
Chamber of Commerce 74840266
Privacy questions: privacy@unexus.nl
General: info@unexus.nl or +31 88 7620 400
We have no separate data protection officer; a company of our size is not required to appoint one. Email the privacy address and it reaches the people who deal with it.
What is on the platform
What exactly is on the platform depends on how the organisation has set it up. These are the kinds of data.
If you contact an organisation that uses Unexus Connect
| What | Examples |
|---|---|
| Who you are and how to reach you | Name, phone number, email address, messaging address, customer or case number. Some of it you give yourself; some the organisation looks up in its own systems, for instance to recognise your number |
| What you said or wrote | The call recording if the organisation records calls, voicemail, emails and attachments, chat and WhatsApp messages, files you send, survey answers |
| How the contact went | When and how long, which number or address you contacted, which queue, menu choices, whether a message was delivered and read, the web page you were on when you started a chat |
| What AI made of it, if the organisation uses that | A transcript, a summary of the conversation, sentiment and keywords, the conversation with a virtual assistant |
If you work with Unexus Connect
| What | Examples |
|---|---|
| Your account | Name, work email address, your account in your organisation's directory (for the Teams app: your Microsoft account at work), role, department, job title and photo if your organisation shares them |
| Your availability | Your status in Unexus Connect and, if switched on, your Teams presence and calendar availability |
| Your work | The contacts you handle, your notes and internal chat messages, numbers and durations, status history and, if switched on, quality scores and customer feedback |
| Security | When you signed in and from which network address, and who opened which recording |
We never ask for sensitive data such as health information, and there are no fields for it. But people sometimes mention it in a call or a message, and then it is in the recording or the text. The organisation decides how it deals with that, and can for instance pause recording or tell the AI to leave such details out of a summary.
Why, and on which basis
The organisation decides what it uses the platform for, and on which legal basis. Usually that is handling and following up your question or request, improving quality and training staff, planning staff, and meeting its own legal obligations. Depending on the organisation, the basis can be a task in the public interest, an agreement with you, a legal obligation or a legitimate interest. The privacy statement of the organisation tells you exactly.
We use the data only to deliver the platform to that organisation.
What we decide ourselves
| What | What data | Why we are allowed to | How long |
|---|---|---|---|
| Keeping the platform secure for all customers | Sign-ins, administrative actions, network addresses, security alerts | Legitimate interest: protecting the platform and the data of all our customers | 90 days |
| Helping when an organisation asks us for support | Your support request, and what we see in the organisation's environment while we help | The agreement with your organisation, and legitimate interest in a working service | Support requests: 5 years. In the environment itself we keep nothing |
To bill the organisation we count the licences in use per organisation. That count has no names in it.
To improve the product we look at totals, such as how many calls a feature handles. You are not in those totals.
Where we rely on legitimate interest, we have weighed our interest against yours. You may object; see "What you can ask".
Who else sees it
To run the platform we use a small number of other companies. They may do nothing else with the data than what we ask, and we have put that in writing with each of them.
| Who | What they do for us | When | Where |
|---|---|---|---|
| Microsoft (Azure) | Hosting the platform, the databases and the recordings | Always | the Netherlands |
| Microsoft (Azure AI services) | Speech recognition and transcription, summaries, the virtual assistant, language detection, chat translation | Only if the organisation uses those features | the Netherlands |
| Google (Firebase Cloud Messaging) | Delivering notifications to the Unexus Mobile app | Only if the organisation uses the mobile app | European Union and United States |
| Apple (Push Notification service) | Delivering those notifications to iPhones | Only with the mobile app on an iPhone | European Union and United States |
Calls reach the platform through the telephone network. The telecom operators that carry them do so under telecommunications law, on their own responsibility. If the organisation buys its connection through us, that is our sister company Unexus Telecom.
The organisation can connect Unexus Connect to systems it has chosen itself, such as its own CRM, case system, Microsoft 365, WhatsApp or SMS provider. Those work for the organisation, not for us. They are in the organisation's own privacy statement.
Only where the law obliges us to, for instance on a court order, do we give data to a government body. We tell the organisation, unless the law forbids that.
Where your data sits
The platform, the databases and the recordings sit at Microsoft Azure in the Netherlands. The backups are kept within the European Union. Data does not leave the European Union, with one exception:
- Notifications to the Unexus Mobile app. A notification, for instance an internal chat message or a voicemail alert with the caller's name, passes through Google and Apple on its way to your phone. They may handle it in the United States. Both are certified under the EU-US Data Privacy Framework, the arrangement between Europe and the United States on the protection of data. The organisation can switch these notifications off.
How long we keep what
The organisation decides how long its data is kept, and sets that in the platform. If it has not chosen a period, the standard periods below apply. The privacy statement of the organisation tells you what it has chosen. Every night the platform deletes what is older than the period. Deleted data stays in our encrypted backups for at most 35 days more, and is then gone for good. The organisation can also have names and other details made unrecognisable earlier, and have a recording deleted as soon as an AI summary of it has been made.
| What | Standard, unless the organisation chooses otherwise |
|---|---|
| Contact history: calls, emails, chats, messages, notes | 5 years; organisations usually choose between 1 and 5 years |
| Call recordings, voicemails, emails and attachments | 90 days; organisations usually choose between 7 days and 1 year |
| Sign-ins and security logs | 90 days |
| Backups, encrypted, in the European Union | Databases 35 days, recordings and other files 30 days |
When an organisation stops using Unexus Connect, it gets a full export of its data. Only once it has checked that export and asks us in writing do we delete its environment, within 30 days. The backups then expire within 35 days, and we no longer restore from them. The organisation receives a signed statement that says when its data was deleted and when the last backup expires.
AI features
If the organisation switches them on, Unexus Connect can transcribe conversations, summarise them, recognise sentiment and keywords, and let a virtual assistant answer simple questions.
- These help staff; they do not make decisions about you. Whatever follows from a conversation is decided by people at the organisation.
- A summary is marked as made by AI and is checked by staff.
- You can always ask the virtual assistant for a person.
- It runs at Microsoft in the Netherlands, and your data is not used to train AI models.
We do not make decisions about you that are based only on automated processing, and we do not build profiles of you.
How we secure your data
Unexus is ISO 27001 certified. That is the international standard for information security. An independent party tests every year whether we live up to it. For the platform it means among other things: connections and stored data are encrypted, staff only get access when their work requires it and sign in with a second step, access to recordings is logged, and the platform is tested by an outside party. More about how we work is on security & compliance.
If something goes wrong with data on the platform, we tell the organisation without undue delay, so it can report it to the Dutch Data Protection Authority and inform you where needed. If it concerns the things we decide ourselves, we report it to the authority ourselves.
What you can ask
You have the right to know what is held about you, and to have it corrected or deleted. Concretely, you can ask to see it, correct it, delete it, limit its use, object to its use, take it with you in a common file format, and not be subject to decisions taken only by a computer.
About the data on the platform, go to the organisation. It is in charge, and it is the only one that knows the full picture: why it has your data, on which basis and for how long. Its privacy statement says how to ask. We help the organisation answer you.
Did you come to us anyway? Then we pass your question on to the organisation within 5 working days, and let you know we have done so. We do not act on it ourselves unless the organisation asks us to.
About what we decide ourselves, email privacy@unexus.nl. We answer within a month. To be sure we are talking to the right person, we may ask you to confirm something. We never ask for a copy of your identity document.
Not happy?
Do you think your data is not handled properly? Tell the organisation, or us if it concerns what we decide ourselves; usually it can be sorted out together. You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. If you live in another EU country, you may also go to the supervisory authority there.
If this statement changes
If we change the platform in a way that affects your data, or start working with another company, we update this statement. The date and version number are always at the top. Organisations that use Unexus Connect hear about a new company beforehand, as agreed with them.
Something unclear?
Email privacy@unexus.nl, and we will explain what it says.
