1. Controller

Robotic Automation Solutions UG (haftungsbeschränkt)
Schellingstr. 109a
80798 München, Germany
Email: datenschutz@ras.solutions

2. Our role: controller and processor

Ejra is a business (B2B) platform for AI-powered phone and chat communication. For the operation of this website and the customer portal, and for our customers' contract, account and billing data, Robotic Automation Solutions UG (haftungsbeschränkt) is the controller within the meaning of the GDPR.

Where our customers use Ejra to process personal data of their own end customers (e.g. call data, transcripts, chat histories, appointment bookings), the respective customer is the controller; we process such data exclusively as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement (DPA). We provide a DPA to every customer — please contact datenschutz@ras.solutions.

3. Hosting and server log files

When you access our website and portal, our server automatically processes technical access data (IP address, date and time, page accessed, browser type and operating system). This data is required for secure and stable operation and is not combined with other data sources. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest). Log data is deleted as soon as it is no longer required for this purpose.

4. Cookies

We only use technically necessary cookies — no marketing or tracking cookies.

Storing and reading these cookies is permitted under Sec. 25 (2) of the German TDDDG, as they are strictly necessary for the service you use; the associated data processing is based on Art. 6 (1) (b) and (f) GDPR.

5. Registration and customer account

When you register for and use a customer account, we process master and contact data (name, business email address, company details, roles and permissions), security data (e.g. password hash, multi-factor settings, passkeys) as well as billing and usage data. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR for statutory retention obligations.

6. Contact form

If you contact us via the contact form, we process your details (name, email address, message) to handle your enquiry (Art. 6 (1) (b) or (f) GDPR). To protect against automated abuse, we use a bot-protection service operated by an external provider; it checks technical characteristics of your browser without performing advertising tracking. Your message is delivered to us via a cloud service provider.

7. Data processing within the Ejra platform (voice and chat)

In operating the platform — depending on the configuration chosen by the respective customer — the following data in particular is processed: phone numbers and connection data, audio data during calls, transcripts, chat histories, appointment and enquiry data, as well as log and quality data. This processing is carried out on behalf of and under the instructions of our customer (Art. 28 GDPR); the controller is the customer whose phone or chat service you use. For information about a specific call or chat, please first contact the respective company.

8. Recipients and processors

To deliver our services, we use carefully selected service providers in the following areas:

• Cloud hosting and infrastructure
• AI language models; inputs are not used by the provider to train the models
• Speech recognition (speech-to-text) and speech synthesis (text-to-speech)
• Telephony infrastructure (call setup, phone numbers, media streams)
• Bot and abuse protection for public forms
• Delivery of system and notification emails

Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers. We provide customers with an up-to-date list of sub-processors on request.

9. Data transfers to third countries

Some of our service providers process data (also) in third countries, in particular in the USA. Transfers are based on an adequacy decision (EU-U.S. Data Privacy Framework) or on the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR, supplemented by technical safeguards such as transport encryption.

10. Retention periods

We store personal data only for as long as necessary for the purposes described. For platform content data, the respective customer, as controller, sets the retention period in its organisation settings. In detail:

• Account and contract data: for the duration of the contractual relationship and subsequently within the scope of statutory retention obligations (generally six to ten years under German commercial and tax law).
• Email content: the message body is removed automatically after the period set by the customer, once the matter has been settled. Header data (sender, subject, date) and a short preview are deleted after a separate period configurable by the customer.
• Automation logs: step logs and intermediate state of workflow runs are redacted after the period set by the customer.
• Calls, transcripts and chat conversations: the customer sets the retention period in its organisation settings. Once the period elapses, the wording is deleted automatically – for calls, the call data (time, duration, outcome) and the consent record are kept, while chat conversations are deleted in full. The customer can delete this data earlier in the application at any time. If a caller declines consent to the transcript, the wording produced up to that point is deleted immediately; only the record of the refusal is kept. No audio recording of calls is created or stored.
• Tickets and audit logs: deleted automatically once the period set by the customer elapses; the customer can delete them earlier in the application at any time.
• Server and application logs: deleted automatically on a regular basis once they are no longer required for secure operation.

Once the period has elapsed, or after deletion by the customer, the data is removed from the database or anonymised. Where statutory retention obligations prevent deletion, processing is restricted instead (Art. 18 GDPR).

11. Your rights

You have the right, vis-à-vis the respective controller, to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on Art. 6 (1) (f) GDPR pursuant to Art. 21 GDPR; you may withdraw any consent you have given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach, Germany.

12. Data security

We protect your data with state-of-the-art measures, in particular transport encryption (TLS), encryption of stored credentials and secrets, role-based access controls, tenant isolation and logging of security-relevant events.

13. Changes to this privacy policy

We update this privacy policy when our services or the legal situation change. The version published here applies.

14. Contact

For privacy enquiries, you can reach us at: datenschutz@ras.solutions