When does it happen, who receives text messages, and how does Twilio process and store personal data associated with the transmission of personal data?
Data processing activities using Twilio for processing text messages with AskCody
What is it?
The Visitor Management module of the AskCody platform transmits text messages (SMS) to Meeting Hosts and Visitors using Twilio Programmable SMS from twilio.com, a cloud communications platform that provides messaging capabilities for web and mobile applications such as AskCody.
Who does this apply to?
Text messages (SMS notifications) from the AskCody platform are only sent to Meeting Hosts and/or a Visitors, if the customer (Controller) is using the Visitor Management component of our AskCody platform. Therefore, using Twilio as a sub-processor to AskCody and using Twilio to process data on behalf of the customer (and AskCody) only applies to customers using the AskCody Visitor Management module and customers who have enabled SMS notfications for Meeting Hosts and/or Visitors.
When does Twilio process data?
For meetings scheduled with AskCody, with attendees being pre-registered to a meeting using the AskCody Visitor Management Add-in for Outlook and Office 365, where the users mobile phone number is included as part of the information being registered on the Visitor/Attendee, that person will receive a text message related to their meeting. This, either before they arrive at the Reception, or when they check in on the Check-in Screen at the Reception. In this case, Twilio is used to send the SMS notification to that visitor/attendee, and therefore process data about that visitor/attendee.
The Meeting Host will receive a text message when the Visitor checks in on the Check-in Screen at the Reception if a Meeting Hosts mobile phone number, is included as part of the information stored on the contact person (user in AskCody). A Meeting Host can also receive a text message if a delivery to that host is handed off at the Reception and a Meeting Host in registered in AskCody, as a contact person for deliveries.
Requirements for SMS notifications to be send
For such text messages (SMS notifications) to be sent, several criteria must be fulfilled:
- A Meeting Host can only receive text messages if SMS notifications are enabled for that Host in the Management Portal.
- A Meeting Host can receive text messages in case a delivery is made to the Reception only if ”Contact person for delivery” is enabled for the host in the Management Portal.
- A Meeting Host can receive text messages in case of unexpected visits to the Reception only if ”Contact person for unexpected visits” is enabled for that Host in the Management Portal.
- A Visitor can receive text messages only if a mobile number is registered for that Visitor. A Receptionist can register a mobile number for a Visitor when pre-registering (adding) that Visitor in the AskCody Management Portal. A Visitor can also add a mobile number directly on the check-in screen when arriving at the Reception, if the Mobile field on the AskCody Visitor Management Check-In Screen Configuration used for that specific Check-In Screen is set to either Optional or Required in the Admin Center.
How is data transferred and processed?
When transmitting text messages using Twilio Programmable SMS, the Visitor Management component of the AskCody platform transfers the text messages and the phone number in question to Twilio, for Twilio to process. The data transfer takes place using secure communication encrypted through Transport Layer Security v1.2+, commonly referred to at HTTPS over TLS.
The data transferred to Twilio for Twilio to process is:
- Phone number
- Body of SMS (text string managed by the customer)
- If configured by the customer, the body text can contain the visitors name or other contact The body text is entirely managed by the customer (Controller)
Once Twilio has transmitted the text message, Twilio logs information about the transmission for a period of time, including the body of text and the phone number in their Programmable SMS API logs. The body of text, including any personal data it might contain, is deleted from Twilio’s Programmable SMS API logs after 60 days. The phone number is deleted from Twilio’s Programmable SMS API logs after 150 days. So, 150 days after Twilio has sent a text message on behalf of AskCody, Twilio’s Programmable SMS API logs no longer contains personal data about that text message.