Data processing

When an organisation enrols participants, the organisation is the controller and Kompis is the processor. When an individual signs up directly with us, Kompis is the controller.

Contact details needed to give a person access, the conversations they have with Kompis, and survey responses where a programme includes measurement. No raw audio files are retained.

Participant data is stored within the EU/EEA. Processing is a separate question: speech-to-text and language-model requests are handled by third-party providers, some of which process data outside the EEA. Those transfers rely on Standard Contractual Clauses, and we state which provider handles which step in writing.

We use a small set of sub-processors for hosting, speech processing and language models. The current list, including each one's processing location, is provided in writing with the data processing agreement, and we notify controllers before it changes.

Data is kept for the duration of the programme plus three months, then deleted or anonymised. A participant or a controller can request deletion at any time. We remove the data from the live service promptly, and it disappears from encrypted backups within 30 days as those backups roll over.

Organisations receive participation and outcome figures at group level. An employer or a kommun never receives an individual participant's conversations.

We do not use conversations as training data. Our providers are used under API terms and settings that exclude submitted data from their model training. We confirm the applicable vendor terms in writing on request.

If we become aware of a personal data breach we notify the controller without undue delay and provide what we know, what is affected and what we are doing about it.