1. Controller and processor roles
For website enquiries and Valenero's own business administration, Valenero normally acts as a controller. For caller and customer information handled solely to operate a client's configured answering service, the client will normally be the controller and Valenero will act as its processor.
The client determines what types of calls Valenero handles, what information should be collected, what booking and escalation rules apply and how the resulting information is used in the client's business.
2. Documented instructions
When acting as a processor, Valenero processes personal information only to deliver and support the agreed service and in line with the client's documented instructions, unless applicable law requires otherwise. Instructions may be recorded in an onboarding form, proposal, workflow configuration, email or other written form capable of being retained.
3. Confidentiality
People authorised to access client personal information are expected to treat it as confidential and only access what they need for their role. Credentials and administrative access should not be shared unnecessarily.
4. Security measures
Valenero uses reasonable measures appropriate to the service, which may include encrypted connections, access controls, restricted credentials, minimisation of stored data, separation of client configurations, logging and backup controls. Security measures are reviewed as the service architecture changes.
Clients must also protect their own connected accounts, calendars, telephone systems and credentials and must notify Valenero promptly if they believe an account or integration has been compromised.
5. Subprocessors and infrastructure
Valenero may use specialist providers to deliver the service. Depending on the configuration, subprocessors or supporting providers may include:
- Netlify — website hosting and website-form infrastructure;
- ElevenLabs — voice-agent infrastructure where configured;
- n8n — workflow automation where configured;
- Google — calendar or productivity services where connected;
- Stripe — billing and payment processing when enabled;
- telephony, SMS and email providers — call routing and customer/client communications.
The exact provider set can change as the service develops. Where Valenero appoints a subprocessor to process client personal information, Valenero will use appropriate contractual arrangements and remains responsible for its processor obligations to the client.
6. International processing
Some providers may process information outside the UK. Where a restricted transfer applies, Valenero will use or rely on an appropriate legal mechanism for the transfer as required by applicable law and the relevant provider arrangement.
7. Data-subject requests and incidents
Where Valenero receives a request relating to personal information processed on behalf of a client, Valenero will direct the request to the client or assist the client as reasonably required. Valenero will also provide reasonable assistance with relevant security incidents, regulatory enquiries or data-protection impact work relating to the service.
8. End of the service
On termination, Valenero will delete or return client personal information in accordance with the client's instructions and the service agreement, except where law requires retention. Residual copies may remain temporarily in secure backup systems until they are overwritten through normal backup cycles.
9. Client-specific data processing terms
Clients who require a signed controller-processor agreement, documented retention schedule, provider list or security information can request it from cody@valenero.co.
Client-specific processing terms and a signed controller-processor agreement can be provided where required for the account.