Privacy notice for callers

Effective date: 6 November 2026

In accordance with Article 13 et seq. of the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), we provide you — as a person calling a Linca user's phone number — with this Information on Personal Data Processing, describing the conditions under which your personal data is processed.

Linca, the AI phone assistant, is a software application using artificial intelligence elements, provided by SLAI labs s.r.o. (hereinafter "SLAI labs"), which answers calls on behalf of the User. Linca conducts a conversation with you — the caller — on the User's phone number, records it, and generates a transcript and/or summary (hereinafter "Linca").

This enables the User to handle your requests as quickly and efficiently as possible.

If you are a Linca application User yourself, this Information does not apply to you. For information on how we process your data, please read the Information on Personal Data Processing for Users.

1. Who Is the Controller of Your Data

The controller of your data as a Caller is the User — the holder of the phone number.

Exception: for the purpose of reporting unsolicited and fraudulent calls to public phone-number databases, the controller is SLAI labs (contact details in section 2).

2. Who Is the Processor of Your Data

Linca is provided by SLAI labs, with registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, Company ID: 24010065, email: jiri@linca.io, which acts as the Processor of your data, except for the reporting of unsolicited and fraudulent calls (section 5, purpose 5), where it is the controller.

3. To Whom May Data Be Transferred

4. What Personal Data Is Processed

The following categories of your data are processed in order to provide Linca:

All summaries are automatically filtered using a dedicated security configuration that ensures special categories of data — such as health data, religious beliefs, or sexual orientation ("Special Categories of Personal Data") — are removed prior to the summary being stored.

Anonymised transcript: A version of the transcript that has been fully anonymised to remove personal data. This data cannot be linked back to you, is not personal data, and falls outside the scope of the GDPR and of this Information.

5. For What Purpose and on What Legal Basis Is Your Data Processed

Your data is processed for the following purposes:

1. Handling your call and requests
   • The content of your call is processed solely for the purpose of providing the User with a text summary of your call, enabling them to identify who called and why.
   • Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR); legitimate interest in communication and handling your request (Art. 6(1)(f) GDPR).
   • This includes checking your number in public phone-number databases on an incoming call and automated classification of the call, so that the User can recognise unsolicited calls. The classification itself has no legal or similarly significant effects. The User may switch on automatic blocking of calls from numbers assessed as unwanted. Legal basis: the User's legitimate interest (Art. 6(1)(f) GDPR).
2. Call recording and transcription
   • Linca conducts a conversation with you, records it, automatically generates a transcript and summary, and delivers the output to the User so they can complete your request (e.g. call you back, process an order, etc.).
   • Legal basis: legitimate interest in efficient communication and quality customer service, including the ability to verify the course of a call (Art. 6(1)(f) GDPR).
   • You are informed of this during the call.
3. Protecting the service and the User's rights
   • Handling complaints and disputes about a call, protecting system security, and preventing misuse (e.g. spam, fraudulent calls). We carry this out on behalf of the User as the Processor.
   • Legal basis: legitimate interest of the User (Art. 6(1)(f) GDPR).
   • Service improvement uses only the anonymised transcript, which is not personal data.
4. Compliance with legal obligations
   • In particular, retention of accounting records, record-keeping, and cooperation with public authorities.
   • Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
5. Protection against unsolicited and fraudulent calls (reporting to public databases)
   • The controller for this purpose is SLAI labs.
   • Phone numbers from which sales, marketing or fraudulent calls are made are passed, together with the call category and the day of the call, to operators of public phone-number databases that serve to protect against unsolicited calls. We do not pass on the content of the call, names or any data about the User. Current list of these operators: list of partners.
   • A report is created automatically from the call classification if the User has switched this on, or the User sends it manually. We automatically report only business and automated calls, not private calls.
   • Legal basis: the legitimate interest of Users and the public in protection against unsolicited and fraudulent calls, and the legitimate interest of SLAI labs in a reliable number check in Linca (Art. 6(1)(f) GDPR).

Legitimate interest (Art. 6(1)(f) GDPR) — For call summaries:

• User's legitimate interest: The User has a legitimate interest in efficiently screening and managing their incoming calls (e.g. protection against unsolicited marketing calls).
• Purpose: The content of your call is processed solely for the purpose of providing the User with a text summary of your call, enabling them to identify who called and why.
• Justification: Following a legitimate interest assessment, it is clear that this processing is necessary for the service and is balanced by a clear audio announcement and a simple opt-out option (hanging up) made available to you.
• It is necessary to ask "who is calling" and "why" because the User cannot effectively screen calls without both pieces of information.

6. Critical Safeguards

The following safeguards have been implemented to protect your privacy by design:

• Immediate audio deletion: Your voice (audio) is not stored — it is processed in real time in memory and immediately discarded.
• Temporary transcript deletion: The temporary transcript (which contains your personal data) is stored only for the few seconds required to generate the summary. It is permanently deleted immediately after the summary is generated.
• Anonymisation for service improvement: Immediately after the summary is generated, a fully anonymised version of the transcript is created. This anonymised data, which cannot be linked back to you, is used to improve the service.
• Sensitive data filtering: We automatically filter the Call Summary before it is stored. This filtering is designed to remove special categories of personal data that you may have inadvertently mentioned.

7. Transfer of Data Outside the EU

Your data may be processed outside the European Economic Area (EEA), including in the United States. The following legal safeguards are used to protect these international transfers:

• Transfers to ElevenLabs, Inc. in the USA are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to companies such as Google are covered by the EU–US Data Privacy Framework (DPF).
• Processing by ProfiSMS s.r.o. takes place within the European Union (Czech Republic).
• Reporting partners are established in the EU. Where their infrastructure providers process data outside the EEA, the transfer is protected by the DPF or by Standard Contractual Clauses (SCCs).

8. How Long Is Your Data Retained

9. Your Data Protection Rights

As a Caller, you have rights regarding your personal data.

Your primary right — the right to object — was provided to you in an audio message when you called the User and your call was answered by Linca, which played the following (or similar) audio message: "This is the AI assistant [USER'S NAME] from Linca. Who is calling and why?"

By hanging up at any point during this message, you exercise your right to object (Article 21 GDPR), and we will cease all processing of your personal data related to that call. Continuing the conversation after this announcement constitutes voluntary acknowledgement that you accept the data processing described in this notice.

You also have the following rights:

• Right of access: You may request confirmation of what personal data is held about you (e.g. your phone number and any associated summaries).
• Right to erasure (deletion): You may request that we delete the call summary associated with your phone number from the User's account.
• Right to object: If you did not hang up but wish to object retrospectively, you may contact us and request deletion of your data. You may object to reporting to public databases at any time by email to jiri@linca.io stating your number. We honour it: we stop reporting the number and arrange withdrawal of the reports at partners.
• Right to withdraw consent: For a one-time SMS message to which you consented, you may withdraw that consent at any time (although this will not affect the lawfulness of the SMS already sent).
• Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority.

To exercise any of these rights, please contact the data controller or processor directly at jiri@linca.io.

For verification purposes, you may be required to provide the phone number you used to make the call, the date and time of the call, and the User's number you called.

You may lodge a complaint with the supervisory authority in the Czech Republic: Úřad pro ochranu osobních údajů (ÚOOÚ) (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic (www.uoou.cz, posta@uoou.cz).

10. Updates to This Policy

This Information on Personal Data Processing may be updated to reflect changes to Linca or applicable legislation.

The latest version will always be available at this URL. We recommend checking this page periodically if you frequently call Linca Users.

Change History

• v3.0 (6 November 2026): SLAI labs is the controller for reporting unsolicited and fraudulent calls to public databases; new category of recipients and list of partners; automated call classification and number check; procedure for objection and withdrawal of reports
• v2.0 (9 June 2026): Data updates and improved wording for clarity
• v1.0 (1 December 2025): First publication of the standalone Information on Personal Data Processing for Callers