Privacy Notice for Recorded Persons

Ponora International GmbH

Information pursuant to Art. 14 GDPR for persons whose voice, conversation content or other personal data is recorded or processed by Ponora users.

1. Who Is the Controller?

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ponora International GmbH
Hammfelddamm 4 A
41460 Neuss
Germany
Email: support@ponora.ai
Website: https://ponora.ai

Currently, no data protection officer has been appointed. Data protection requests can be sent to support@ponora.ai.

2. Why are you receiving this information?

This information is intended for people who do not have to be Ponora users themselves, but whose voice or conversation content is contained in a recording created, uploaded, transcribed, summarized, shared or otherwise processed by a Ponora user.

In this case, the personal data usually does not come directly from you, but from the person or organization that created the recording or transmitted it to Ponora.

3. What data may be affected?

• Voice and spoken content in audio recordings;
• Transcripts and text content derived therefrom;
• Technical speaker labels used to distinguish between speakers;
• Summaries, notes, highlighted key messages or tasks, if they relate to you;
• Metadata associated with the recording or processing, such as timing, file name or technical processing information;
• Special categories of personal data within the meaning of Art. 9 GDPR, provided that such information is mentioned in the conversation or becomes recognizable from it.

Ponora does not create or use a database of voice profiles to identify individuals; no identification based on biometric voice characteristics takes place. Voice samples used briefly for technical speaker assignment are deleted immediately after the processing operation is completed or fails; the assignment results (section identifiers, technical speaker labels, time windows, confidence values) are stored as metadata for the recording and deleted with it.

4. For what purposes can the data be processed?

• Provision of the recording, upload, transcription and summary functions requested by the Ponora user;
• Technical speaker diarisation and assignment of contributions to the conversation;
• Provision of search, export, sharing or similar functions, if the user activates them;
• Transcripts and notes, as well as other AI analyses initiated by the user (title suggestions, mind maps, tasks, keywords, cross-recording context notes);
• Provision of shared content via a sharing link; transcript sections, summaries, tasks and participant details may be accessible to recipients without a Ponora account, and access is logged with IP address and user agent.
• Security, error diagnosis and abuse prevention, insofar as this is required and legally permissible;
• Fulfillment of legal obligations and processing of data subject requests.

Ponora does not currently use audio recordings and transcripts to train generally available AI models.

5. On what legal basis does the processing take place?

The specific legal basis depends on the context in which the recording was made and on Ponora’s role in the processing concerned. For corporate customers, the customer may be the controller for the content and purposes of the recording, while Ponora may process the data on the customer’s behalf. For private users, the legal classification may differ depending on the circumstances of use.

Where special categories of personal data are involved, an additional exception under Art. 9(2) GDPR must apply. Legal responsibility for the recording itself and for obtaining any required consent or other legal basis does not rest solely with Ponora; the person or organisation making the recording must also comply with the applicable statutory requirements.

6. Which service providers can be involved?

Depending on the activated function, the following service providers may be involved in the processing:

• Google Cloud Platform for the primary cloud infrastructure;
• Microsoft Azure Speech for speech recognition and speaker separation;
• Anthropic Claude and Google Gemini via Google Vertex AI (region europe-west1, European Union) for AI-supported summaries and further text analyses;
• Mailgun (EU endpoint) for transactional emails and support communication; Google Firebase Cloud Messaging for push notifications (transfer to Google LLC, USA, based on the standard contractual clauses (EU) 2021/914); IONOS (Frankfurt am Main) for object storage and backups.

Ponora's primary Google Cloud infrastructure is located in the europe-west3 region (Frankfurt am Main). Azure Speech is used in the Germany West Central region (Germany). Claude and Gemini are accessed via Vertex AI in the europe-west1 region (European Union). For message processing (Google Cloud Pub/Sub), storage outside the European Union cannot currently be excluded; in this case, the transfer relies on the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914).

Further information on recipients, processors and any international data transfers can be found in Ponora's privacy policy.

7. How long will the data be stored?

The retention period depends on the relevant function, the Ponora user’s settings and statutory retention obligations. Persistently stored User Content is generally retained until the user deletes it, terminates their Account or contract, or retention is no longer necessary for the relevant purpose, unless statutory obligations require otherwise.

Temporary audio files for technical speaker assignment are deleted immediately after processing is completed or fails. Logs concerning use of AI functions and system and security logs are retained and subsequently deleted or anonymised.

Details of storage and erasure periods, backups and log data can be found in Ponora’s current Privacy Policy.

8. What rights do you have?

If Ponora processes personal data concerning you, you may, in particular and subject to the statutory requirements, have the following rights:

• Access to personal data concerning you;
• Rectification of inaccurate data;
• Erasure, unless precluded by statutory grounds;
• Restriction of processing;
• Data portability, insofar as the legal requirements are met;
• Objection to certain processing;
• Withdrawal of consent with effect for the future;
• Complaint to a data protection supervisory authority.

9. How can you exercise your rights if you do not have a Ponora account?

You do not need a Ponora account to make a privacy request. Write to support@ponora.ai and describe as specifically as possible which recording, which conversation, which period or which Ponora user your request relates to.

To protect everyone involved in the conversation, Ponora may request appropriate proof of your identity or additional information where necessary to prevent content from being disclosed to unauthorised persons or erased without authority.

Depending on the case, Ponora may work with the user or corporate customer who provided the recording when processing a request. Legal restrictions and rights of other participants will be taken into account.

10. What Should You Do If You Do Not Wish to Be Recorded?

If possible, tell the person making the recording before or during the recording that you do not consent to being recorded or to further processing. Whether recording is lawful without your consent depends on the specific circumstances and the applicable law.

In Germany, the unauthorised recording of the non-publicly spoken word may, in particular, be punishable under section 201 StGB. Ponora does not replace the individual legal assessment that must be made by the user or the organisation acting as controller.

11. Automated decisions

Within the standard functions described, Ponora does not make decisions concerning recorded persons based solely on automated processing that produce legal effects or similarly significantly affect them.

12. Changes and further information

This Privacy Notice may be amended if functions, data flows, service providers or legal requirements change. The version published at the relevant time shall apply.

Further information can be found in Ponora's general privacy policy at https://ponora.ai/privacy.

Contact

Ponora International GmbH
Hammfelddamm 4 A
41460 Neuss
Germany
Email: support@ponora.ai