When you trust us with your customers, you trust us with their personal data. Data protection is built into how we set up, run and close every programme — in line with the EU General Data Protection Regulation.
Under the GDPR, every party in the chain has its own responsibilities. Knowing who does what is the starting point of every partnership.
ETB as processor
When we handle your customers' data, you remain the controller. We process personal data only on your documented instructions, under a Data Processing Agreement in line with Article 28 GDPR.
ETB as controller
For our own employees, candidates and business contacts we are the controller — with our own privacy statement, legal bases and retention rules.
Agents only see what they need, systems only keep what they must, and every programme starts with privacy — not ends with it.
The obligations of a GDPR-compliant outsourcing partner — and how we meet them, from the contract to the contact floor.
Data Processing Agreement
Every programme starts with a DPA: subject matter, duration, categories of data and data subjects, confidentiality, assistance duties, audit rights and return or deletion at the end of the contract.
Lawful international transfers
Where teams work outside the EEA, transfers are covered by the European Commission's Standard Contractual Clauses, supported by a transfer impact assessment and supplementary technical measures.
Security of processing
An ISO/IEC 27001 information security management system: role-based access, multi-factor authentication, encryption in transit and at rest, logging, vulnerability management and regular testing.
Privacy management system
Privacy controls mapped to GDPR and audited externally, with records of processing activities kept for every client programme.
Secure production floor
Badge-controlled access, a clean-desk policy and restrictions on personal devices and paper where agents work with customer data.
Minimisation & retention
Agents see only the data they need for the task. Retention periods are agreed per client, and data is securely deleted or returned when they expire.
Data subject rights
Requests for access, rectification, erasure, restriction or objection that reach our teams are recognised, logged and passed to you promptly — and we help you answer them within the legal deadline.
Breach management
A documented incident response process: we notify you without undue delay and provide the facts you need to meet the 72-hour notification duty to the supervisory authority.
Sub-processors
No sub-processor without your prior authorisation. The same data protection obligations flow down to every party in the chain.
Trained, bound people
Every employee signs a confidentiality agreement and completes privacy and security training at onboarding, refreshed periodically.
Call recording & payment data
Calls are recorded only on your instruction and with proper notice to the caller. Card data is kept out of recordings and notes.
Privacy by design & DPIA
Privacy is built into every new programme by default, and we support you with the information needed for a data protection impact assessment.
Due diligence
Security and privacy questionnaire, certificates and the DPA agreed before any data is shared.
Transfer assessment
Data flows mapped, SCCs signed and a transfer impact assessment completed where needed.
Secure set-up
Access rights, systems and training configured per programme on a need-to-know basis.
Monitoring & audit
Access reviews, logging, internal audits and external ISO audits — with your audit rights respected.
Return & deletion
At the end of the contract, data is returned or securely deleted, and deletion is confirmed in writing.
Our information security and privacy information management systems are certified against ISO/IEC 27001 and ISO/IEC 27701.
27001
Information security
27701
Privacy information management
Compliance pack
Available on request
- Data Processing Agreement
- Overview of technical and organisational measures
- List of sub-processors
- ISO/IEC 27001 and 27701 certificates
- Support with your DPIA and transfer impact assessment
- Completion of your security and privacy questionnaire
Policies
This page describes our general approach. The binding commitments for each client are set out in the Data Processing Agreement. For personal data ETB processes as controller, see our privacy statement.
Talk to us about DPAs, international transfers, security questionnaires or a data protection impact assessment.