GDPR-compliant customer communication
Customer messages contain personal data: names, phone numbers, email addresses, order and complaint history. When those messages live on employees' personal phones or in mailboxes opened with a shared password, it becomes impossible to track who accessed what. Lonca brings customer communication into one permissioned, auditable place.
Why scattered tools are a risk
- Customer data stays on employees' personal phones and apps; when an employee leaves, the data leaves with them.
- In mailboxes shared through one password, nobody knows who read or deleted which message.
- When a data subject asks for access or erasure (GDPR Articles 15 and 17), finding where that person's data lives takes days.
Which technical measures does Lonca provide?
- Encryption: data is encrypted in transit (TLS) and at rest.
- Role- and channel-based permissions: you define which team member can see which inbox and channel.
- Immutable audit log: critical actions such as role changes, message deletion and channel access are written to a hash-chained log; you can verify it hasn't been silently altered.
- Customer history in one place: a person's messages, calls and tasks are gathered on a unified contact card, so you know where to look when a request comes in.
- Deletion requests: users can request account deletion from inside the app; data deletion instructions are published for connected Meta channels.
- Optional AI: AI features only run when your organization adds its own OpenAI or Anthropic key. Until then, messages are not sent to any AI provider.
What remains your organization's responsibility?
No software makes an organization GDPR-compliant on its own. Lonca provides technical security measures (GDPR Article 32). Controller obligations such as privacy notices, a lawful basis for processing, records of processing activities and a retention policy remain with your organization. We recommend working with your legal advisor or DPO on these.
Where is data transferred?
The payment provider (Paddle) and the AI providers your organization enables may be located outside your country. The scope of these transfers and their safeguards are described in the Privacy Policy.
Which plan?
Encryption, permissions and the audit log are included in every plan. The omnichannel inbox that gathers customer messages is part of Professional ($19 per user per month) and Enterprise ($39 per month). See the omnichannel inbox page for details.