Who is responsible for what
Under UK GDPR your business is the controller of caller data and the AI platform is a processor. You need a lawful basis (usually legitimate interests for handling enquiries and contract for bookings), a privacy notice that mentions the AI and recording, and a data processing agreement with the provider that lists its sub-processors (telephony, speech and language model providers, hosting).
Call recording and consent
Recording business calls is lawful in the UK with a clear notice — "calls are recorded for quality and training" — and a lawful basis; explicit consent is not normally required for ordinary enquiries. The agent should play the notice at the start, and you should be able to turn recording off per channel or for specific call types.
Controls to look for
- Automatic redaction of card numbers and other sensitive details in transcripts and recordings
- Retention you set (e.g. 30, 90, 365 days) with automatic deletion
- Export and delete a caller's data on request, in one action
- Role-based access, two-factor authentication and an audit log
- UK/EU hosting with encrypted storage and backups
- Named AI providers and a statement that your data isn't used to train their models
Payments and PCI
Card details should never be read out to or stored by the agent. The compliant pattern is a hosted payment link sent by text, so the card is entered on the payment provider's page and never touches the phone platform.
Practical steps
Update your privacy notice to mention the AI assistant and recording, sign the provider's DPA, set retention, decide what is redacted, and keep a record of your lawful basis. Ask the provider for their security assurance statement and sub-processor list — a serious one will have both ready.
Common questions
Do callers have to consent to speaking with an AI?
No specific consent is required in the UK, but transparency is expected: tell them it's an AI and that calls are recorded.
Where is ParlioTec data hosted?
In the UK/EU on encrypted infrastructure, with recordings in UK object storage and nightly encrypted backups. Details are on our Security page.
Is ParlioTec ICO-registered?
Yes — registration 00015465911, shown on our Privacy policy.
Free guide: The AI Advantage
How UK SMEs are putting AI to work across phones, email and messaging without hiring — practical, not hype.