Is an AI receptionist
GDPR compliant?
That depends on how the service is set up, not on the fact that it uses AI. With FirstReach you are the controller and we are your processor, under a data processing addendum written to Article 28 UK GDPR that forms part of our standard terms. Callers are told at the start of every call that they are speaking to an automated assistant and that the call is transcribed.
Three roles, set out in the contract.
You are the controller
Your callers are your customers. You decide what the assistant may do with their data and for what purposes, and your privacy notice covers it.
We are your processor
We act only on your documented instructions under a data processing addendum that meets Article 28 UK GDPR. It is part of our standard terms.
Our providers are sub-processors
Speech recognition, the voice, the language model and the phone line each come from a named provider. The list is published, with where each one is based and which agreement covers it.
Each of these is a term of the addendum, not a promise on a page.
- No model training on your callers' data.
- Encryption in transit and at rest.
- Access limited to people who need it, protected by multi-factor authentication, logged and reviewed.
- Each client's data and configuration logically separated from every other client's.
- Retention you set, and data returned or deleted within 30 days of the end of the contract.
Including us. Ask these before you sign anything.
- Are you a controller or a processor for my callers' data, and is there an Article 28 addendum in the contract?
- Which sub-processors do you use, where are they based, and what covers a transfer outside the UK?
- Is the caller told they are speaking to an automated assistant, and when?
- Is call audio kept, and for how long? Is it separate from the transcript?
- Is any of it used to train a model, and can you point to the term that says so?
- Who on your side can read a transcript, and is that access logged?
- What happens to everything when I leave?
Where the full answer lives.
- Our security and privacy page sets out the path of a call, every sub-processor and the retention defaults.
- The addendum itself comes with your contract, with the sub-processor list attached. Ask us for it before you commit to anything.
- Our privacy policy covers what happens when you phone or email us directly.
See it answer your phone.
Book a 20-minute consultation. We map your workflow, preview a persona built for your business and show you what a pilot would look like.