UK GDPR
Can you use an AI receptionist under UK GDPR?
Yes, if callers are told what is answering them, the provider handles their details under written terms, and anything sent abroad has a safeguard. This page sets out exactly how While You Work does each of those, so you can check it before you switch on.
Who is responsible
You are the controller, we are your processor
When your virtual receptionist takes a message, the caller’s details belong to your business. You decide why they are collected, which makes you the controller. We handle them on your behalf as your processor, under our data processing terms, which form part of every account.
Vitesse Digital Ltd, the company behind While You Work, is registered with the Information Commissioner’s Office under number ZC246746. We carried out a data protection impact assessment in September 2026, because AI handling recorded calls is on the ICO’s list of processing likely to be high risk.
What callers hear
Callers are told before they say anything personal
Every greeting gives the business name, says the caller is speaking to an automated assistant and says calls are recorded, then asks their name. If a caller asks whether it is a real person, it says plainly that it is the automated assistant for your business.
If someone does not want to be recorded, the receptionist apologises, explains the recording is only there so the message reaches you accurately, and offers to take just a name and number. If they ask how their details are used, it tells them and points them to our privacy notice.
Retention
What is kept, and for how long
| Data | How it is kept |
|---|---|
| Call recordings | Deleted after 30 days, or sooner if you delete them. Played only through private links that expire. |
| Transcripts and call details | Deleted after 12 months, or sooner if you delete them. |
| Database backups | Encrypted with AES-256. Kept on the server for 14 days and in a separate London store that deletes them after 90 days. |
| Error reports | Personal data is removed before a report leaves our server. |
| Card details | Never taken on a call. With diary booking on Business, deposits go through your own payment link by text. |
Transfers
Where callers’ data goes
Our own systems are in London. The voice and AI processing that makes the receptionist work happens in the United States, under the safeguards UK law approves for that.
| What | Where | Safeguard |
|---|---|---|
| Our application and database | London, United Kingdom | Not needed, the data stays in the UK |
| The voice platform (speech, recordings, transcripts) | United States | UK Addendum to the EU Standard Contractual Clauses |
| The AI language model | United States | UK Addendum to the EU Standard Contractual Clauses |
| Phone numbers, call routing and texts | United States and Ireland | UK Extension to the EU-US Data Privacy Framework |
| Sending and receiving email | European Union | UK adequacy regulations for the EEA |
The full list is on our sub-processors page. We email customers at least 30 days before we add or replace a provider, and we send the name of any provider within two working days if you ask.
Callers’ rights
If a caller asks for their data
A caller can ask your business for a copy of what was recorded, or for it to be deleted. Forward the request to us and we will provide or delete the recording, transcript and messages so you can answer within the legal time limit. If a caller contacts us directly, we pass the request to you, because you are the controller.
Questions
AI receptionist and GDPR FAQs
Is an AI receptionist GDPR compliant?
An AI receptionist can be used under UK GDPR if callers are told they are speaking to an automated assistant and that the call is recorded, the provider works as your processor under written terms, and transfers outside the UK have an approved safeguard. While You Work does all three: the greeting says it, our data processing terms are part of every account, and each provider is listed with its safeguard on our sub-processors page.
Who is the data controller when an AI receptionist answers my calls?
You are. Your business decides why callers’ details are collected, so you are the controller. While You Work is your processor and only uses the details to answer the call and pass them to you.
Do callers have to be told the call is recorded?
Yes. Every While You Work greeting says the caller is speaking to an automated assistant and that calls are recorded, before it asks anything else. A caller who does not want to be recorded is offered a quick way to leave just a name and number.
Where is the data stored?
Our application, database and backups are hosted in London. Speech recognition and the AI that understands the call run in the United States under the UK Addendum to the EU Standard Contractual Clauses. The sub-processors page lists every provider, where it works and the safeguard.
What happens if there is a data breach?
Our data processing terms commit us to telling you without undue delay, and in any case within 48 hours of becoming aware, with the information you need for your own reporting.
Do I need to change my privacy notice?
It is worth adding a line saying calls you cannot answer may be taken by an automated assistant and recorded so you can call back. Callers who ask the receptionist how their details are used are told, and pointed to our privacy notice.
See how a call sounds first
Ring our own receptionist on 01202 144997 and listen to the greeting, or read how the AI receptionist works. Plans from £39 a month plus VAT.