UK GDPR
Yes, if callers are told what is answering them, the provider handles their details under written terms, and anything sent abroad has a safeguard. This page sets out exactly how While You Work does each of those, so you can check it before you switch on.
Who is responsible
When your receptionist takes a message, the caller’s details belong to your business. You decide why they are collected, which makes you the controller. We handle them on your behalf as your processor, under our data processing terms, which form part of every account.
Vitesse Digital Ltd, the company behind While You Work, is registered with the Information Commissioner’s Office under number ZC246746. We carried out a data protection impact assessment in September 2026, because AI handling recorded calls is on the ICO’s list of processing likely to be high risk.
What callers hear
Every greeting gives the business name, says the caller is speaking to an automated assistant and says calls are recorded, then asks their name. If a caller asks whether it is a real person, it says plainly that it is the automated assistant for your business.
If someone does not want to be recorded, the receptionist apologises, explains the recording is only there so the message reaches you accurately, and offers to take just a name and number. If they ask how their details are used, it tells them and points them to our privacy notice.
Retention
| Data | How it is kept |
|---|---|
| Call recordings | Deleted after 30 days, or sooner if you delete them. Played only through private links that expire. |
| Transcripts and call details | Deleted after 12 months, or sooner if you delete them. |
| Database backups | Encrypted with AES-256. Kept on the server for 14 days and in a separate London store that deletes them after 90 days. |
| Error reports | Personal data is removed before a report leaves our server. |
| Card details | Never taken on a call. With diary booking on Business, deposits go through your own payment link by text. |
Transfers
Our own systems are in London. The voice and AI processing that makes the receptionist work happens in the United States, under the safeguards UK law approves for that.
| What | Where | Safeguard |
|---|---|---|
| Our application and database | London, United Kingdom | Not needed, the data stays in the UK |
| The voice platform (speech, recordings, transcripts) | United States | UK Addendum to the EU Standard Contractual Clauses |
| The AI language model | United States | UK Addendum to the EU Standard Contractual Clauses |
| Phone numbers, call routing and texts | United States and Ireland | UK Extension to the EU-US Data Privacy Framework |
| Sending and receiving email | European Union | UK adequacy regulations for the EEA |
The full list is on our sub-processors page. We email customers at least 30 days before we add or replace a provider, and we send the name of any provider within two working days if you ask.
Callers’ rights
A caller can ask your business for a copy of what was recorded, or for it to be deleted. Forward the request to us and we will provide or delete the recording, transcript and messages so you can answer within the legal time limit. If a caller contacts us directly, we pass the request to you, because you are the controller.
Questions
An AI receptionist can be used under UK GDPR if callers are told they are speaking to an automated assistant and that the call is recorded, the provider works as your processor under written terms, and transfers outside the UK have an approved safeguard. While You Work does all three: the greeting says it, our data processing terms are part of every account, and each provider is listed with its safeguard on our sub-processors page.
You are. Your business decides why callers’ details are collected, so you are the controller. While You Work is your processor and only uses the details to answer the call and pass them to you.
Yes. Every While You Work greeting says the caller is speaking to an automated assistant and that calls are recorded, before it asks anything else. A caller who does not want to be recorded is offered a quick way to leave just a name and number.
Our application, database and backups are hosted in London. Speech recognition and the AI that understands the call run in the United States under the UK Addendum to the EU Standard Contractual Clauses. The sub-processors page lists every provider, where it works and the safeguard.
Our data processing terms commit us to telling you without undue delay, and in any case within 48 hours of becoming aware, with the information you need for your own reporting.
It is worth adding a line saying calls you cannot answer may be taken by an automated assistant and recorded so you can call back. Callers who ask the receptionist how their details are used are told, and pointed to our privacy notice.
Ring our own receptionist on 01202 144997 and listen to the greeting, or read how the AI receptionist works. Plans from £39 a month plus VAT.