Call Recording, Transcription and AI — How We Process Calls

1. What we do

Where a customer switches on our AI call-intelligence services (transcribed and Call IQ) for a number, calls on that number may be recorded, transcribed and analysed to provide the service. The analysis uses AI models to produce a transcript, a summary and call signals — for example the category of the call, its outcome, whether it was resolved, and caller-mood indicators. The results are delivered to the customer for their own call records, quality review and compliance purposes — by email, in the Call IQ portal, as alerts, by webhook to their CRM, or through MCP/API access that the customer connects to its own systems or AI agents.

Recording and transcription apply only to numbers where the customer has enabled the feature, and only to calls made after it was switched on.

2. Where the processing happens

Call content is transcribed and analysed only by AI models running on NumberGroup's own infrastructure:

• our servers, transcription computers and call databases are in a datacentre in Douglas, Isle of Man; and
• audio recordings are encrypted before they are uploaded to storage with Cloudflare R2 in Western Europe (EEA), so the stored files cannot be listened to without our keys.

The Isle of Man is not part of the UK, but it is recognised as giving adequate protection for personal data under both UK adequacy regulations and an EU adequacy decision. Details, and every supplier we use, are in our Privacy Policy and Sub-processors list.

Separately from call processing, we use some third-party AI suppliers for internal workflows such as drafting support responses; these are listed on the same page and are not used to analyse call content.

We also learn from processing, in a de-identified and aggregated form — for example, general rules about how calls of a certain kind tend to go — to improve our services. These learnings do not identify anyone and contain no call content.

3. Who is responsible for what

Two organisations have defined roles under UK GDPR:

• The customer is the data controllerfor the recordings, transcripts, summaries and call signals produced on their numbers. The customer decides which numbers are enabled, what the outputs are used for, and is responsible for telling its callers that calls are recorded and analysed. Datazero Ltd processes that data as the customer's processor, under the Data Processing Addendum.
• Datazero Ltd is the data controller only for processing it carries out for its own purposes: billing and network operation, and fraud-prevention and security processing — for example detecting fraudulent, abusive or repeat nuisance calls on the network — and for the voice fingerprints described in section 5.

4. Lawful bases

For the processing Datazero Ltd carries out as controller, we rely on legitimate interests (UK GDPR Article 6(1)(f)) — providing and securing the service and preventing fraud — and on legal obligation where regulation requires it. Where consent is required, for example under PECR for certain communications, it is obtained. Customers, as controllers of their own recordings, must establish their own lawful basis and inform their callers — typically through call announcements. Our Caller Notice Templates provide suggested wording.

Transparency information required by UK GDPR Articles 13 and 14 for Datazero's own processing is set out in our Privacy Policy; callers are informed about a customer's recording via that customer's own announcements.

5. Caller history and voice fingerprints

Where the service shows a history of previous calls from the same caller, that history is linked by the calling telephone number (CLI). Where the caller withholds their number, calls may instead be grouped by a voice fingerprint — a numerical summary of voice characteristics created automatically from the call.

6. How long the data is kept

We keep call audio for much less time than the information extracted from it. In short:

• Audio: a rolling 30 days from the date of the call, then deleted.
• Transcripts and extracted data: for the length of the customer's contract, then deleted.
• Voice fingerprints: see section 7 of our Privacy Policy.
• Backups: overwritten on a rolling cycle; deleted data is not restored from them.
• Legal hold: specific data may be kept longer only where needed for a legal claim, legal obligation or investigation.

The full periods are in section 7 of our Privacy Policy. Customers can ask for shorter retention or deletion of specific calls at any time.

7. Card payments

AI recording on an enabled number is continuous and cannot be paused during a call. To protect payment card details, our systems automatically remove card numbers and related card details from transcripts and AI output. We are introducing the same removal for stored audio. Customers should not take card details by voice on an AI-enabled number unless they use a payment method that keeps the card details out of the call. The pause/resume control in our hosted PBX applies only to the PBX's own call recording, not to AI recording.

8. Your rights and how to object

If you have been a caller on a recorded line and want to exercise your UK GDPR rights over the recording or transcript — access, correction, erasure, restriction or objection — the customer whose line you called is the controller, and your request should normally go to them. We will assist them as their processor, and we handle requests relating to our own controller processing (such as fraud-prevention data) directly. Our Your Data Requests page explains how to ask for a copy of your data or for it to be deleted, how we check who you are, and how long it takes.

You can object to processing, ask for a human to review any concern about how AI-derived outputs were used, or raise any question with us at help@numbergroup.com. Our Privacy Policy explains your rights in full, including your right to complain to the Information Commissioner's Office.

Datazero Ltd, trading as NumberGroup. Registered in England and Wales, company number 07390438. Registered office: International House, 36-38 Cornhill, London EC3V 3NG. ICO registration ZA261621. This page is an explainer, not legal advice. Effective 1 November 2026.