Policies · Call Recording
Call Recording and Voice Data Policy
We record calls to and from our AI assistant. We tell you we are recording at the start of every call. UK law lets us do this without your consent for service quality but we disclose anyway. The recording is encrypted, kept for a short period, accessible to you on request. We do NOT extract voiceprints or biometric data.
What we record
Every call to / from the AI assistant produces: raw audio (both sides), real-time transcript, intent labels (what the AI understood), sentiment markers (positive / neutral / frustrated), routing decisions (AI handled or escalated and why), conversation summary linked to the customer record. We do NOT generate: voiceprints, voice embeddings, any speaker-identification biometric, mood-detection beyond simple sentiment, demographic inferences (age, gender, ethnicity), hallucinated 'facts' stored in a profile.
Legal basis
UK position: one-party consent under Investigatory Powers Act 2016 — a party to the call can record it without the other's consent for its own use. BUT UK GDPR transparency principle (Art 5(1)(a) + Art 13) STILL requires disclosure. PECR Reg 5A: recording for training / quality monitoring requires you to inform the caller. ICO call recording guidance: clear and prominent notification at start, purpose stated. Lawful bases: Service delivery (contract Art 6(1)(b)). Service quality / training (legitimate interest Art 6(1)(f)). Dispute resolution (legitimate interest + legal claims defence). Regulatory compliance (legal obligation Art 6(1)(c)). AI model training: opt-in consent — separate (see /policies/ai-training-data).
Disclosure to caller — every call
Opening line includes: 'This call is recorded for service and quality.' Full disclosure (recording + AI status + opt-out path): 'Hi, you're speaking to Taurex's automated assistant — I'm an AI, and I can help with shipments, tracking, and indicative quotes, or transfer you to a person at any time. This call is recorded for service and quality. Say human whenever you'd like a real person.' Objection: we offer to NOT record by transferring to a human on a non-recorded line, EXCEPT where the call concerns a complaint, claim, sanctions matter, or other legitimate-interest / legal-obligation purpose that requires recording.
Retention
Raw audio (routine service call): 90 days → hard delete. Raw audio (complaint / claim related): 6 months → hard delete. Raw audio (legal hold): until lifted. Real-time transcript (identifiable): 12 months → hard delete or anonymise. Intent labels and routing logs: 12 months → hard delete. Conversation summary linked to customer: 6 years (Limitation Act). AI training extracts (opt-in only): 24 months. Voiceprints / biometric embeddings: NOT STORED.
Storage, security, use restrictions
Storage: vendor-hosted under DPA, UK / EEA region pinned. Encryption: AES-256 at rest, TLS 1.2+ in transit. Access: role-based, MFA, fewer than 5 named users in audit log. Audit: every access logged (who, when, what, why). Sub-processors reviewed at procurement and annually. International transfers: UK IDTA or UK Addendum + Transfer Impact Assessment. We do NOT: sell, share, or monetise recordings; allow advertisers or unrelated third parties access; use recordings for any purpose not in clause above; repurpose service recordings as AI training without separate opt-in; build voiceprint databases; use AI to score callers without DPIA and fairness review; listen to recordings outside legitimate logged review.
Voice biometrics — deliberately NOT collected
Under UK GDPR a voiceprint used for identification is BIOMETRIC data and is SPECIAL CATEGORY data (Art. 9). Requires explicit consent or other Art 9(2) condition, plus DPIA, plus elevated security. HMRC was forced to delete 5–7 MILLION voiceprints in 2019 because no valid Art. 9 basis. We use ASR (speech-to-text) without speaker-identification embeddings. Authentication via verbal account reference + code on registered email / phone, NOT voiceprint.
Your rights
Access — copy of audio + transcript + summary + intent labels + sentiment + routing decision + retention status: email [email protected] subject 'SAR — call records'. Rectification — correct a fact in your customer summary. Erasure — delete the recording (unless dispute / legal hold). Restrict processing. Object to legitimate interests processing. Human review of AI-influenced outcome (Art. 22). Opt out of recording — tell the AI / agent at start. Opt out of AI training — default (opt-in only). Lodge a complaint with ICO at ico.org.uk/concerns or 0303 123 1113. We respond within 1 month (extendable by 2 months for complex requests).
Last reviewed 2026-06-06.