Privacy Notice

Crystal Voice Data Ltd
Last updated: 12 October 2026

1. About this notice

This notice explains how Crystal Voice Data Ltd ("Crystal Voice Data", "we", "us") collects, uses, stores and protects personal data when you:

  • visit our website
  • call us, including when you speak to our AI receptionist
  • email us, message us or fill in a form
  • ask for a quote or proposal
  • become a customer and use our business phone, broadband, Wi-Fi, data cabling or related services.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.

2. Who we are

Crystal Voice Data Ltd, company no. 13442068, registered in England and Wales.
We serve businesses in Cardiff and the surrounding area.
Email: info@crystalvoicedata.com
Phone: 0333 5678 444 (Mon–Fri, 9am–5pm)

For data protection purposes, we are the controller of your personal data. We don't have a statutory Data Protection Officer. Data protection queries go to the contacts above.

3. The data we collect

Depending on how you deal with us, we may collect:

  • Identity and contact data: name, business name, job title, business address, email address and phone numbers.
  • Business and account data: company registration number, VAT number, billing details, bank details for Direct Debit, and credit check results where relevant.
  • Service data: the numbers, lines, users and equipment on your account, call detail records, and usage and system logs needed to run and bill your services.
  • Call data: recordings and transcripts of phone calls with us (including calls handled by our AI receptionist), plus call summaries and notes.
  • Communications data: emails, messages (including WhatsApp, if you contact us that way), support tickets, and your preferences for hearing from us.
  • Website data: IP address, browser and device information, and how you use our website. Non-essential cookies are only used if you agree to them (see section 13).

We don't intend to collect special category data such as health information. Please don't share it on calls or in forms unless we have asked for it.

4. Where we get your data

  • From you: through calls, emails, messages, website forms, quotes, contracts and using our services.
  • From others: credit reference agencies; network and wholesale suppliers (for example, line and broadband availability checks for your address); your colleagues, if they give us your details as a contact for your business; and public sources such as Companies House.

5. How we use your data and our lawful bases

  • Answer enquiries, prepare quotes and proposals, and check service availability at your address: Steps at your request before entering a contract; legitimate interests (responding to business enquiries)
  • Provide, install, support and bill our services, and manage your account, number porting and Direct Debits: Performance of a contract; legitimate interests where the contract is with your employer
  • Credit checks before providing services on credit: Legitimate interests (managing financial risk)
  • Record, transcribe and summarise calls, including AI receptionist calls (see section 6): Legitimate interests (accurate records, quality, training, handling requests, resolving disputes); performance of a contract for customer service calls
  • Follow-up calls about an enquiry or proposal you've made: Legitimate interests (following up an enquiry, quote or proposal you asked us for) / steps at your request before entering a contract. Some follow-up calls are made by our AI assistant (see section 7).
  • Service messages and important account notices: Performance of a contract; legal obligation
  • Marketing (see section 8): Legitimate interests for business (corporate) contacts; consent or "soft opt-in" where PECR requires it
  • Keep accounting, tax and regulatory records, and meet Ofcom and law-enforcement requirements: Legal obligation
  • Make, defend or pursue legal claims: Legitimate interests
  • Website analytics and improvements: Consent (cookie banner)

Where we rely on legitimate interests, we've weighed our interests against your rights. You can ask us for details and you can object at any time (section 11).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Our AI receptionist and call recording

What happens when you call us: Calls to our number may be answered by an AI receptionist, an automated voice assistant. At the start of the call, it tells you that it's an AI assistant and that the call is recorded and transcribed. It can take your details, answer general questions and pass your message to our team.

Talking to a person: You can ask to speak to or be called back by a member of our team at any time. You can also email info@crystalvoicedata.com instead.

What we record and create:

  • an audio recording of the call (both sides)
  • a written transcript
  • a short summary of what you asked for. Our team receives the summary by email, and it's added to our enquiry records so we can follow up.

We also record calls our team makes to you, including follow-up calls, and we tell you at the start of the call.

Why: to deal with your enquiry accurately, keep a reliable record of what was agreed, train and check quality, prevent fraud and misuse, and resolve complaints or disputes.

Lawful basis: legitimate interests, and performance of a contract for existing customers. We don't use call recordings to make automated decisions about you, and we don't use your calls to train third-party AI models.

Who processes it: our telephony provider (Twilio) carries and records calls. Our voice AI provider (xAI) runs the AI receptionist. Transcripts are produced on our own systems, and summaries are sent through our email provider (Microsoft 365) and our workflow/automation tool. These providers act on our instructions under data processing terms. Some are based in the USA (see section 10).

How long we keep it:

  • Call recordings and transcripts: deleted automatically 90 days after the call.
  • Call summaries (including the summary emails our team receives) and call history held by our voice AI provider: deleted after 90 days.
  • Telephone numbers on our "do not call" list are kept for as long as needed to respect your request.
  • We may keep a specific recording longer only if it's needed for a complaint, dispute or legal claim, and only until that's resolved.

If you'd rather not be recorded, please email us instead and we'll respond the same way.

7. Calls we make to you

We call you about an enquiry, quote or proposal you've asked us for, and about your account if you're a customer. Some of these follow-up calls are made by our AI assistant. It tells you at the start of the call that it's an AI assistant from Crystal Voice Data and that the call is recorded and transcribed, and you can ask for a member of our team instead at any time.

Our lawful basis for these calls is legitimate interests (following up a request you made to us) and taking steps at your request before a contract. We've carried out a legitimate interests assessment, and you can ask us for a copy. We only call numbers connected with an enquiry or proposal you made; we don't use AI calls for unsolicited sales calls, and we don't make unsolicited live sales calls to numbers registered with the Telephone Preference Service (TPS) or Corporate TPS (CTPS). We screen numbers against the TPS and CTPS before calling.

You can object to these calls at any time. Just tell the caller (human or AI) "please don't call me again", email info@crystalvoicedata.com or call 0333 5678 444. We'll add your number to our do-not-call list and won't call it again.

Recordings and transcripts of these calls are kept for 90 days (see section 6).

8. Marketing

  • Limited companies, LLPs and public bodies (corporate subscribers): we may email you about similar business services. Every message identifies us and includes an easy way to opt out.
  • Sole traders and partnerships: we only send electronic marketing (email, SMS, WhatsApp) if you've agreed, or if you're a customer or have asked us for a quote and we're marketing similar services to you ("soft opt-in"). In that case, you'll have had the chance to opt out when we collected your details and in every message.
  • To opt out at any time, use the unsubscribe link, reply "STOP", or contact us. We keep a suppression record so we don't contact you again.

9. Who we share your data with

We don't sell your personal data. We share it only where needed with:

  • Network and wholesale suppliers and carriers that provide your lines, numbers, broadband and porting, e.g. Gamma
  • Telephony and AI providers: Twilio (calls and recordings) and xAI (AI receptionist)
  • IT and cloud providers: Microsoft 365 (email and documents), Duda (website hosting), our workflow/automation tool, Google Analytics (website statistics, only with your consent), Chaty (website chat button) and Vimeo (website videos)
  • Contract and payment providers: Adobe Acrobat Sign (electronic signatures), GoCardless (Direct Debit), Xero (accounting)
  • Credit reference agencies, where we run credit checks
  • Professional advisers (accountants, lawyers, insurers)
  • Regulators, law enforcement and courts, where the law requires it, including emergency services (999/112) location information.

Our processors may only use your data on our instructions and must keep it secure.

10. International transfers

Some of our providers (for example Twilio, xAI, Microsoft, Adobe and Google) may process data in the USA or other countries outside the UK. When this happens, we make sure there are appropriate safeguards:

  • UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where the US recipient is certified
  • the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

You can contact us for more details.

11. How long we keep your data

  • Enquiries and quotes that don't lead to a contract
  • Customer account, contract and billing records: Life of the contract plus 6 years (limitation and tax rules)
  • Call detail records for billing
  • Call recordings, transcripts and summaries: 90 days, then deleted (longer only for an open complaint, dispute or claim). Do-not-call list: as long as needed to respect your request.
  • Marketing suppression list (opt-outs): For as long as needed to respect your opt-out
  • Website analytics: Up to 14 months in Google Analytics
  • Complaint records

When we no longer need the data, we securely delete or anonymise it.

12. Keeping your data secure

We use appropriate technical and organisational measures. These include access controls and multi-factor authentication, encrypted connections, restricted access to call recordings and customer files, and contracts with our suppliers. No system is completely secure, but we work to protect your data and will deal with any incident as the law requires.

13. Cookies

We use strictly necessary cookies to run our website. We only use analytics cookies, embedded video and chat widget cookies, and any advertising cookies if you accept them in our cookie banner. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. See our Cookie Policy for the full list.

14. Your rights

You have the right to:

  • access your personal data
  • correct inaccurate data
  • have data erased
  • restrict how we use it
  • object to processing based on legitimate interests, and to direct marketing at any time
  • data portability
  • withdraw consent at any time, where we rely on consent.

To use any of these rights, email info@crystalvoicedata.com or call 0333 5678 444. We'll respond within one month. This can be extended by up to two more months for complex requests, and we'll tell you if so. We may need to confirm your identity first.

15. Data protection complaints

Complain to us first. If you're unhappy with how we've handled your personal data, please tell us:

  • Email: info@crystalvoicedata.com, with "Data protection complaint" in the subject
  • Online: use the contact form on our website and choose "Data protection complaint"
  • Phone: 0333 5678 444

We'll acknowledge your complaint within 30 days of receiving it. We'll look into it and tell you the outcome without undue delay, keeping you updated if it takes longer.

Complain to the regulator. You also have the right to complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office; it still uses the name "ICO"). The regulator usually expects you to raise the complaint with us first.

  • Website: https://ico.org.uk/make-a-complaint/
  • Helpline: 0303 123 1113

16. Changes to this notice

We may update this notice from time to time. The latest version will always be on this page, with the "Last updated" date. We'll tell customers directly about significant changes.

17. Contact us

Crystal Voice Data Ltd, company no. 13442068
Email: info@crystalvoicedata.com · Phone: 0333 5678 444