Security and data protection.
Your customers' data is handled on your instructions, by our own people on managed company devices, with the safeguards your customers' law requires in place before any work starts.
Data protection
Your customers' data stays yours. We handle it on your behalf, for the work you've asked for, and nothing else.
What we are
A data processor, and for US clients, a service provider or processor under US state privacy laws. We act only on your documented instructions.
What we never do
Sell or share your customers' data, or use it for our own purposes, including training our own AI tools.
Where your data lives.
You always know where your customers' data is, who can see it, and from where.
- In your own toolsOur people work inside your helpdesk and systems, with your history and reports staying where they are.
- Calls, depending on the set-upWhere we answer on your own phone system, recordings stay there, under your rules. Where calls come through our phone platform, recordings and call records are held in Amazon Web Services' London region, encrypted, with access restricted and logged.
- Our own peopleEmployed by us, not freelancers, working in the Philippines, Portugal and Ireland, with management in the UK and Ireland.
- Every sub-processor listedWe name every company that handles your data on our behalf, and tell you before we add one.
Where it is
- Your helpdesk and toolsYour account
- Calls on our platformAWS, London
- Our peoplePH · PT · IE
- ManagementUK · IE
Security, day to day.
Multi-factor sign-in
On every account, with sign-in only from our managed devices.
Managed, encrypted devices
Company laptops with encrypted disks, endpoint protection and remote wipe.
Named, limited access
No shared logins, and only the access the work needs. When someone leaves the team, their access is shut off that day, by a leavers’ process agreed with you.
No customer data in email or chat
Our people share links to cases, not customer details, in our own channels.
Never mixed
One client's information is never visible to people working for another.
Trained, and checked
Data protection and security training when people join and every year, with background checks where local law allows.
Across borders, covered properly.
Before any work starts, the safeguards your customers' law requires are in place, set out in a data processing agreement we sign with you.
- UK and European customersWe work to UK GDPR and the EU GDPR, with standard contractual clauses for international transfers and a written assessment of the risks.
- US customersA US state privacy schedule covering the requirements of the California Consumer Privacy Act and comparable states' laws.
- Every country namedWhere your data is accessed from is written into your agreement, and nothing new is added without telling you first.
- Portugal is inside the EUWork done there raises no international transfer question for European customers.
If something goes wrong.
We keep a written incident plan, rehearse it, and hold each client's notice deadline and contacts on record.
- We tell you quicklyWithin the time agreed in your contract, starting from the moment we find out.
- We contain itAccess closed off and the problem stopped before anything else.
- We find out what happenedWhich data, which customers and how, so you have what you need for your own obligations.
- We fix the causeAnd go through what changed with you, so it does not happen again.
Questions, answered.
The questions every client asks first, answered plainly.
Are you GDPR compliant?
We work to UK GDPR and the EU GDPR as a data processor. Our standard data processing agreement and transfer safeguards are signed with the contract, so they don't hold up the start. There's no such thing as a GDPR certificate, so we don't claim one.
Will you complete our security questionnaire?
Yes. We'll complete your questionnaire, share our policies and the list of suppliers we use, and walk you through the controls we work to.
Will you sign our data processing agreement?
Yes, or we'll share ours. Ours covers UK, European and US requirements in one agreement, with schedules for each.
Where are calls recorded, and how long are they kept?
It depends how your calls reach us. If we answer on your own phone system, recordings stay in it, under your rules. If calls come through our phone platform, recordings and call records are held in Amazon Web Services' London region, encrypted, with access restricted and logged, and kept for as long as we agree with you.
Do you use AI on our customers’ conversations?
Only with your written approval, and never to train AI tools on your customers' data.
Can you handle card payments, health records or children’s data?
Card payments, yes. Your customer pays through a payment link, or types their card number on their phone keypad where your phone or payment set-up allows it. Either way, our people never hear or see the card number. Health records and children's data need extra safeguards, so they are only handled where that is agreed in writing first.
What happens to our data when we stop working together?
It's deleted or returned to you, as your agreement sets out, and our people's access to your systems is removed.
Related pages.
A question about your customers' data?
Ask us anything about how it's protected, before you commit to anything.