Privacy Notice

1.1 Duty Agent is a trading name of [LEGAL ENTITY NAME], a company registered in England and Wales with company number [COMPANY NUMBER] and registered office at [REGISTERED ADDRESS]. Our ICO registration number is [ICO REGISTRATION NUMBER].

1.2 We provide an AI receptionist that answers estate and letting agency telephone lines when the agency's own staff cannot. The AI tells every caller at the start of the call that it is an AI.

1.3 Contact for anything in this notice: hello@dutyagent.co.uk, subject line "Privacy". Postal address: [REGISTERED ADDRESS].

Agency

the estate or letting agency whose telephone line we answer.

Caller

anyone who calls an Agency line while it is diverted to us.

Agency User

a member of the Agency's staff who has an account with us or receives the Digest.

Call Data

the audio recording, transcript, caller telephone number, time and duration of a call, and the details the Caller states during it.

Digest

the morning email we send the Agency with each call, recording link and transcript.

UK GDPR

the UK General Data Protection Regulation, read with the Data Protection Act 2018 and as amended by the Data (Use and Access) Act 2025.

Sub-processor

a third party we use to process Call Data on the Agency's behalf.

3.1 For Callers, the Agency is the controller and we are its processor. The Agency decides that its out-of-hours calls are answered and recorded, why, and how long the recordings are kept. We process Call Data only on the Agency's documented instructions under our Data Processing Addendum. The Agency's own privacy notice should also cover the call.

3.2 For Agency Users, we are the controller. We decide how to use the data we hold about Agency staff for the purposes of running the account, billing, support and security.

3.3 For people we contact about our service (prospective customers), we are the controller. See section 9.

4.1 What we collect. When you call a diverted Agency line we collect:

(a) the audio recording of the call;

(b) a written transcript and a short summary produced by an automated system;

(c) your telephone number, as presented by the network (if you withhold it, we do not receive it);

(d) the date, time and duration of the call;

(e) whatever you choose to tell the AI: for example your name, whether you are renting or buying, your budget, the areas you are interested in, when you want to move, the property you are asking about, and a callback number;

(f) if you describe an emergency (for example a leak or lock-out), the nature of the emergency, so that the call can be transferred to the Agency's on-call number.

4.2 What we do not collect on purpose. The AI does not ask for special category data (health, ethnicity, religion, sexual orientation and similar), payment card details, passwords or identity documents. If you volunteer such details they will be in the recording and transcript. Please avoid saying them to the AI; the Agency's staff will call you back.

4.3 What we do with it. We record and transcribe the call, summarise it, put it in the Digest sent to the Agency, and make the recording and transcript available to the Agency on its call log page. We do nothing else with it. We do not use Call Data to train general AI models, for advertising, or for any Agency other than the one you called.

4.4 No decisions with legal effect. The AI does not decide whether you get a viewing, a tenancy or an offer. It takes a message and notes for the Agency's staff, who make every decision. This means Article 22 UK GDPR (as replaced by the Data (Use and Access) Act 2025 from 5 February 2026) is not engaged. If you believe the Agency has made a decision about you based only on an automated system, you can ask the Agency for a human review.

5.1 The Agency, as controller, determines the lawful basis. Our understanding, which the Agency should confirm in its own notice, is:

(a) Legitimate interests (Article 6(1)(f) UK GDPR) for recording and transcribing the call: the Agency's interest in not missing enquiries out of hours, in having an accurate record of what was said, and in staff being able to act on the call the next morning. The Agency should record a legitimate interests assessment. We have prepared a template for Agencies on request.

(b) Steps at the request of the data subject before entering a contract (Article 6(1)(b)) for capturing your details in order to arrange a viewing or respond to your enquiry.

5.2 Consent is not the basis for the recording. You cannot use the service without being recorded, which would make consent unfree. Instead, you are told at the start of the call and can hang up.

5.3 Recording of business calls without the consent of the other party is permitted under the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 where the business makes reasonable efforts to tell users that calls may be recorded. The spoken notice in section 6 is that effort.

5.4 For Agency Users, our lawful basis is performance of our contract with the Agency (Article 6(1)(b)) and our legitimate interest in securing and administering the service (Article 6(1)(f)). For statutory records such as VAT invoices it is legal obligation (Article 6(1)(c)).

6.1 Every call answered by the AI opens with a notice to this effect, before anything else is asked:

"You've reached [Agency name]. I'm an AI assistant answering while the team is away. This call is recorded and a transcript is sent to [Agency name] so they can call you back. If you would rather not be recorded, you can call back during office hours."

6.2 If you say you would rather not be recorded, the AI tells you the Agency's office hours and ends the call. Nothing further is stored beyond the fact that a call was received and declined, so the Agency can see the missed call in its Digest.

6.3 The exact wording may vary slightly by Agency but always states, in the first sentence, that the voice is an AI, and, before any details are taken, that the call is recorded and shared with the Agency.

7.1 Unless the Agency instructs a shorter period, we keep recordings, transcripts and summaries for [RETENTION MONTHS] months from the date of the call and then delete them from our systems and instruct our Sub-processors to do the same.

7.2 If the Agency stops using Duty Agent, its Call Data remains available to it for [POST-CANCELLATION DAYS] days after cancellation and is then deleted.

7.3 Where you have declined recording (6.2) we keep only the call time and the fact it was declined, for the same period.

7.4 Digest emails sit in the Agency's own email system, which the Agency controls; our retention period does not apply to the Agency's copies.

7.5 Agency User account data is kept for the life of the account and for 6 years after it closes, to meet accounting and limitation-period requirements. Support emails are kept for 2 years.

8.1 The Agency you called. All Call Data for a call goes to the Agency whose line you called, and to no other Agency.

8.2 Sub-processors. We use the following providers to deliver the service. Each is bound by a written contract with data protection terms at least as protective as our Data Processing Addendum.

8.3 Retell AI's own list of the language model, speech and telephony providers it uses is available from Retell on request (support@retellai.com) and is incorporated into our Sub-processor list. We will publish the full chain on this page once confirmed in writing.

8.4 We will tell Agencies by email at least 14 days before adding or replacing a Sub-processor that handles Call Data. The current list is always at /legal/privacy.

8.5 Others. We may disclose data where the law requires it (for example a court order), to our professional advisers under confidentiality, or to a buyer of our business, who would be bound by this notice.

8.6 We do not sell personal data. We never use Call Data for marketing.

9.1 We email estate and letting agencies at their business addresses about the service, sometimes with a recording of a test call we made to the agency's own advertised line at a time it was closed. We make those calls ourselves, record our own side of the interaction (typically a ring-out or voicemail greeting), and share the recording only with that agency.

9.2 Emails to limited companies and LLPs do not require prior consent under regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR). Where an agency is a sole trader or unincorporated partnership, its staff are individual subscribers and we only email them where we have a lawful basis to do so. Every email identifies us and carries a working opt-out line, as regulation 23 PECR requires. Opt-outs are honoured permanently.

9.3 Our lawful basis under UK GDPR for holding the names and work contact details of agency staff is legitimate interests: telling a small, defined set of businesses about a service built for them. You can object at any time by replying "stop" or emailing hello@dutyagent.co.uk.

9.4 We never make outbound marketing calls, by AI or by a person.

10.1 Call Data is processed by Retell AI in the United States. That is a restricted transfer under Chapter V UK GDPR.

10.2 Our safeguard is: [TRANSFER MECHANISM FOR RETELL]. Retell AI's Data Processing Addendum incorporates the EU Standard Contractual Clauses; for UK data we add the ICO's International Data Transfer Addendum to those clauses, and we keep a transfer risk assessment on file. If Retell AI is certified to the UK Extension to the EU-US Data Privacy Framework at the time of transfer, the UK-US data bridge (in force since 12 October 2023) provides adequacy and no further safeguard is needed; we check the Data Privacy Framework list before relying on it.

10.3 The ICO has said it intends to update the IDTA and Addendum during 2026 following the Data (Use and Access) Act 2025. Until it does, the current documents remain the approved clauses and we use them.

10.4 Our other Sub-processors are located as listed in section 8.2. Where any is outside the UK we rely on UK adequacy regulations (for the EEA and for DPF-certified US organisations) or on the IDTA/Addendum. You can ask us for a copy of the safeguards in place.

11.1 Call Data is encrypted in transit and at rest. Access is limited to the founder and to Agency Users of the Agency the call belongs to. Agency Users log in by magic link sent to a verified work email address.

11.2 We keep an access log for the call log page and review it if we suspect misuse.

11.3 We use the retention and privacy controls Retell AI provides to limit how long it holds audio and transcripts, matching the period in section 7.

11.4 If we discover a personal data breach affecting Call Data we tell the affected Agency without undue delay and within 72 hours of becoming aware, with the information the Agency needs to meet its own duty to notify the ICO.

11.5 No system is perfectly secure. We are a small company and we say so plainly. Do not tell the AI anything you would not want written down.

12.1 Under UK GDPR you have the right to: access the personal data held about you; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing, including an absolute right to object to direct marketing; data portability where processing is by automated means and based on contract; and not be subject to a solely automated decision with legal or similarly significant effect without safeguards.

12.2 Callers: contact the Agency first. The Agency you called is the controller and holds the recording, transcript and your details. Ask the Agency to hear your recording, correct your details or delete the call. If you are not sure which Agency you called, or the Agency does not reply, email us at hello@dutyagent.co.uk with the number you called, the number you called from and the approximate time. We will pass your request to the Agency the same working day and help it respond. If you ask us directly to delete a recording, we will do so on the Agency's instruction.

12.3 Agency Users: contact us. Email hello@dutyagent.co.uk with "Data request" in the subject. We respond within one month. We may ask you to confirm your identity.

12.4 There is no charge for exercising your rights unless a request is manifestly unfounded or excessive.

13.1 If you think we have handled your personal data wrongly, please complain to us first at hello@dutyagent.co.uk with "Complaint" in the subject, or by post to [REGISTERED ADDRESS]. We acknowledge every data protection complaint within 5 working days, well inside the 30 days that Article 77A UK GDPR (in force from 19 June 2026) requires, look into it without undue delay, and tell you the outcome and any action taken.

13.2 You can also complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to complain to us first, but it usually resolves matters faster.

13.3 Callers may also complain to the Agency they called, which as controller has its own duty to handle the complaint.

14.1 Our website at dutyagent.co.uk sets no cookies of its own and loads no analytics, tracking pixels, embedded social widgets or other third-party scripts. Our website host may set a cookie strictly necessary to serve or protect the site; none is set at the time of writing. There is nothing to consent to and no cookie banner. If that changes we will update this section and, where required by regulation 6 PECR, ask for consent first.

14.2 Our website host, [WEBSITE HOST], records standard server logs (IP address, requested page, browser type, time) for security and to keep the site running. These are kept for [LOG RETENTION DAYS] days.

14.3 If you call the demo line 020 3000 0000, an AI answers and the call is recorded in the same way as an Agency call, with Duty Agent as controller. Demo recordings are kept for 30 days and used only to check that the demo works.

The service is built for adults dealing with an estate or letting agency. We do not knowingly collect data from anyone under 18. If a child calls, the recording is handled like any other and deleted on request.

We will post changes here with a new version number and date, and email Agencies about any material change at least 30 days before it takes effect.