Our GDPR Commitments

Our Core Commitments

Why This Matters in Contact Centres

Contact centres are one of the highest-risk environments for GDPR compliance. Every call contains personal data. Call recordings, interaction notes, and routing decisions all carry compliance obligations — and most AI vendors either underestimate this risk or choose not to raise it.

In our experience, the most common GDPR risks in contact centre AI deployments include:

• Call recordings processed or stored on US-based servers without adequate safeguards
• AI systems trained on customer interaction data without appropriate legal basis
• Automated routing and scoring decisions with no audit trail or explainability
• Unstructured call notes containing special category data (health, financial difficulty) not handled separately
• Retention periods for call data not enforced systematically, creating regulatory exposure

We identify and address all of these risks as part of our Operations & Efficiency Audit.

Your Responsibilities as Data Controller

Where SereneAI processes personal data on behalf of your organisation, you remain the data controller under UK GDPR. This means you retain responsibility for:

• Establishing the legal basis for processing customer interaction data
• Maintaining your own privacy notices and informing customers of automated processing
• Handling subject access requests from your customers
• Ensuring retention policies are enforced consistently across all systems

We will support you in all of these areas as part of our engagement, but legal responsibility remains with your organisation as controller.

Sub-Processors

Where our solutions involve third-party technology providers acting as sub-processors, we will document these in the Data Processing Agreement provided at the start of your engagement. We will notify you of any material changes to sub-processors that may affect your data.

Data Breach Notification

In the event of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and within 72 hours of becoming aware, in line with UK GDPR Article 33. We will provide all information necessary for you to fulfil your own notification obligations to the ICO.

Questions About Our GDPR Approach

If you have questions about how we handle data — either in connection with our website or in relation to a potential or existing engagement — please contact us directly.

Read our full Privacy Policy →