What does GDPR require?

GDPR covers the processing of personal data, which means almost anything done with it: collecting, recording, storing, using, sharing or erasing. Article 5 sets out seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability, which means the controller must be able to show it complies.

Each use of personal data needs a lawful basis, such as consent, a contract or legitimate interests. People have rights to be informed, to see their data, to have it corrected or erased and to object, among others.

The law separates controllers, which decide why and how data is processed, from processors, which act on a controller’s instructions under a written contract. Under the EU GDPR, fines for the most serious infringements can reach €20 million or 4% of worldwide annual turnover, whichever is higher. The UK GDPR’s equivalent is £17.5 million or 4%.

For example, a SaaS company that saves support conversations has to tell callers about it, have a lawful basis, decide how long to keep the transcripts and handle requests to see or delete them.

Sources

Why does GDPR matter for a website voice agent?

A voice agent processes personal data as soon as someone speaks: the voice in real time, the words in the transcript and any details the caller gives. The business running the agent usually decides why and how that happens, which makes it the controller, so it has to tell callers what happens to their data and use only processors that give sufficient guarantees.

The practical questions for a vendor are where data is stored and processed, which other companies handle it, how long transcripts are kept, how deletion works and whether a data processing agreement is available.

How Kawl Now approaches GDPR

Kawl Now doesn’t claim to be GDPR compliant. This is what’s in place today, so you can judge it against your own obligations.

If you need something that isn’t listed, ask before you switch on customer calls. The security page has contact details for data processing questions.

  • Data is stored in a Postgres database on Supabase in London, and the app runs in Railway’s EU West region.
  • OpenAI processes the voice conversation, and its processing region isn’t documented, so there’s no claim that all data stays in the UK or EU.
  • Automatic insights run for every workspace, and there’s no setting to turn them off. Callers’ words from recent calls are sent to an OpenAI model, with email addresses, long numbers and links masked first, and the results quote callers in your dashboard, API and MCP.
  • If you use human handover, an early release, Twilio verifies your team’s phone number and connects the call in its default region, the United States. The name a caller types and a short AI-written summary of their issue are spoken to your team in a private briefing.
  • No call audio is recorded. Each conversation keeps a text transcript, and the widget tells callers about it before they start.
  • There are no retention settings, and transcripts aren’t deleted automatically. They’re kept until you ask for deletion, and export and deletion are handled on request.
  • There are no product terms, privacy notice or data processing agreement for pilot workspaces yet.
Sources

Common questions

Does GDPR apply to companies in the UK?

UK organisations follow the UK GDPR and the Data Protection Act 2018, enforced by the Information Commission, still known as the ICO. A UK company that offers goods or services to people in the EU, or monitors their behaviour, may also have to comply with the EU GDPR for that processing.

Does GDPR require data to stay in the EU?

No. GDPR doesn’t require data to stay in one place. It restricts transfers outside the EU, or outside the UK under the UK GDPR, unless they’re covered by an adequacy decision, appropriate safeguards such as standard contractual clauses, or a specific exception.