Before we switch anything on, we agree what information is needed, who can access it and where it goes. For the AI receptionist the starting point is the caller’s enquiry — not your whole customer database.
01
The assistant collects what is needed to call back and handle the enquiry. We agree the fields with you. If a process needs special category data, such as health information, we assess it separately — the ready-made package isn’t designed to handle medical data.
02
For every integration we set out what the system needs access to. We prefer limited permissions that you can revoke. The connection method — an API or the provider’s own authorisation, for example — depends on your tools and is part of the build description.
03
A call can pass through several providers: the phone network, a voice service, an AI model and the delivery channel. Before activation we give you the list of providers for your configuration, with information about recordings, transcripts, locations and retention.
04
The safeguards follow from the architecture of the specific service. We check permissions, how data is passed on, administrative access and what happens if an enquiry fails to deliver. We don’t claim the same certifications, firewalls or retention settings for every configuration without confirming them.
05
When we process personal data on your behalf, we agree a written data processing agreement first. The data security sheet below has the details. Questions about a specific data flow: info@sitco.uk.
Data security and AI infrastructure sheet
The exact data flow, providers, safeguards and retention are described for each configuration. This sheet is for information; it is not a data processing agreement.
The AI receptionist package is provided by SITCO LTD (Company No. 13257604), registered in England and Wales. We are not VAT-registered, so no VAT is added. Terms for custom projects are set out separately in each proposal.
For the phone assistant: the caller’s number, name, the reason for the call and anything else the caller chooses to say. The scope depends on the agreed script. Special category data, such as health information, needs a separate assessment and isn’t part of the ready-made package.
Your role and sitco’s depend on the specific process. Usually you are the controller of your callers’ data and SITCO LTD acts as your processor. In that case we agree a data processing agreement meeting Article 28 of the UK GDPR before go-live. This public sheet doesn’t replace that agreement and doesn’t by itself authorise any sub-processor.
The service may use providers for telephony, speech recognition, the AI model, hosting and email. Before activation we name the providers used in your configuration, their roles, the relevant locations and the transfer safeguards in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. We don’t assume every configuration uses the same tools or that data never leaves the UK.
Access, how long recordings and transcripts are kept, backups and how deletion works are set for the specific service and providers. In the package, audio recording is off by default and the voice provider’s transcripts are set to be deleted after 30 days. We don’t promise one universal deletion date for every copy at every provider. Requests: info@sitco.uk; how it works: data deletion.
A description of the data flow and the providers, the agreed data scope, retention periods, access rules and — where the roles require it — a data processing agreement. How we handle data about visitors to this website is in the privacy notice.
Before launch you receive
Who you deal with, which documents apply and where to ask.
Email info@sitco.uk or send an enquiry — before anything goes live.
Or call +44 7822 000220 · email info@sitco.uk
