Kallin Privacy Policy
This Privacy Policy explains how Kallin handles personal information when you visit our website, use our app, contact us, try a demonstration or interact with a business using Kallin. It covers AI telephone answering, website chat, WhatsApp, bookings, notifications, Kallin Intelligence and enabled follow-ups after a service interruption.
1 Who is responsible for your information
In this policy, "Kallin", "we", "us" and "our" refer to the service operating under the Kallin trading name. You can contact us about privacy at info@kallin.co.uk. Our website is https://www.kallin.co.uk and our app is https://app.kallin.co.uk.
Kallin acts as a data controller when we decide why and how to use personal information for our own website, account administration, billing, enquiries, sales demonstrations, marketing and other independent purposes described in this policy.
When a business uses Kallin to handle its callers, website visitors or messaging contacts, that business is normally the controller for those communications. Kallin normally acts as its processor, handling information on its documented instructions under our Data Processing Agreement. If the business itself acts for another controller, the relevant roles and instructions follow that arrangement.
The business you contact is responsible for its own purposes, lawful basis, privacy information and decisions about your enquiry. Its privacy notice should explain its use of Kallin. Contact that business first about how it uses your information; you can also contact us and we will help direct your request appropriately. Actual processing determines these roles, and each party remains responsible for its own legal duties.
2 Who this policy covers
This policy covers website visitors, prospective and existing customers, account owners and authorised users, people contacting Kallin, participants in our demonstrations, and people whose information we process through customer communications.
Customer communications are also governed by the relevant business's privacy notice and instructions. Our Terms and Conditions, including the Data Processing Agreement, govern our service agreement with the business. This policy explains data use; it does not provide blanket consent to recording, marketing or tracking.
3 Information we collect and where it comes from
Account and business information may include your name, business name, role, contact details, login identifiers, authorised users, account preferences, plan, setup instructions and integration permissions. If you use social sign-in, we receive the information needed for the sign-in and any permissions you authorise from that provider. We do not receive your social-provider password through that sign-in.
Billing information may include billing contact details, invoices, subscription status, transaction references, payment status and agreed usage charges. Where a payment provider handles card entry, it processes payment details under its own arrangements. Payment credentials must not be entered into ordinary call or chat conversations.
Communication information may include caller or sender identifiers, names and contact details provided during an enquiry, call time and duration, routing and delivery status, audio where enabled, transcripts, chat and WhatsApp messages, summaries, appointment details, requested actions, replies and relevant conversation history.
Configuration and preference information may include recording and retention choices, notification destinations, authorised actions, opt-ins where required, objections and opt-outs, feature settings, Kallin Intelligence instructions and a record of material instruction changes.
Technical and service information may include IP address, browser and device information, authentication events, service errors, usage records, security logs, identifiers used by permitted cookies or similar technologies, and information needed to investigate a fault or support request.
We receive information directly from you; from the business you contact or work for; from authorised integrations such as calendars or CRM systems; from communications and hosting providers; and from your interactions with our services. For our own business enquiries and permitted sales activity, we may also receive work contact details from referrals, public business websites, professional sources or lead forms. A public contact detail is not, by itself, permission for every type of marketing.
If you provide information about another person, you must have an appropriate reason to do so and avoid sharing information that is unnecessary for the enquiry. We use only the information needed for the applicable purpose.
4 How we use information for customer businesses
On a customer's instructions, we may process information to answer a call or message; understand and respond to an enquiry; capture relevant contact and enquiry details; prepare a transcript or summary; support an authorised booking, update or transfer; send a permitted notification; display records to authorised staff; connect an approved system; and provide support, security, export and deletion for that service.
Enabled Kallin Intelligence and recovery messaging operate for the purposes described below. The customer's setup and enabled functions determine which processing takes place. Availability of a feature does not mean every customer uses it.
The customer must identify an appropriate lawful basis for its processing and any additional legal condition or permission it requires. Depending on the context, this may include legitimate interests, a contract with the individual or steps requested before that contract, a legal obligation, or consent. We follow lawful customer instructions and apply the restrictions relevant to our own role. Customer acceptance of our terms does not give consent on behalf of every caller or contact.
5 Why Kallin uses information and our lawful bases
Account and service administration. We use information to set up accounts, provide the agreed service, manage authorised users, administer subscriptions and maintain our customer relationship. We rely on contractual necessity where the individual is a party to the contract or asks us to take steps before entering it. For information about representatives of a business customer, we normally rely on legitimate interests in delivering and administering that business relationship.
Enquiries, sales discussions and support. We use contact details and correspondence to respond to requests, demonstrate the service, investigate issues and keep an appropriate record of the exchange. Our legitimate interests are answering enquiries, helping users and managing our business relationships. Contractual necessity also applies where the individual requests steps towards their own contract or the processing is needed for their existing contract.
Direct demonstrations. Real-time processing is used to provide the demonstration requested, on the applicable basis above. We ask for consent before retaining recordings or transcripts of our own sales demonstrations. The demonstration notice explains the recording, transcription and permitted review purposes. You may decline retained recording or withdraw consent and contact us for an alternative way to discuss the service. A customer's own trial workspace follows that customer's instructions and privacy arrangements instead.
Billing and legal obligations. We use the information needed to collect agreed charges, maintain financial records and meet applicable tax, accounting and other legal duties. We rely on legal obligations for required records, and on contractual necessity or legitimate interests for administering payments and resolving disputes where appropriate.
Security and service reliability. For our own controller processing, we rely on legitimate interests in protecting accounts, preventing fraud and misuse, investigating incidents, and maintaining a reliable service. Security and support processing of customer communication data remains within the applicable processor instructions and agreement. Access to conversation content must be necessary and limited to an authorised purpose.
Our own marketing. Where permitted, we use relevant contact details to tell people about Kallin. We rely on consent where required and otherwise on legitimate interests where the communication rules permit that use. Our legitimate interest is promoting relevant services to prospective or existing business contacts. We apply the separate marketing rules as well as the UK GDPR, and provide a way to stop marketing.
Optional tracking and advertising. We use consent for non-exempt storage or access technologies and related advertising processing where required. For any use relying on an applicable exception or another lawful basis, we identify the purpose and meet its conditions, including any required objection mechanism. Further details are in our Cookie Policy and the relevant settings.
When we rely on legitimate interests, we assess the purpose, necessity and effect on individuals. You may object as explained below. When we rely on consent, you can withdraw it; withdrawal does not affect processing that was lawful before it was withdrawn. We do not substitute another basis simply to defeat a valid withdrawal.
6 AI calls recording and transcription
Kallin uses AI to process communications and generate responses. Depending on the customer's settings, this can involve real-time audio processing, speech recognition, stored audio, a transcript, a summary and authorised actions. These are distinct activities: disabling stored audio does not necessarily disable speech processing or retained transcripts.
The opening notice must identify the AI assistant and accurately explain the enabled recording or transcription activities before the substantive enquiry. Where a call is always recorded, the notice must say that it is recorded. Relevant privacy information must be accessible through a suitable route. Required notices are protected from changes that would remove or contradict them.
A recording announcement is transparency information, not automatic consent. Where applicable law requires consent, or consent is the chosen basis, the relevant processing must not begin until valid consent has been obtained. An appropriate alternative must be available for refusal. A caller's silence or continued use must not be treated as blanket consent.
Customer businesses decide their lawful purposes and instructions, including any lawful conversation review. We provide the agreed controls and remain responsible for our own operation of them. Additional country, sector or sensitive-data requirements must be assessed before the affected deployment.
7 Kallin Intelligence and conversation review
Where enabled, Kallin Intelligence reviews conversations from the customer's workspace, identifies useful patterns or issues, and generates or applies updates to that customer's assistant instructions. Reviews may run daily or on another disclosed schedule. The purpose is to improve that customer's handling of future enquiries within its approved business information and permissions.
The customer's privacy information must explain this review where it applies. The feature must not change required disclosures, marketing permissions, privacy requirements, prices, spending permissions or the assistant's authorised actions. Material instruction changes are recorded and remain subject to any configured approval requirements. Customers can disable future reviews and automatic updates and request correction or a supported restoration of instructions.
Disabling the feature does not automatically erase existing conversation records or previously applied instructions. Applicable retention and rights controls still apply, including to identifiable information in derived instructions.
Under the standard customer agreement, identifiable customer conversations are not used to train general-purpose AI models for Kallin's or a supplier's independent purposes, or to improve another customer's assistant. Any proposed separate use requires a prior lawful arrangement and appropriate transparency and permissions. Supplier processing must meet the agreed restrictions.
We may use genuinely anonymised aggregate information to understand and improve the service, where it cannot identify individuals. Removing names alone does not necessarily make a conversation or dataset anonymous.
8 Notifications and follow-ups after an interruption
Enabled notifications can include staff enquiry alerts, summaries, booking confirmations or reminders, booking changes, requested follow-ups and operational information. They may use supported email, SMS, WhatsApp, push or other channels. Customer instructions determine the purpose and authorised recipients, and messages must include only the information needed for that purpose.
An enabled recovery feature may use reliable contact-event information to identify a recent attempted enquiry affected by an interruption. Once the relevant service is restored, it can send a limited message on behalf of the business explaining that the contact route is available again and how to continue that enquiry.
Recovery messages require an appropriate lawful basis, an eligible destination and any required channel permission. They must not be sent to unrelated leads, invalid or withheld destinations, contacts known to be wrong, or people who have asked not to receive those follow-ups. A prior telephone call does not automatically give permission to initiate a WhatsApp conversation.
The business controls whether recovery messaging is enabled. The feature uses a disclosed sending window, expiry, suppression and deduplication controls. Unless the recipient requests further communication, there must be no more than one initial recovery follow-up to the same destination for the same incident. The content must remain limited to the original enquiry and service interruption.
You can stop optional recovery follow-ups using the method stated in the message, including STOP where replies are supported, or by contacting the business. Clear objections must be respected. A STOP request must not be treated as a new enquiry. Re-enabling the business's feature must not erase an individual's applicable opt-out.
Turning recovery messaging off stops new sends and cancels messages still queued under our control. Messages already handed to a provider may still arrive. A reply may be used to continue the original enquiry and, where requested, arrange an authorised booking; it is not permission for unrelated marketing.
9 Marketing permissions and communication preferences
Genuine administrative or customer-service messages are assessed according to their content, purpose and context. Including an offer, upselling or another promotional purpose can make a message marketing, even if it is called a notification. The appropriate marketing rules then apply.
For our own marketing, we use consent or a genuinely applicable permission or exception under the relevant communication rules. We do not treat an enquiry, contract acceptance or a missed call as blanket marketing permission. You can unsubscribe through a working method in the message or contact info@kallin.co.uk. Marketing objections are applied to the relevant activity, and we retain only the minimum suppression information needed to respect them.
For a customer business's messages, contact that business or use its stated opt-out route. We apply objections received through our supplied controls and assist customers with relevant preferences. Permissions are recorded for the appropriate business, purpose and channel. WhatsApp platform permissions, approved-template requirements and service-window restrictions apply alongside legal requirements.
Necessary account, billing, legal, security and operational communications may continue where needed to administer the service or meet a legal duty. They must not be used to bypass an objection to marketing.
10 Who receives information
Customer communication information is made available to the authorised customer business and its permitted staff or recipients. Customer-approved calendars, CRM systems, routing destinations and other integrations receive only the information and access authorised for the relevant function. An independently controlled connected service may have its own privacy notice.
We use appointed providers where needed for telecommunications and messaging, hosting and storage, databases and authentication, AI speech and conversation processing, notifications, payments, support and security. We limit their access and purposes through appropriate arrangements. Providers acting as our subprocessors must meet the applicable Data Processing Agreement obligations.
The actual supplier register supplied with the customer processing arrangements identifies appointed subprocessors, their roles and relevant locations. Customers receive the required information before processing and notification of intended new or replacement subprocessors under the agreed change process. You can contact info@kallin.co.uk for relevant recipient and safeguard information.
Some services, such as payment platforms, social sign-in providers or communications networks, may also act as independent controllers for their own account, security, compliance or network purposes. Their notices explain those activities. That does not give them unrestricted rights to reuse our customers' conversation content.
We may disclose limited information to professional advisers, insurers, regulators, courts or law-enforcement bodies where there is a lawful and necessary reason. If a business transfer occurs, relevant information may be disclosed to parties and advisers subject to confidentiality, necessity and applicable safeguards. A transfer does not remove individuals' rights or permit an incompatible new use without the required legal basis and information.
We do not sell identifiable customer conversation information or use it for independent advertising under the standard service agreement. Access within Kallin must be limited to people who need it for a defined authorised purpose.
11 Overseas processing and international transfers
The applicable providers and integrations may involve storage, processing or authorised support access outside the UK, and outside the EEA where EU data protection law applies. The countries involved and the relevant transfer arrangements are described at [INSERT ACTUAL PROCESSING COUNTRIES AND APPLICABLE TRANSFER SAFEGUARDS OR A LINK TO THE COMPLETED REGISTER].
Where a restricted transfer is involved, we use the applicable lawful mechanism and safeguards. Depending on the actual destination and recipient, this may include an adequacy arrangement, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or applicable EU Standard Contractual Clauses, with the required assessments and supplementary protections. We rely on a certified adequacy framework only where the relevant recipient and processing are covered.
You can contact info@kallin.co.uk for information about relevant safeguards and how to obtain a copy, subject to appropriate protection of confidential information. A UK or EU hosting region alone does not establish where every provider processes information or accesses it. We must not make a restricted transfer merely because this policy refers generally to overseas providers.
12 How long we keep information
We keep personal information only for the applicable purpose and period, subject to lawful instructions and any necessary legal retention. The periods below distinguish customer communication data from Kallin's own controller records.
Customer communication records. During service, recordings, transcripts, messages, summaries and other identifiable conversation records follow the retention period agreed with the customer and disclosed in its setup and privacy information. The standard active retention period and available customer options are: [INSERT THE ACTUAL DEFAULT ACTIVE RETENTION PERIOD AND AVAILABLE CUSTOMER RETENTION OPTIONS]. Valid shorter instructions or individual rights may require earlier action. Information must not be kept indefinitely simply because storage is available.
Leaving the service. Under our standard customer agreement, the customer can request an available export during service and within 30 days after termination. At its choice we return or delete processor personal data. If no return instruction is received within the export period, the default instruction is deletion. Active service copies are deleted within 60 days after termination, with protected residual backup copies deleted or overwritten within a further 90 days, unless a valid earlier instruction or a specific legal obligation applies. These are contractual maximum periods, not a right to retain information unnecessarily.
Scope of deletion. Deletion includes relevant recordings, transcripts, summaries, messages and identifiable derived instructions or search records under our control. Relevant instructions are passed to appointed subprocessors. Backup information awaiting expiry is protected and kept beyond ordinary use, and outstanding deletion instructions are reapplied if a backup is restored. Copies in independently controlled customer integrations are handled under the appropriate controller's instructions.
Our direct demonstrations. Retained audio and transcripts of Kallin's own sales demonstrations are normally deleted or anonymised within 30 days of the demonstration. A specific necessary legal hold or investigation may require limited information for longer. Sales contact details and follow-up correspondence are separate records and are retained only while reasonably needed for the enquiry or another disclosed lawful purpose. Customer trial workspaces follow the customer-processing rules above.
Account and support records. Account information is retained while needed to provide and administer the account. Unnecessary account profile data is normally deleted within 60 days after closure. We keep limited support, billing, transaction, security, complaints and legal records for the periods needed to resolve the matter, meet applicable legal duties or establish, exercise or defend legal claims. We assess necessity, the nature of the information, outstanding issues and applicable limitation or regulatory periods.
Permission and suppression records. We retain the minimum evidence reasonably needed to demonstrate permissions and respect objections while the relevant processing or communication activity continues. A request to erase ordinary enquiry information does not necessarily require erasing a minimal suppression record needed to prevent unwanted contact.
Legal retention must be limited to the necessary information and period, protected from unrelated use, and explained where lawful. Genuinely anonymised information that cannot identify individuals may be retained separately. Contact us, or the relevant customer business, for the retention arrangements that apply to your information.
13 How we protect information
We apply appropriate technical and organisational safeguards for the information and risks involved. These include access restrictions, protection of credentials and integration permissions, suitable encryption, customer separation, controlled access to private records, limited staff and supplier access, confidentiality obligations, monitoring and incident procedures.
Customer separation applies to recordings, database records, storage, search, AI retrieval, integrations, generated instructions and exports. Notifications must not expose unnecessary personal information, particularly where devices, numbers or inboxes are shared. Support access to conversation content must be needed for a defined purpose and appropriately recorded.
We maintain appropriate backup and recovery arrangements and assess security effectiveness. No service can guarantee absolute security. If a personal data breach occurs, we take appropriate protective action and make notifications required by our role, including notifying affected customer controllers without undue delay where we act as processor.
14 Cookies analytics and advertising technologies
Our website, app and embedded tools may use cookies or similar technologies for functions such as authentication, security, preferences and permitted analytics or advertising. Our Cookie Policy and applicable preference controls explain the actual technologies, purposes, providers and periods.
Non-exempt storage or access and relevant advertising tracking require valid consent. We respect rejection and withdrawal through the applicable controls, including in corresponding server-side advertising processing. Moving an event to a server does not provide permission to bypass a person's choice.
Where an applicable narrow exception is used, we meet its conditions, including providing information and an easy, free objection mechanism where required. Optional analytics are not automatically exempt merely because they are called analytics. Cookie preferences are separate from agreement to the Terms. Essential functions may remain necessary to provide a requested login or security feature.
15 Sensitive information and children
Our business accounts are intended for authorised adults aged 18 or over. The service is not directed at children as account holders. A customer business may nevertheless receive an enquiry involving a child and must assess the relevant purposes, protections and privacy information.
The standard service is not intended for deliberate collection of unnecessary health information, other special-category data, criminal-offence information, biometric identification data, full payment-card details or sensitive credentials. Customers needing deliberate sensitive processing or children's information at scale must establish the necessary legal conditions and agree suitable safeguards before activation.
Incidental disclosure does not authorise unrestricted retention or further use. We minimise and handle that information under the relevant lawful instructions. If you believe unnecessary sensitive information or a child's information has been provided, contact the business concerned or info@kallin.co.uk so that appropriate action can be considered.
16 Automated processing and human contact
The assistant can generate responses, summarise or classify an enquiry and carry out supported actions within the customer's instructions. Kallin Intelligence can generate or apply permitted instruction changes. AI outputs can be inaccurate, and significant information and actions should follow appropriate verification and escalation rules.
The standard service is intended to support communications and authorised administrative actions. It is not intended to act as an independent decision-maker for decisions such as credit eligibility, employment selection or other decisions with legal or similarly significant effects. Any such deployment requires a separate assessment, appropriate privacy information, a lawful basis, any additional legal conditions and applicable safeguards.
Where applicable law provides safeguards for a significant decision based solely on automated processing, these may include information about the decision, the opportunity to make representations, human intervention and the ability to challenge it. Contact the relevant customer business about its decisions, or contact us about processing for which Kallin is responsible. You can ask for a human contact route during an interaction.
17 Your privacy rights
Depending on the applicable law and circumstances, you may request access to and a copy of your personal information, correction of inaccurate information, erasure, restriction of processing, portability where applicable, or object to processing based on legitimate interests. You can withdraw consent where we rely on it. You can object to use for direct marketing, and we must stop processing for that marketing purpose. Applicable automated-decision safeguards are described above.
Some rights are conditional. For example, limited legal retention may prevent immediate erasure of a particular record. If a restriction or exemption applies, the responsible controller must assess it and explain the outcome as required. A request must not require you to purchase or renew a subscription.
For Kallin's controller processing, contact info@kallin.co.uk. You do not need to use a special form or legal wording. We may reasonably verify identity or authority to avoid disclosing another person's information. We respond without undue delay and normally within one calendar month, subject to lawful identity requirements, permitted clarification pauses and any applicable extension. We explain a lawful extension or refusal as required.
For customer communication data, the business you contacted normally handles the request as controller. We promptly refer relevant requests to it and assist with secure searches, correction, export, restriction and deletion under our agreement. We must also address our own processing and conduct. Searches and disclosures must protect other people's information.
18 Privacy complaints
You can complain about Kallin's handling of personal information by emailing info@kallin.co.uk. Please identify the issue and the information or interaction concerned. You can ask for an accessible alternative, and complaints received through another channel will be directed appropriately.
We acknowledge a privacy complaint within 30 days of receipt, investigate without undue delay, keep you appropriately informed and communicate the outcome. An acknowledgement is not the same as resolving the complaint or responding to a separate rights request. We address our own conduct and assist a customer controller where its processing is involved.
You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or another competent regulator where applicable. You do not have to complete our complaints process before exercising a statutory complaint right.
19 Changes to this policy
We review this policy as our service, processing or legal requirements change. The latest version and update date are made available with our legal information. For material changes affecting how we use personal information, we provide appropriate notice. We explain a proposed new purpose before starting the affected processing and obtain any permission required by law.
Updating this policy does not retrospectively authorise an incompatible use, replace a required consent or remove an individual's rights. Contractual changes and subprocessor changes also follow the applicable agreement and legal requirements.