Privacy Notice

Last updated: 7 October 2026

1. Who we are and our role in your data

Barritel Limited (company number 04101655), registered at 147a High Street, Waltham Cross, Hertfordshire EN8 7AP, is a telecommunications provider regulated by Ofcom. We provide business telephony, SIP trunking, telephone numbers, SMS, AI voice agents that answer and make calls, AI call analysis, AI email handling and related services. Some of these services are marketed under the Barbuck brand. Barbuck Limited (company number 07299619) owns that brand and does not act as a data controller for these services.

Our role depends on how your information reaches us, and it is worth being clear about the difference because it decides who you should contact:

• When you deal with us directly, because you contact us by telephone or email, or you are a contact at a client or supplier, Barritel Limited is the data controller. Section 2 covers this.
• When you call, email or message an organisation that uses our services, a car dealership or a warranty company for example, that organisation is the data controller and Barritel Limited is their data processor. We handle that information on their written instructions and we do not decide why or how it is processed. Section 3 covers this, and section 8 tells you where to send a request.
• When your call passes across our network, we are also a provider of public electronic communications services. Section 6 explains what that means for call records.

2. When you deal with us directly

What we collect. Your name, company, job title, email address and telephone number when you contact us. If you are a client contact, the records needed to run the account, provide support and bill for the service, including your telephone numbers, call records and service configuration. When you browse this website, information about your device and visit: IP address, browser type, referring pages, pages viewed, and date and time stamps.

If you telephone us. Calls to our own telephone numbers may be recorded, and may be answered or assisted by an automated voice agent. Where you are speaking to an automated agent, it will tell you so. We use the recording, and any transcript or analysis of it, to handle your enquiry, to train our own people, and to improve our service.

Why, and our lawful basis.

Where we rely on legitimate interests we have considered whether those interests are outweighed by your rights, and you can ask us for that assessment.

Cookies and similar technologies on this website. This website runs on Squarespace. Essential cookies needed to make the site work are set without consent, as the law allows. With your consent, given through the cookie banner, we also use:

• Squarespace analytics, to understand how visitors use this website.
• Google Analytics 4, for the same purpose.
• Google Ads, to measure the performance of our advertising.

We also use our own call tracking technology, provided by Calltracks Limited, a company in our group. It stores an identifier in your browser when you visit and links your browsing to a subsequent telephone call, so we can see which pages preceded a call to us. The identifier is kept for seven days unless you call us, and you can remove it at any time by clearing your browser's site data for barritel.com.

You can change your cookie choices at any time through the cookie banner or your browser settings. We do not currently respond to browser Do Not Track signals, as there is still no agreed standard for interpreting them.

How long we keep it. Enquiries from prospective clients: 24 months from our last contact with you, unless you become a client. Client account records, including billing records and call detail records: for the life of the contract and six years afterwards, to cover our legal, tax and regulatory obligations. Recordings of calls to our own numbers: six months. Website analytics data: in line with the retention settings of the tools named above.

3. When you deal with one of our clients

Our clients use our services to answer, route, record and understand their telephone calls, and to handle their email. In this situation our client is the data controller. They decide what is collected and why. We act only on their instructions.

Telephone calls. When you call a number we provide for a client, we hold the caller's telephone number, the number called, the time and duration, and the routing of the call. Where the client has asked us to, the call is recorded. It is the client's responsibility to tell you that calls are recorded, and why.

AI voice agents. Some clients use our AI voice agent to answer their calls, and in some cases to make agreed call-backs. This is what happens on such a call:

• You are told. The greeting tells you that you are speaking with an automated assistant. You can ask for a person at any point and the agent will transfer you or arrange a call-back.
• What the agent does. It listens to what you say, converts your speech to text, works out what you need using a language model, and replies in a synthesised voice. Depending on how the client has set it up it can answer questions about opening hours, locations and services, take your name and contact details, log the reason for your call, book or change an appointment, send you a confirmation text message, and transfer you to the right department. It follows a script and rules the client has approved; it does not improvise offers or make commitments on the client's behalf.
• What is recorded. The call audio, the transcript, the details you give, the agent's summary of the call, and the outcome (for example transferred, message taken, appointment booked). The client's staff see this in their reporting interface and may listen to the recording.
• What is sent to our AI providers. The audio and transcript pass to the speech and language providers listed on our sub-processor page, under contracts that forbid them from using it to train their models. Our voice agent platform deletes conversation data after seven days. We keep the recording and transcript for the client for the lifetime of the client's account, as set out below.
• What the agent does not do. It does not take payment card details. It does not try to judge your mood from your voice. It does not make decisions with legal or similar effect on you; where a decision follows, a person at the client makes it.
• Accuracy. Speech recognition and automated summaries can be wrong, particularly with names, registrations and reference numbers. If the agent has recorded something incorrectly, tell the client and they will correct it.

The client is the controller for these calls. It is the client's responsibility to tell you, in its own privacy notice, that it uses an automated assistant and records calls, and we require that of every client.

Email handling. Some clients connect their own mailboxes to our service. We retrieve and store the email in those mailboxes, sort it with the help of artificial intelligence, and prepare draft replies. A member of the client's staff reviews and approves every reply before it is sent. Nothing is sent to you by the system on its own. The client's email platform, Microsoft 365 or Google Workspace, remains the client's own.

SMS. Where a client sends text messages through us, we hold the message content, the sending and receiving numbers, and delivery status, on the client's instructions.

What we do with it. We compile this information and make it available to our client through their reporting interface. We do not use it for our own purposes, we do not sell it, and we do not combine it across clients to build a profile of you.

How long we keep it. For the lifetime of the client's account with us. When a client's contract ends, their data is deleted or returned as they instruct. Clients can also instruct us at any time to delete specific records, and we do so within 30 days. Some providers we use keep data for shorter periods: our voice agent platform, for example, deletes conversation data after seven days. Call detail records may be kept longer where the law requires it, as section 6 explains.

4. Artificial intelligence and automated analysis

Some of our services use artificial intelligence. We would rather tell you plainly what that means than leave you to guess.

What the AI does. Where a client has asked for it, we may:

• Answer calls and make call-backs using an automated voice agent, as described in section 3: speech recognition, a language model to understand and respond, and a synthesised voice to speak.
• Transcribe call recordings into text automatically, using speech recognition.
• Analyse that text to categorise what the call was about, identify whether the caller's enquiry was resolved, and highlight calls where a customer appears to have had a poor experience or where an opportunity looks to have been missed.
• Score calls against criteria the client sets, to help them review and improve how enquiries are handled.
• Read and sort email and draft replies for a person at the client to approve.

All of this is done for our client, as their processor, on their instructions.

What the AI does not do.

• We do not allow the providers of these AI systems to use client data to train their models.
• We do not analyse voice recordings to infer the emotional state of a client's staff. Assessing employees' emotions from their voice is something we have chosen not to build.
• We do not make automated decisions that produce legal effects for you, or similarly significantly affect you. Our analysis informs people; it does not decide. Where a client uses our scoring to review how their staff handled calls, we require that a person makes any decision that follows, not the system.

Accuracy. Automatic transcription and analysis are not perfect. They are a guide for our clients, not a record of record. If you believe something we hold about you is wrong, section 8 explains how to have it corrected.

5. Who else is involved

We use a small number of carefully selected suppliers to deliver these services. Each is bound by a written contract requiring them to protect your information, to act only on instructions, and to meet the standards the law requires of us. The current list, with what each one does and where the data sits, is published at barritel.com/sub-processors. Clients are told of any change to that list at least 30 days before it takes effect and may object, as our contracts provide.

Calls to and from our services are carried by UK public electronic communications networks. Those networks are independent controllers of their own communications data under the Communications Act 2003; they are not our suppliers in the sense above.

We will also share information where the law requires it, or to establish or defend legal claims.

6. Call records and the law

Because we provide public electronic communications services, we keep call detail records (who called whom, when and for how long, but not the content of calls) for the purposes of billing, network security and fraud prevention, and we may be required by law, including the Investigatory Powers Act 2016, to retain certain communications data and to disclose it to law enforcement and other public authorities on a lawful request. In respect of that retention and disclosure we act as a controller in our own right, as the law requires, and not on a client's instructions. Such records are kept separately from our operational systems, access to them is restricted, and they are deleted when the applicable retention period ends.

7. Where your information is held, and how we protect it

Our systems and the data held in them are hosted in the United Kingdom and the European Union: our telephony platform runs on Amazon Web Services in the EU and on our own equipment in data centres in London and Manchester, and our application platform is hosted in London and Ireland.

Some of our suppliers, in particular the providers of speech recognition, speech synthesis and language models, process information in the United States. Where that happens, we rely on the safeguards UK data protection law requires: contractual protections in the form of the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for details of the safeguards used for any particular transfer.

Our group holds ISO 9001 and ISO 27001 certification. In addition:

• Access to systems is controlled, reviewed regularly, and granted on the principle of least privilege, with multi-factor authentication on production systems.
• Data is encrypted in transit, and at rest on our cloud platforms.
• Each client's data is kept separate from every other client's.
• Card numbers detected in stored call or email content are removed.
• We engage accredited security specialists to test our infrastructure and procedures.
• Every change to a client record is logged: who changed it, when, and what it was before.

8. Your rights

You have the right to:

1. ask for a copy of the information we hold about you;
2. have inaccurate or incomplete information corrected;
3. ask us to erase information, in certain circumstances;
4. ask us to restrict how we use it, in certain circumstances;
5. ask us to transfer it to another organisation, in certain circumstances;
6. object to certain kinds of processing, including direct marketing, which you can stop at any time;
7. object to decisions made purely by automated means, including profiling;
8. withdraw your consent at any time, where we rely on consent; and
9. complain to the Information Commissioner's Office.

Where to send your request. Email customerservices@barritel.com, or write to us at the address in section 10.

If your request concerns a call, email or message you exchanged with another organisation, that organisation is the data controller and holds the right to decide the outcome. Send your request to them if you can. If you send it to us, we will pass it on promptly, tell you we have done so, and help them respond.

We will respond within one month where we are the controller. If a request is complex we may extend that, and we will tell you if so.

9. Changes to this notice

We review this notice regularly and will update it when our services or the law change. The date at the top shows when it was last revised. Where a change materially affects how we use your information, we will take reasonable steps to bring it to your attention.

10. Contact us

Barritel Limited
147a High Street, Waltham Cross, Hertfordshire EN8 7AP
Email: customerservices@barritel.com
Telephone: 0345 475 8802

If you are not satisfied with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.

About this notice. It is issued by Barritel Limited and covers the telecommunications and AI services it provides, including those marketed under the Barbuck brand. It is governed by, and should be read in line with, UK data protection law: the UK GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.